Spyware Warrior Spyware Warrior
Help with Spyware, Hijacking & Other Internet Nuisances
 
FAQ :: Search :: Memberlist :: Usergroups :: Register
Profile :: Log in to check your private messages :: Log in

New Ads by Name

 
Post new topic   This topic is locked: you cannot edit posts or make replies.    Spyware Warrior Forum Index -> Help with spyware removal
View previous topic :: View next topic  
Author Message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Wed Sep 16, 2015 7:22 am    Post subject: New Ads by Name Reply with quote

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.18015 BrowserJavaVersion: 11.31.2
Run by user at 15:52:29 on 2015-09-16
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.351.2070.18.3959.1007 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
c:\windows\system32\svchost.exe -k dcomlaunch
c:\windows\system32\svchost.exe -k rpcss
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted
C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted
c:\windows\system32\svchost.exe -k netsvcs
c:\windows\system32\svchost.exe -k gpsvcgroup
c:\windows\system32\svchost.exe -k localservice
C:\Windows\system32\atieclxx.exe
c:\windows\system32\svchost.exe -k networkservice
c:\windows\system32\svchost.exe -k localservicenonetwork
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\svchost.exe -k utcsvc
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
C:\Windows\system32\GWX\GWX.exe
C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\system32\taskeng.exe
c:\windows\system32\svchost.exe -k hpz12
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\system32\svchost.exe -k hpz12
C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
c:\windows\system32\svchost.exe -k imgsvc
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Microsoft Security Client\NisSrv.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\CCleaner\CCleaner64.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
C:\Users\user\Downloads\msert.exe
C:\Users\user\Downloads\msert.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Google\Update\Install\{3E7CAC7B-FB18-4D28-B93F-A363AB5DB052}\GoogleUpdateSetup.exe
C:\Program Files (x86)\GUMC275.tmp\GoogleUpdate.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = google.pt
uSearch Bar = google.pt
uSearch Page = google.pt
uDefault_Page_URL = google.pt
mStart Page = hxxp://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=hitachixhts545050b9a300_100317pbn40017cs63vex
mDefault_Page_URL = hxxp://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=hitachixhts545050b9a300_100317pbn40017cs63vex
uProxyOverride = <local>
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
BHO: Programa Auxiliar de Início de Sessão do Windows Live ID: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
uRun: [CCleaner Monitoring] "C:\Program Files (x86)\CCleaner\CCleaner64.exe" /MONITOR
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [MobileBroadband] C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe /silent
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
dRun: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\AUTOCA~1.LNK - C:\Program Files (x86)\Common Files\Autodesk Shared\acstart17.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: SoftwareSASGeneration = dword:1
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.0.1 192.168.0.1
TCP: Interfaces\{0E4938FD-0AAE-4307-BF34-F6CA5A63D726} : NameServer = 192.168.0.2 192.168.0.1
TCP: Interfaces\{35B37513-616A-41DE-B04C-CB43F2BA2CC4} : NameServer = 62.169.64.129 62.169.64.130
TCP: Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6} : DHCPNameServer = 192.168.0.1 192.168.0.1
TCP: Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}\65F6461666F6E656D2335354243413 : DHCPNameServer = 192.168.0.2 192.168.0.1 8.8.8.8
TCP: Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}\65F6461666F6E656D4F62696C65675966496D2536483137363 : DHCPNameServer = 192.168.0.1 192.168.0.1
TCP: Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}\8445340205F627471626C6560284F6473707F647 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}\E4F435D294E6475627E65647D2D4F66756C6D234136433 : DHCPNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}\F4074796D657374374F573035334 : DHCPNameServer = 192.168.1.1 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\45.0.2454.93\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = google.pt
x64-mSearch Page = google.pt
x64-mDefault_Page_URL = google.pt
x64-mDefault_Search_URL = google.pt
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
x64-Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
x64-Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
x64-Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\tpmjus6e.default-1442410384943\
FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrlui.dll
FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
FF - plugin: C:\Program Files (x86)\Veetle\Player\npvlc.dll
FF - plugin: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
FF - plugin: C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2015-3-4 280376]
R1 iSafeKrnl;YAC Mini-Filter Driver;C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [2015-9-15 260856]
R1 iSafeKrnlKit;YAC Kit Driver;C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [2015-9-15 110112]
R1 iSafeKrnlMon;YAC Monitor Driver;C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [2015-9-15 61832]
R1 iSafeKrnlR3;YAC Ring3 Driver;C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [2015-9-15 103904]
R1 iSafeNetFilter;YAC NDIS Driver;C:\Windows\System32\drivers\iSafeNetFilter.sys [2015-9-15 68488]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-4-29 202752]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-1-28 249200]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 DiagTrack;Diagnostics Tracking Service;C:\Windows\System32\svchost.exe -k utcsvc [2009-7-14 27136]
R2 iSafeService;YAC Service;C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [2015-9-15 118048]
R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2013-3-19 377704]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2012-11-29 16056]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2013-4-12 72216]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2010-10-24 124568]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\Windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
R3 CnxtHdmiAudService;Conexant UAA HDMI Function Driver for High Definition Audio Service;C:\Windows\System32\drivers\CHDMI64.sys [2010-3-5 720952]
R3 FwLnk;FwLnk Driver;C:\Windows\System32\drivers\FwLnk.sys [2010-4-1 9216]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-4-29 56344]
R3 huawei_enumerator;huawei_enumerator;C:\Windows\System32\drivers\ew_jubusenum.sys [2013-1-29 86016]
R3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-2-10 158720]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-4-20 169584]
R3 PGEffect;Pangu effect driver;C:\Windows\System32\drivers\PGEffect.sys [2010-4-1 35008]
R3 vodafone_K3805-z_dc_enum;Vodafone K3805-z DC Enumerator (ZTE);C:\Windows\System32\drivers\vodafone_K3805-z_dc_enum.sys [2010-3-1 75776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-4-12 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-4-11 124088]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe [2014-12-11 89864]
S3 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2015-5-6 282112]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\Windows\System32\drivers\ew_hwusbdev.sys [2013-1-29 117248]
S3 ew_usbenumfilter;huawei_CompositeFilter;C:\Windows\System32\drivers\ew_usbenumfilter.sys [2013-1-29 13952]
S3 ewusbnet;HUAWEI USB-NDIS miniport;C:\Windows\System32\drivers\ewusbnet.sys [2013-1-29 415232]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-2-26 1432400]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2012-4-16 48488]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-3-8 1492840]
S3 HTCAND64;HTC Device Driver;C:\Windows\System32\drivers\ANDROIDUSB.sys [2009-11-1 33736]
S3 htcnprot;HTC NDIS Protocol Driver;C:\Windows\System32\drivers\htcnprot.sys [2010-6-25 36928]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2015-9-9 114688]
S3 iSafeKrnlBoot;YAC Boot Driver;C:\Windows\System32\drivers\iSafeKrnlBoot.sys [2015-9-15 53568]
S3 massfilter;MBB Mass Storage Filter Driver;C:\Windows\System32\drivers\massfilter.sys [2011-5-6 11776]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-4-12 19456]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-4-1 232992]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-4-12 57856]
S3 vodafone_K3805-z_cdc_acm;Vodafone K3805-z CDC-ACM driver (ZTE);C:\Windows\System32\drivers\vodafone_K3805-z_cdc_acm.sys [2010-3-1 78336]
S3 vodafone_K3805-z_cdc_ecm;vodafone_K3805-z_cdc_ecm;C:\Windows\System32\drivers\vodafone_K3805-z_cdc_ecm.sys [2010-3-1 88576]
S3 vodafone_K3805-z_cpo;Vodafone K3805-z Install;C:\Windows\System32\drivers\vodafone_K3805-z_cpo.sys [2010-3-1 13824]
.
=============== File Associations ===============
.
FileExt: .scr: AutoCADLTScriptFile="C:\Windows\System32\NOTEPAD.EXE" "%1"
.
=============== Created Last 30 ================
.
2015-09-16 14:49:09 6420480 ----a-w- C:\Program Files (x86)\GUTC286.tmp
2015-09-16 14:49:09 -------- d-----w- C:\Program Files (x86)\GUMC275.tmp
2015-09-16 13:27:00 -------- d-----w- C:\Users\user\AppData\Local\Mozilla
2015-09-16 13:23:25 -------- d-----w- C:\Users\user\AppData\Local\VirtualStore
2015-09-16 13:22:08 75888 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{04569B4F-8AE6-43B5-B489-4D75410FC4E8}\offreg.128.dll
2015-09-16 12:26:10 11745192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{04569B4F-8AE6-43B5-B489-4D75410FC4E8}\mpengine.dll
2015-09-16 10:49:58 -------- d-s---w- C:\Windows\SysWow64\Microsoft
2015-09-16 10:32:18 -------- d-----w- C:\Users\user\AppData\Roaming\Dropbox
2015-09-16 10:29:40 -------- d-----w- C:\ProgramData\Dropbox
2015-09-16 10:29:40 -------- d-----w- C:\Program Files (x86)\Dropbox
2015-09-15 17:29:50 68488 ----a-w- C:\Windows\System32\drivers\iSafeNetFilter.sys
2015-09-15 17:29:50 53568 ----a-w- C:\Windows\System32\drivers\iSafeKrnlBoot.sys
2015-09-15 17:29:49 -------- d-----w- C:\Windows\System32\log
2015-09-15 17:29:08 -------- d-----w- C:\Program Files (x86)\Elex-tech
2015-09-15 17:14:54 -------- d-----w- C:\Users\user\AppData\Roaming\Elex-tech
2015-09-15 16:11:52 -------- d-----w- C:\Windows\SysWow64\vbox
2015-09-15 16:11:52 -------- d-----w- C:\Windows\System32\vbox
2015-09-15 16:11:16 -------- d-----w- C:\Users\user\AppData\Roaming\AVAST Software
2015-09-15 16:02:51 -------- d-----w- C:\ProgramData\AVAST Software
2015-09-15 14:54:22 13824 ----a-w- C:\Windows\System32\ffnd.exe
2015-09-15 13:26:29 11745192 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-09-15 10:45:19 -------- d-----w- C:\ProgramData\HitmanPro
2015-09-15 09:02:13 11745192 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8B3DA8A1-7DB3-4E60-9B71-87633425B9B7}\mpengine.dll
2015-09-14 22:10:52 113880 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2015-09-14 22:10:29 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2015-09-14 22:10:29 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2015-09-14 22:10:29 109272 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2015-09-14 22:10:29 -------- d-----w- C:\ProgramData\Malwarebytes
2015-09-14 22:10:29 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-14 22:10:03 -------- d-----w- C:\Users\user\AppData\Local\Programs
2015-09-14 16:05:37 -------- d-----w- C:\ProgramData\VIPRE
2015-09-14 15:57:48 -------- d-----w- C:\ProgramData\STOPzilla!
2015-09-14 15:57:31 -------- d-----w- C:\Program Files (x86)\iS3
2015-09-09 10:23:29 2004480 ----a-w- C:\Windows\System32\msxml6.dll
2015-09-09 10:23:28 1887232 ----a-w- C:\Windows\System32\msxml3.dll
2015-09-09 10:23:27 1391104 ----a-w- C:\Windows\SysWow64\msxml6.dll
2015-09-09 10:23:26 2048 ----a-w- C:\Windows\SysWow64\msxml6r.dll
2015-09-09 10:23:26 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll
2015-09-09 10:23:26 2048 ----a-w- C:\Windows\System32\msxml6r.dll
2015-09-09 10:23:26 1241088 ----a-w- C:\Windows\SysWow64\msxml3.dll
2015-09-09 10:23:25 2048 ----a-w- C:\Windows\System32\msxml3r.dll
2015-09-09 10:22:50 616360 ----a-w- C:\Windows\System32\winresume.efi
2015-09-09 10:22:50 147456 ----a-w- C:\Windows\System32\appidpolicyconverter.exe
2015-09-09 10:22:49 692672 ----a-w- C:\Windows\System32\winload.efi
2015-09-09 10:22:49 59392 ----a-w- C:\Windows\System32\appidapi.dll
2015-09-09 10:22:49 32768 ----a-w- C:\Windows\System32\appidsvc.dll
2015-09-09 10:22:48 50688 ----a-w- C:\Windows\SysWow64\appidapi.dll
2015-09-09 10:22:45 63488 ----a-w- C:\Windows\System32\setbcdlocale.dll
2015-09-09 10:22:45 61440 ----a-w- C:\Windows\System32\drivers\appid.sys
2015-09-09 10:22:45 17920 ----a-w- C:\Windows\System32\appidcertstorecheck.exe
2015-09-09 10:19:12 -------- d-----w- C:\Users\user\AppData\Local\Autodesk
2015-09-09 10:15:35 -------- d-----w- C:\Users\user\AppData\Local\Adobe
2015-09-08 17:23:52 -------- d-----w- C:\Users\user\AppData\Local\Macromedia
2015-09-08 17:19:37 -------- d-----w- C:\Users\user\AppData\Local\Toshiba
2015-09-08 17:19:28 -------- d-----w- C:\Users\user\AppData\Local\LogMeIn
2015-09-04 08:46:55 1190000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EC088A68-5167-4D57-AA54-095D36FD75A6}\gapaengine.dll
.
==================== Find3M ====================
.
2015-09-02 03:04:49 41984 ----a-w- C:\Windows\System32\lpk.dll
2015-09-02 03:04:46 100864 ----a-w- C:\Windows\System32\fontsub.dll
2015-09-02 03:04:44 14336 ----a-w- C:\Windows\System32\dciman32.dll
2015-09-02 03:04:42 46080 ----a-w- C:\Windows\System32\atmlib.dll
2015-09-02 02:48:31 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
2015-09-02 02:48:28 10240 ----a-w- C:\Windows\SysWow64\dciman32.dll
2015-09-02 02:48:25 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2015-09-02 02:47:18 25600 ----a-w- C:\Windows\SysWow64\lpk.dll
2015-09-02 01:51:28 3209216 ----a-w- C:\Windows\System32\win32k.sys
2015-09-02 01:47:08 372736 ----a-w- C:\Windows\System32\atmfd.dll
2015-09-02 01:33:48 299520 ----a-w- C:\Windows\SysWow64\atmfd.dll
2015-08-26 18:07:11 98304 ----a-w- C:\Windows\System32\wudriver.dll
2015-08-26 18:07:11 3165696 ----a-w- C:\Windows\System32\wucltux.dll
2015-08-26 18:07:11 192000 ----a-w- C:\Windows\System32\wuwebv.dll
2015-08-26 18:06:43 91136 ----a-w- C:\Windows\System32\WinSetupUI.dll
2015-08-26 18:06:33 12288 ----a-w- C:\Windows\System32\wu.upgrade.ps.dll
2015-08-26 18:06:30 37376 ----a-w- C:\Windows\System32\wuapp.exe
2015-08-26 17:56:25 93184 ----a-w- C:\Windows\SysWow64\wudriver.dll
2015-08-26 17:56:25 173056 ----a-w- C:\Windows\SysWow64\wuwebv.dll
2015-08-26 17:55:37 34816 ----a-w- C:\Windows\SysWow64\wuapp.exe
2015-08-15 06:34:10 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2015-08-15 06:33:56 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2015-08-15 06:18:47 66560 ----a-w- C:\Windows\System32\iesetup.dll
2015-08-15 06:18:00 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2015-08-15 06:17:54 417792 ----a-w- C:\Windows\System32\html.iec
2015-08-15 06:17:49 585216 ----a-w- C:\Windows\System32\vbscript.dll
2015-08-15 06:17:25 88064 ----a-w- C:\Windows\System32\MshtmlDac.dll
2015-08-15 06:04:47 114688 ----a-w- C:\Windows\System32\ieetwcollector.exe
2015-08-15 06:04:46 144384 ----a-w- C:\Windows\System32\ieUnatt.exe
2015-08-15 06:04:25 814080 ----a-w- C:\Windows\System32\jscript9diag.dll
2015-08-15 06:00:44 5923328 ----a-w- C:\Windows\System32\jscript9.dll
2015-08-15 05:57:20 968704 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
2015-08-15 05:53:22 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2015-08-15 05:46:15 77824 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
2015-08-15 05:40:29 504832 ----a-w- C:\Windows\SysWow64\vbscript.dll
2015-08-15 05:40:12 62464 ----a-w- C:\Windows\SysWow64\iesetup.dll
2015-08-15 05:39:32 47616 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2015-08-15 05:39:22 341504 ----a-w- C:\Windows\SysWow64\html.iec
2015-08-15 05:38:34 64000 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
2015-08-15 05:29:36 115712 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2015-08-15 05:29:12 620032 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2015-08-15 05:22:47 1359360 ----a-w- C:\Windows\System32\mshtmlmedia.dll
2015-08-15 05:22:03 2126336 ----a-w- C:\Windows\System32\inetcpl.cpl
2015-08-15 05:16:37 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
2015-08-15 05:10:32 4520448 ----a-w- C:\Windows\SysWow64\jscript9.dll
2015-08-15 05:07:28 2427392 ----a-w- C:\Windows\System32\wininet.dll
2015-08-15 05:01:47 2052608 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2015-08-15 05:01:23 1155072 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
2015-08-15 04:43:00 1951232 ----a-w- C:\Windows\SysWow64\wininet.dll
2015-08-14 18:18:25 778440 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2015-08-14 18:18:24 142536 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2015-08-05 17:56:14 1110016 ----a-w- C:\Windows\System32\schedsvc.dll
2015-08-05 17:56:07 24576 ----a-w- C:\Windows\System32\jnwmon.dll
2015-08-05 17:56:06 275456 ----a-w- C:\Windows\System32\InkEd.dll
2015-08-05 17:40:50 216064 ----a-w- C:\Windows\SysWow64\InkEd.dll
2015-07-30 18:06:57 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll
2015-07-30 18:06:57 1648128 ----a-w- C:\Windows\System32\DWrite.dll
2015-07-30 18:06:57 1180160 ----a-w- C:\Windows\System32\FntCache.dll
2015-07-30 17:57:30 1987584 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
2015-07-30 17:57:30 1251328 ----a-w- C:\Windows\SysWow64\DWrite.dll
2015-07-30 13:13:38 103120 ----a-w- C:\Windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-07-30 13:13:11 124624 ----a-w- C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2015-07-28 20:09:44 17344 ----a-w- C:\Windows\System32\CompatTelRunner.exe
2015-07-28 20:05:53 774656 ----a-w- C:\Windows\System32\invagent.dll
2015-07-28 20:05:50 743424 ----a-w- C:\Windows\System32\generaltel.dll
2015-07-28 20:05:47 437760 ----a-w- C:\Windows\System32\devinv.dll
2015-07-28 20:05:45 1116672 ----a-w- C:\Windows\System32\appraiser.dll
2015-07-28 20:05:44 69120 ----a-w- C:\Windows\System32\acmigration.dll
2015-07-28 20:05:44 227328 ----a-w- C:\Windows\System32\aepdu.dll
2015-07-28 19:55:14 1148416 ----a-w- C:\Windows\System32\aeinv.dll
2015-07-23 00:06:26 5568960 ----a-w- C:\Windows\System32\ntoskrnl.exe
2015-07-23 00:06:25 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2015-07-23 00:06:25 155584 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2015-07-23 00:03:19 1730496 ----a-w- C:\Windows\System32\ntdll.dll
2015-07-23 00:03:07 362496 ----a-w- C:\Windows\System32\wow64win.dll
2015-07-23 00:03:07 243712 ----a-w- C:\Windows\System32\wow64.dll
2015-07-23 00:03:07 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2015-07-23 00:03:06 215040 ----a-w- C:\Windows\System32\winsrv.dll
2015-07-23 00:01:53 31232 ----a-w- C:\Windows\System32\lsass.exe
2015-07-23 00:01:39 338432 ----a-w- C:\Windows\System32\conhost.exe
2015-07-23 00:01:32 64000 ----a-w- C:\Windows\System32\auditpol.exe
2015-07-22 23:58:17 60416 ----a-w- C:\Windows\System32\msobjs.dll
2015-07-22 23:57:53 146432 ----a-w- C:\Windows\System32\msaudite.dll
2015-07-22 23:51:59 686080 ----a-w- C:\Windows\System32\adtschema.dll
2015-07-22 17:57:49 3989952 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2015-07-22 17:57:49 3934656 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2015-07-22 17:54:12 1311768 ----a-w- C:\Windows\SysWow64\ntdll.dll
2015-07-22 17:52:52 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2015-07-22 17:52:19 50176 ----a-w- C:\Windows\SysWow64\auditpol.exe
2015-07-22 17:52:03 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2015-07-22 17:52:03 665088 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2015-07-22 17:52:03 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2015-07-22 17:52:03 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2015-07-22 17:47:28 60416 ----a-w- C:\Windows\SysWow64\msobjs.dll
2015-07-22 17:46:50 146432 ----a-w- C:\Windows\SysWow64\msaudite.dll
2015-07-22 16:48:49 41984 ----a-w- C:\Windows\System32\UtcResources.dll
2015-07-22 16:45:48 159232 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
2015-07-22 16:44:51 290816 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2015-07-22 16:44:45 129024 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
2015-07-22 16:34:31 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
.
============= FINISH: 15:58:18,24 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 22-06-2010 01:17:46
System Uptime: 16-09-2015 14:20:57 (1 hours ago)
.
Motherboard: TOSHIBA | | Portable PC
Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz | CPU | 2267/1066mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 140,252 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 220,144 GiB free.
E: is CDROM ()
F: is CDROM (CDFS)
H: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsla2bde8c8
Device ID: ROOT\LEGACY_MPKSLA2BDE8C8\0000
Manufacturer:
Name: MpKsla2bde8c8
PNP Device ID: ROOT\LEGACY_MPKSLA2BDE8C8\0000
Service: MpKsla2bde8c8
.
Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: Photosmart C6300 series
Device ID: ROOT\IMAGE\0001
Manufacturer: HP
Name: Photosmart C6300 series
PNP Device ID: ROOT\IMAGE\0001
Service: StillCam
.
Class GUID:
Description: Photosmart C6300 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer:
Name: Photosmart C6300 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID:
Description: 2260ij
Device ID: ROOT\MULTIFUNCTION\0001
Manufacturer:
Name: 2260ij
PNP Device ID: ROOT\MULTIFUNCTION\0001
Service:
.
Class GUID:
Description: Photosmart C6300 series
Device ID: ROOT\MULTIFUNCTION\0002
Manufacturer:
Name: Photosmart C6300 series
PNP Device ID: ROOT\MULTIFUNCTION\0002
Service:
.
Class GUID:
Description: Photosmart C6300 series
Device ID: ROOT\MULTIFUNCTION\0003
Manufacturer:
Name: Photosmart C6300 series
PNP Device ID: ROOT\MULTIFUNCTION\0003
Service:
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart C6300 series
Device ID: ROOT\MULTIFUNCTION\0004
Manufacturer: HP
Name: Photosmart C6300 series
PNP Device ID: ROOT\MULTIFUNCTION\0004
Service:
.
Class GUID: {4d36e97d-e325-11ce-bfc1-08002be10318}
Description: DAEMON Tools Virtual Bus
Device ID: ROOT\SYSTEM\0001
Manufacturer: DT Soft Ltd
Name: DAEMON Tools Virtual Bus
PNP Device ID: ROOT\SYSTEM\0001
Service: dtsoftbus01
.
Class GUID:
Description:
Device ID: ROOT\WPD\0000
Manufacturer:
Name:
PNP Device ID: ROOT\WPD\0000
Service:
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Adaptador de Túnel Teredo da Microsoft
Device ID: ROOT\*TEREDO\0000
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TEREDO\0000
Service: tunnel
.
==== System Restore Points ===================
.
RP779: 16-09-2015 11:49:02 - avast! antivirus system restore point
RP780: 16-09-2015 13:19:44 - Removed Suporte para Aplicações Apple
RP781: 16-09-2015 13:21:37 - Removed Apple Software Update
RP782: 16-09-2015 13:22:54 - Removed HTC Sync.
RP783: 16-09-2015 13:27:13 - Removed HTC Driver Installer.
RP784: 16-09-2015 13:28:24 - Removed HTC BMP USB Driver.
RP785: 16-09-2015 13:30:06 - Removed eBay
.
==== Installed Programs ======================
.
64 Bit HP CIO Components Installer
7-Zip 4.65 (x64 edition)
7-Zip 9.21beta
Adobe AIR
Adobe Flash Player 18 ActiveX
Adobe Flash Player 18 NPAPI
Adobe Reader XI (11.0.10) - Português
Advertising Center
Akamai NetSession Interface
Alerta de HDD/SSD TOSHIBA
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
ATI Catalyst Install Manager
µTorrent
Auslogics Disk Defrag
AutoCAD LT 2007 - English
Autodesk DWG TrueView 2014
Bluetooth Stack for Windows by Toshiba
Broadcom 802.11 Network Adapter
Brother MFL-Pro Suite DCP-J4120DW
BufferChm
C6300
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
Complemento Messenger
Conexant Audio Driver For AMD HDMI Codec
Conexant HD Audio
Controlo ActiveX do Windows Live Mesh para Ligações Remotas
CutePDF Professional 3.6 (Evaluation)
CutePDF Writer 3.0
D3DX10
DAEMON Tools Lite
Definition Update for Microsoft Office 2010 (KB3085525) 32-Bit Edition
DocProc
DWG TrueView 2012
DWG TrueView 2014
Facebook Video Calling 1.2.0.287
FARO LS 1.1.406.58
Folder Size for Windows (64-bit)
Galeria de Fotografias do Windows Live
GOM Player
Google Apps Migration For Microsoft Outlook® 3.4.27.52
Google Apps Sync™ for Microsoft Outlook® 3.7.410.1100
Google Chrome
Google Drive
Google Earth
Google SketchUp 8
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService2
gpedt.msc 1.0
HP Photosmart C6300 All-In-One Driver Software 13.0 Rel. 4
HP Photosmart Essential 3.5
HP Smart Web Printing 4.60
HP Solution Center 13.0
HP Support Solutions Framework
HP Update
HPDiagnosticAlert
HPPhotoGadget
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPProductAssistant
HPSSupply
HTC Driver Installer
ImagXpress
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
Intel(R) Turbo Boost Technology Driver
Java 8 Update 31
Java 8 Update 31 (64-bit)
Java Auto Updater
Java(TM) 6 Update 17
JavaFX 2.1.1
Junk Mail filter update
LogMeIn
Malwarebytes Anti-Malware versão 2.1.8.1057
Mesh Runtime
Microsoft .NET Framework 4.5.1 (Português)
Microsoft .NET Framework 4.5.1 (PTG)
Microsoft .NET Framework 4.5.2
Microsoft Antimalware Service PT-PT Language Pack
Microsoft Application Error Reporting
Microsoft IntelliPoint 8.2
Microsoft Office Access MUI (Portuguese (Brazil)) 2010
Microsoft Office Excel MUI (Portuguese (Brazil)) 2010
Microsoft Office Groove MUI (Portuguese (Brazil)) 2010
Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2010
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (Portuguese (Brazil)) 2010
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (Portuguese (Brazil)) 2010
Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Project MUI (English) 2010
Microsoft Office Project Professional 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Portuguese (Brazil)) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Proofing (Portuguese (Brazil)) 2010
Microsoft Office Publisher MUI (Portuguese (Brazil)) 2010
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit MUI (Portuguese (Brazil)) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared MUI (Portuguese (Brazil)) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (Portuguese (Brazil)) 2010
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
Microsoft Project Professional 2010
Microsoft Security Client
Microsoft Security Client PT-PT Language Pack
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
Microsoft Works
Mozilla Firefox 40.0.3 (x86 pt-PT)
Mozilla Maintenance Service
MSVC80_x64_v2
MSVC80_x86_v2
MSVC90_x64
MSVC90_x86
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB2758694)
MSXML 4.0 SP3 Parser (KB973685)
Nero 9 Essentials
Nero BackItUp
Nero BackItUp and Burn
Nero BurnRights
Nero BurnRights Help
Nero ControlCenter
Nero DiscSpeed
Nero DiscSpeed Help
Nero DriveSpeed
Nero DriveSpeed Help
Nero Express
Nero Express Help
Nero InfoTool
Nero InfoTool Help
Nero Installer
Nero Online Upgrade
Nero RescueAgent
Nero StartSmart
Nero StartSmart Help
NeroExpress
neroxml
Network64
Nokia Connectivity Cable Driver
Nokia Ovi Suite
Nokia Ovi Suite Software Updater
Nokia PC Internet Access
Nuance PaperPort 12
Nuance PDF Viewer Plus
OCR Software by I.R.I.S. 13.0
Ovi Desktop Sync Engine
OviMPlatform
Pacote de controladores do Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)
PaperPort Image Printer 64-bit
PC Connectivity Solution
PDFCreator
Photo Service - powered by myphotobook
PlayReady PC Runtime amd64
Power Commander Control Center 3.2.0 (Test Build 1)
PrimoPDF -- by Nitro PDF Software
PS_AIO_04_C6300_Software_Min
QuickTime
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
Realtek USB 2.0 Card Reader
RealUpgrade 1.1
Scan
Scansoft PDF Professional
Security Update for Microsoft .NET Framework 4.5.2 (KB3023224)
Security Update for Microsoft .NET Framework 4.5.2 (KB3035490)
Security Update for Microsoft .NET Framework 4.5.2 (KB3037581)
Security Update for Microsoft .NET Framework 4.5.2 (KB3074230)
Security Update for Microsoft .NET Framework 4.5.2 (KB3074550)
Security Update for Microsoft Excel 2010 (KB3085526) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553313) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589288) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598244) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2760781) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2881071) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2920748) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2956076) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2965310) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB3054848) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB3054965) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2920812) 32-Bit Edition
Security Update for Microsoft Visio 2010 (KB3054876) 32-Bit Edition
Security Update for Microsoft Word 2010 (KB2553428) 32-Bit Edition
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Shop for HP Supplies
Skype™ 7.0
SmartWebPrinting
SolutionCenter
Synaptics Pointing Device Driver
Toolbox
Toshiba Assist
TOSHIBA Bulletin Board
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA eco Utility
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
Toshiba Manuals
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
TOSHIBA Online Product Information
TOSHIBA PC Health Monitor
TOSHIBA Recovery Media Creator
TOSHIBA Recovery Media Creator Reminder
TOSHIBA ReelTime
TOSHIBA Service Station
TOSHIBA Supervisor Password
TOSHIBA TEMPRO
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
TRORMCLauncher
Undelete 360
Unity Web Player
UnloadSupport
Update for Microsoft Access 2010 (KB2965300) 32-Bit Edition
Update for Microsoft Excel 2010 (KB2956084) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2881026) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553140) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553347) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589318) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589386) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597089) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687275) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
Update for Microsoft Office 2010 (KB2883019) 32-Bit Edition
Update for Microsoft Office 2010 (KB2889828) 32-Bit Edition
Update for Microsoft Office 2010 (KB2910896) 32-Bit Edition
Update for Microsoft Office 2010 (KB2965301) 32-Bit Edition
Update for Microsoft Office 2010 (KB3054873) 32-Bit Edition
Update for Microsoft Office 2010 (KB3054962) 32-Bit Edition
Update for Microsoft Office 2010 (KB3054964) 32-Bit Edition
Update for Microsoft Office 2010 (KB3055042) 32-Bit Edition
Update for Microsoft Office 2010 (KB3055047) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2956075) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2965297) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB3085522) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553308) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB3085513) 32-Bit Edition
Update for Microsoft Project 2010 (KB2553251) 32-Bit Edition
Update for Microsoft Project 2010 (KB3085531) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2881021) 32-Bit Edition
Update for Microsoft Word 2010 (KB3085518) 32-Bit Edition
Veetle TV
Viber
Vodafone Mobile Broadband Lite
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinRAR 4.20 (64-bit)
XnView 2.13
YAC(Yet Another Cleaner!)
YouSendIt Plug-in for Outlook
.
==== End Of File ===========================

My pc was infected and "Ads by name" keeps coming up. Ads appear and web pages changes. No error messages apear.
Its only on firefox hasn't appeared on Crome.
I've reset bookmarks on firefox and even reseted firefox and the problem continues.
I've downloaded adwcleaner, hitmanpro, malwarebytes anti-malaware, yac, ccleaner and others but non found my problem.
Can you help me?

Best regards
Ricardo
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Wed Sep 16, 2015 8:18 am    Post subject: Reply with quote

Looking over your logs, back soon.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Wed Sep 16, 2015 8:28 am    Post subject: Reply with quote

Quote:
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the "Help with spyware removal" forum and wait for help.


Unless informed of in advance, failure to post replies within 3 days will result in this thread being closed.


Hi Mariani

I'm Gary R,

Before we start: Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

As an added safety precaution, before we start removing anything, I'd like you to make a backup of your Registry, which we can restore to if necessary.

Please click on THIS link, and follow the instructions for installing TCRB and creating a backup of your Registry.

Please observe these rules while we work:

  • Do not edit your logs in any way whatsoever.
  • Perform all actions in the order given.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with it till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to install any new software (other than those I ask you to) until we've got your computer clean.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. If your defensive programmes warn you about any of those tools, be assured that they are not infected, and are safe to use.

If you can do these things, everything should go smoothly.

  • As you're using Windows 7, it will be necessary to right click all tools we use and select ----> Run as Administrator


Quote:
It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.


There are definitely signs of infection in the logs you've supplied, but before we start removing anything I'd like you to run some additional scans for me.

First ...


  • Download FRST64 to your Desktop.
  • Double click Frst.exe to launch it.
  • FRST will start to run.

    • When the tool opens click Yes to disclaimer.
    • Press the Scan button.
    • When finished scanning 2 logs will open on your Desktop, FRST.txt and Addition.txt
    • Please post them in your next reply.



Next ...

Please download AdwCleaner and save it to your desktop.


  • Double click AdwCleaner.exe to run it.
  • Click Scan.
  • A logfile will automatically open after the scan has finished.
  • Close the adwCleaner window, click ok to the prompt.
  • Please post the contents of that logfile with your next reply.
  • You can also find the logfile at C:\AdwCleaner[R1].txt. (if you've run ADWCleaner before it probably won't be R1 it will be some other number)


AT THIS POINT, DO NOT ATTEMPT TO CLEAN ANYTHING THAT MAY BE FOUND

Summary of the logs I need from you in your next post:

  • FRST.txt
  • Addition.txt
  • ADWCleaner log


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Wed Sep 16, 2015 9:54 am    Post subject: FRST/Addition/Adwcleaner Reply with quote

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:15-09-2015
Ran by user (administrator) on LT-CGF-06-RM (16-09-2015 18:45:49)
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Português (Portugal)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Piriform Ltd) C:\Program Files (x86)\CCleaner\CCleaner64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [MobileBroadband] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [280576 2011-10-19] (Vodafone)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google)
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\SysWOW64\AcSignIcon.dll [2006-03-05] (Autodesk)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk [2010-07-05]
ShortcutTarget: AutoCAD LT Startup Accelerator.lnk -> C:\Program Files (x86)\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-04-01]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-04-01]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-10-29]
ShortcutTarget: Dropbox.lnk -> C:\Users\Miguel Rufino\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2012-10-24]
ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: SBBD.exe /D \Device\HarddiskVolume2\Program Files (x86)\iS3\STOPzilla AntiVirus\Definitions /Lautocheck autochk *
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicyScripts-x32: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{0E4938FD-0AAE-4307-BF34-F6CA5A63D726}: [NameServer] 192.168.0.2 192.168.0.1
Tcpip\..\Interfaces\{35B37513-616A-41DE-B04C-CB43F2BA2CC4}: [NameServer] 62.169.64.129 62.169.64.130
Tcpip\..\Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}: [DhcpNameServer] 192.168.0.1 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = google.pt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
SearchScopes: HKLM -> {017B0775-6C88-46AE-94C1-19A762DB2CDF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {E0C54028-5F27-42C6-93E8-236439369459} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Programa Auxiliar de Início de Sessão do Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-16] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-03-19] (<TOSHIBA>)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-16] (Google Inc.)
Toolbar: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\tpmjus6e.default-1442410384943
FF NewTab: google.pt
FF Homepage: google.pt
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-14] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-14] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2013-02-04] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 -> c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2013-02-04] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll [2012-01-14] (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll [2012-01-14] (Veetle Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-944797692-3693780693-2233505248-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-22] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll [2013-02-04] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprjplug.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll [2013-02-04] (RealPlayer)
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: No Name - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-02-04]
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension [2011-08-17]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\prefs.js [2015-09-14]

Chrome:
=======
CHR HomePage: Default -> google.pt
CHR StartupUrls: Default -> "google.pt"
CHR DefaultSearchURL: Default -> hxxp://www.google.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> google
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-09]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-09-09]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-09]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-09-09]
CHR Extension: (Documentos do Google offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-10]
CHR Extension: (RealDownloader) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2015-09-09]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-09-10]
CHR Extension: (Pagamentos via Chrome Web Store) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-10]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-09]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (No Name) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-28]
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\user\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [77944 2010-07-05] (Autodesk)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-04-16] (Elex do Brasil Participações Ltda)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-16] (LogMeIn, Inc.)
S4 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-16] (LogMeIn, Inc.)
S4 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 CnxtHdmiAudService; C:\Windows\System32\drivers\CHDMI64.sys [720952 2010-03-05] (Conexant Systems Inc.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [415232 2011-10-18] (Huawei Technologies Co., Ltd.)
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-14] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [53568 2015-04-16] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [61832 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2015-09-01] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [68488 2015-08-26] (Elex do Brasil Participações Ltda)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-30] (LogMeIn, Inc.)
S4 LMIRfsClientNP; no ImagePath
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 vodafone_K3805-z_cdc_acm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_acm.sys [78336 2010-03-01] (Vodafone)
S3 vodafone_K3805-z_cdc_ecm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_ecm.sys [88576 2010-03-01] (Vodafone)
S3 vodafone_K3805-z_cpo; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cpo.sys [13824 2010-03-01] (Vodafone)
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-16 18:47 - 2015-09-16 18:47 - 01660416 _____ C:\Users\user\Downloads\AdwCleaner(1).exe
2015-09-16 18:45 - 2015-09-16 18:47 - 00031423 _____ C:\Users\user\Desktop\FRST.txt
2015-09-16 18:45 - 2015-09-16 18:45 - 00000000 ____D C:\FRST
2015-09-16 18:44 - 2015-09-16 18:44 - 02191360 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2015-09-16 18:44 - 2015-09-16 18:44 - 02191360 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2015-09-16 18:40 - 2015-09-16 18:40 - 00000207 _____ C:\Windows\tweaking.com-regbackup-LT-CGF-06-RM-Windows-7-Home-Premium-(64-bit).dat
2015-09-16 18:40 - 2015-09-16 18:40 - 00000000 ____D C:\RegBackup
2015-09-16 18:39 - 2015-09-16 18:39 - 00002242 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-09-16 18:39 - 2015-09-16 18:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-09-16 18:39 - 2015-09-16 18:39 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-09-16 18:38 - 2015-09-16 18:38 - 04687376 _____ (Tweaking.com) C:\Users\user\Downloads\tweaking.com_registry_backup_setup.exe
2015-09-16 18:21 - 2015-09-16 18:21 - 00000000 ____D C:\Users\user\AppData\Local\GWX
2015-09-16 15:58 - 2015-09-16 15:59 - 00031472 _____ C:\Users\user\Desktop\dds.txt
2015-09-16 15:58 - 2015-09-16 15:59 - 00015920 _____ C:\Users\user\Desktop\attach.txt
2015-09-16 15:51 - 2015-09-16 15:51 - 00688992 ____R (Swearware) C:\Users\user\Desktop\dds.com
2015-09-16 15:51 - 2015-09-16 15:51 - 00688992 _____ (Swearware) C:\Users\user\Downloads\dds.com
2015-09-16 15:44 - 2015-09-16 15:43 - 00688992 _____ (Swearware) C:\Users\user\Desktop\dds.scr
2015-09-16 15:43 - 2015-09-16 15:43 - 00688992 _____ (Swearware) C:\Users\user\Downloads\dds.scr
2015-09-16 14:48 - 2015-09-16 14:53 - 148151968 _____ (Microsoft Corporation) C:\Users\user\Downloads\msert.exe
2015-09-16 14:47 - 2015-09-16 14:47 - 00000061 _____ C:\Users\user\Desktop\222.txt
2015-09-16 14:27 - 2015-09-16 14:39 - 00000000 ____D C:\Users\user\AppData\Local\Mozilla
2015-09-16 14:27 - 2015-09-16 14:27 - 00000000 ____D C:\Users\user\AppData\Roaming\Mozilla
2015-09-16 14:23 - 2015-09-16 14:23 - 00000000 ____D C:\Users\user\AppData\Local\VirtualStore
2015-09-16 14:22 - 2015-09-16 18:20 - 00000112 _____ C:\Windows\setupact.log
2015-09-16 14:22 - 2015-09-16 14:22 - 00000000 _____ C:\Windows\setuperr.log
2015-09-16 14:21 - 2015-09-16 14:21 - 00833488 _____ C:\Windows\PFRO.log
2015-09-16 14:11 - 2015-09-16 14:11 - 00008968 _____ C:\Users\user\Desktop\bookmarks-2015-09-16.json
2015-09-16 13:27 - 2015-09-16 13:28 - 00019068 _____ C:\Windows\DPINST.LOG
2015-09-16 13:17 - 2015-09-16 13:17 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\SpyHunter-Installer(1).exe
2015-09-16 11:32 - 2015-09-16 11:32 - 00000000 ____D C:\Users\user\AppData\Roaming\Dropbox
2015-09-16 11:29 - 2015-09-16 14:21 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-09-16 11:29 - 2015-09-16 11:29 - 00000000 ____D C:\ProgramData\Dropbox
2015-09-16 11:28 - 2015-09-16 11:29 - 06667640 _____ (Piriform Ltd) C:\Users\user\Downloads\ccsetup509.exe
2015-09-16 11:01 - 2015-09-16 14:33 - 00000000 ____D C:\Users\user\Desktop\Dados antigos do Firefox
2015-09-15 18:29 - 2015-09-15 18:29 - 00001909 _____ C:\Users\Public\Desktop\YAC.lnk
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Windows\system32\log
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2015-09-15 18:29 - 2015-08-26 07:49 - 00068488 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-09-15 18:29 - 2015-04-16 09:55 - 00053568 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-09-15 18:14 - 2015-09-15 18:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Elex-tech
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user\Downloads\yet_another_cleaner_sk_7489594.exe
2015-09-15 17:17 - 2015-09-15 17:17 - 01660416 _____ C:\Users\user\Downloads\adwcleaner_5.007.exe
2015-09-15 17:11 - 2015-09-15 17:12 - 00000000 ____D C:\Windows\SysWOW64\vbox
2015-09-15 17:11 - 2015-09-15 17:12 - 00000000 ____D C:\Windows\system32\vbox
2015-09-15 17:11 - 2015-09-15 17:11 - 00000000 ____D C:\Users\user\AppData\Roaming\AVAST Software
2015-09-15 17:02 - 2015-09-15 17:02 - 00000000 ____D C:\ProgramData\AVAST Software
2015-09-15 17:01 - 2015-09-15 17:02 - 05685704 _____ (AVAST Software) C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
2015-09-15 15:54 - 2010-03-08 11:10 - 00013824 _____ (Kephyr) C:\Windows\system32\ffnd.exe
2015-09-15 14:42 - 2015-09-15 14:43 - 02687418 _____ (Kephyr) C:\Users\user\Downloads\freefixersetup.exe
2015-09-15 14:30 - 2015-09-15 14:34 - 00000000 ____D C:\Users\user\Downloads\30 Grandes Sucessos
2015-09-15 13:47 - 2015-09-15 13:47 - 00009784 _____ C:\Users\user\Desktop\bookmarks-2015-09-15.json
2015-09-15 12:53 - 2015-09-15 12:53 - 00008366 _____ C:\Windows\system32\.crusader
2015-09-15 11:45 - 2015-09-15 13:00 - 00000000 ____D C:\ProgramData\HitmanPro
2015-09-15 11:44 - 2015-09-15 11:45 - 11352032 _____ (SurfRight B.V.) C:\Users\user\Downloads\HitmanPro_x64.exe
2015-09-14 23:10 - 2015-09-15 14:12 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-14 23:10 - 2015-09-14 23:10 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-14 23:10 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-14 23:10 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-14 23:10 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-14 23:04 - 2015-09-14 23:07 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\user\Downloads\mbam-setup-2.1.8.1057.exe
2015-09-14 18:04 - 2015-09-14 18:04 - 00000000 _____ C:\autoexec.bat
2015-09-14 18:01 - 2015-09-14 18:01 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\SpyHunter-Installer.exe
2015-09-14 17:13 - 2015-09-14 17:13 - 00000000 _____ C:\Windows\system32\SBRC.dat
2015-09-14 17:05 - 2015-09-14 17:05 - 00000000 ____D C:\ProgramData\VIPRE
2015-09-14 16:57 - 2015-09-14 22:46 - 00000000 ____D C:\ProgramData\STOPzilla!
2015-09-14 16:57 - 2015-09-14 16:57 - 00000000 ____D C:\Program Files (x86)\iS3
2015-09-14 16:54 - 2015-09-14 16:54 - 02042328 _____ (iS3, Inc.) C:\Users\user\Downloads\STOPzillaPRO_Downloader.exe
2015-09-14 14:56 - 2015-09-14 15:44 - 03707520 _____ C:\Users\user\Desktop\tarouca_med_loj.dwg
2015-09-14 14:53 - 2015-09-14 14:57 - 23312376 _____ (SUPERAntiSpyware) C:\Users\user\Downloads\SAS_829145C1.EXE
2015-09-14 14:35 - 2012-01-26 11:14 - 00000000 ____D C:\Users\user\Desktop\media
2015-09-11 12:01 - 2015-09-11 12:04 - 00000000 ____D C:\Users\user\Desktop\F0244_PD_Vila_Mea_Franchising
2015-09-11 11:35 - 2015-09-11 11:36 - 00000000 ____D C:\Users\user\Desktop\F0255_PD_Tarouca_Franchising_2015
2015-09-11 11:21 - 2015-09-11 11:21 - 00000049 _____ C:\Users\user\Desktop\nota explicativa.txt
2015-09-10 13:39 - 2015-09-10 14:30 - 00001032 _____ C:\Users\user\Desktop\duvidas reunião.txt
2015-09-10 11:13 - 2015-09-10 11:56 - 00042240 _____ C:\Users\user\Desktop\Portas PT.dwg
2015-09-10 10:09 - 2015-09-10 10:09 - 01660416 _____ C:\Users\user\Downloads\AdwCleaner.exe
2015-09-09 11:25 - 2015-08-15 07:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-09 11:25 - 2015-08-15 07:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-09 11:25 - 2015-08-15 06:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-09-09 11:25 - 2015-08-15 06:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-09-09 11:25 - 2015-08-15 06:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-09-09 11:25 - 2015-08-15 06:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 11:25 - 2015-08-05 18:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-09 11:25 - 2015-07-15 04:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-09 11:25 - 2015-07-15 03:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-09-09 11:25 - 2015-07-09 18:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 11:25 - 2015-07-09 18:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 11:25 - 2015-07-09 18:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-09-09 11:25 - 2015-07-09 18:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-09-09 11:25 - 2015-06-25 11:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 11:25 - 2015-06-25 11:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 11:25 - 2015-06-25 11:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 11:25 - 2015-06-25 10:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-09 11:24 - 2015-09-15 10:23 - 00293280 _____ C:\Users\user\Desktop\Tarouca_DiasBetonagem.dwg
2015-09-09 11:24 - 2015-08-18 02:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-09 11:24 - 2015-08-18 02:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-09 11:24 - 2015-08-15 07:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-09 11:24 - 2015-08-15 07:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-09 11:24 - 2015-08-15 07:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-09 11:24 - 2015-08-15 07:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-09 11:24 - 2015-08-15 07:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-09 11:24 - 2015-08-15 07:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-09 11:24 - 2015-08-15 07:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-09 11:24 - 2015-08-15 07:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-09 11:24 - 2015-08-15 07:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-09 11:24 - 2015-08-15 07:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-09 11:24 - 2015-08-15 06:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-09 11:24 - 2015-08-15 06:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-09-09 11:24 - 2015-08-15 06:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-09 11:24 - 2015-08-15 06:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 11:24 - 2015-08-15 06:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-09 11:24 - 2015-08-15 06:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-09 11:24 - 2015-08-15 06:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-09 11:24 - 2015-08-15 06:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-09-09 11:24 - 2015-08-15 06:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-09-09 11:24 - 2015-08-15 06:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-09 11:24 - 2015-08-15 06:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-09 11:24 - 2015-08-15 06:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-09-09 11:24 - 2015-08-15 06:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-09-09 11:24 - 2015-08-15 06:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-09 11:24 - 2015-08-15 06:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-09 11:24 - 2015-08-15 06:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-09 11:24 - 2015-08-15 06:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-09 11:24 - 2015-08-15 06:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-09-09 11:24 - 2015-08-15 06:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-09 11:24 - 2015-08-15 06:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-09-09 11:24 - 2015-08-15 06:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-09-09 11:24 - 2015-08-15 06:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-09-09 11:24 - 2015-08-15 06:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-09 11:24 - 2015-08-15 06:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-09 11:24 - 2015-08-15 06:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-09 11:24 - 2015-08-15 06:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-09 11:24 - 2015-08-15 06:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-09 11:24 - 2015-08-15 06:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-09-09 11:24 - 2015-08-15 05:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-09 11:24 - 2015-08-15 05:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-09 11:24 - 2015-08-15 05:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-09 11:24 - 2015-08-15 05:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-09 11:24 - 2015-08-15 05:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-09 11:24 - 2015-07-23 01:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 11:24 - 2015-07-23 01:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 11:24 - 2015-07-23 01:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 11:24 - 2015-07-23 01:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 11:24 - 2015-07-23 01:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 11:24 - 2015-07-23 01:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-09-09 11:24 - 2015-07-23 01:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-09-09 11:24 - 2015-07-23 01:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 11:24 - 2015-07-23 01:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 11:24 - 2015-07-23 00:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 11:24 - 2015-07-23 00:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 11:24 - 2015-07-22 18:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-09-09 11:24 - 2015-07-22 18:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-09-09 11:24 - 2015-07-22 18:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-09-09 11:24 - 2015-07-22 18:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-09-09 11:24 - 2015-07-22 18:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-09-09 11:24 - 2015-07-22 18:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-09-09 11:24 - 2015-07-22 18:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 11:24 - 2015-07-22 17:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 11:24 - 2015-07-22 17:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 11:24 - 2015-07-22 17:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 11:24 - 2015-07-22 17:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-09-09 11:24 - 2015-07-22 17:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-09-09 11:24 - 2015-07-22 17:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 11:23 - 2015-08-27 19:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 11:23 - 2015-08-27 19:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 11:23 - 2015-08-27 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 11:23 - 2015-08-27 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 11:23 - 2015-08-27 18:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-09 11:23 - 2015-08-27 18:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-09 11:23 - 2015-08-27 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-09-09 11:23 - 2015-08-27 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-09-09 11:22 - 2015-08-04 19:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-09-09 11:22 - 2015-08-04 19:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-09-09 11:22 - 2015-08-04 18:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 11:22 - 2015-08-04 18:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 11:22 - 2015-08-04 18:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 11:22 - 2015-08-04 18:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 11:22 - 2015-08-04 18:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 11:22 - 2015-08-04 18:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-09 11:22
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Wed Sep 16, 2015 9:55 am    Post subject: FRST/Addition/Adwcleaner Reply with quote

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:15-09-2015
Ran by user (administrator) on LT-CGF-06-RM (16-09-2015 18:45:49)
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Português (Portugal)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Piriform Ltd) C:\Program Files (x86)\CCleaner\CCleaner64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [MobileBroadband] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [280576 2011-10-19] (Vodafone)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google)
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-18\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\SysWOW64\AcSignIcon.dll [2006-03-05] (Autodesk)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk [2010-07-05]
ShortcutTarget: AutoCAD LT Startup Accelerator.lnk -> C:\Program Files (x86)\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-04-01]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-04-01]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-10-29]
ShortcutTarget: Dropbox.lnk -> C:\Users\Miguel Rufino\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2012-10-24]
ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: SBBD.exe /D \Device\HarddiskVolume2\Program Files (x86)\iS3\STOPzilla AntiVirus\Definitions /Lautocheck autochk *
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicyScripts-x32: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{0E4938FD-0AAE-4307-BF34-F6CA5A63D726}: [NameServer] 192.168.0.2 192.168.0.1
Tcpip\..\Interfaces\{35B37513-616A-41DE-B04C-CB43F2BA2CC4}: [NameServer] 62.169.64.129 62.169.64.130
Tcpip\..\Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}: [DhcpNameServer] 192.168.0.1 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = google.pt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
SearchScopes: HKLM -> {017B0775-6C88-46AE-94C1-19A762DB2CDF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {E0C54028-5F27-42C6-93E8-236439369459} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Programa Auxiliar de Início de Sessão do Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-16] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-03-19] (<TOSHIBA>)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-16] (Google Inc.)
Toolbar: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\tpmjus6e.default-1442410384943
FF NewTab: google.pt
FF Homepage: google.pt
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-14] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-14] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2013-02-04] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 -> c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2013-02-04] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll [2012-01-14] (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll [2012-01-14] (Veetle Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-944797692-3693780693-2233505248-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-22] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll [2013-02-04] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprjplug.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll [2013-02-04] (RealPlayer)
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: No Name - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-02-04]
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension [2011-08-17]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\prefs.js [2015-09-14]

Chrome:
=======
CHR HomePage: Default -> google.pt
CHR StartupUrls: Default -> "google.pt"
CHR DefaultSearchURL: Default -> hxxp://www.google.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> google
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-09]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-09-09]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-09]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-09-09]
CHR Extension: (Documentos do Google offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-10]
CHR Extension: (RealDownloader) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2015-09-09]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-09-10]
CHR Extension: (Pagamentos via Chrome Web Store) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-10]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-09]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (No Name) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-28]
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\user\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [77944 2010-07-05] (Autodesk)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-04-16] (Elex do Brasil Participações Ltda)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-16] (LogMeIn, Inc.)
S4 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-16] (LogMeIn, Inc.)
S4 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 CnxtHdmiAudService; C:\Windows\System32\drivers\CHDMI64.sys [720952 2010-03-05] (Conexant Systems Inc.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [415232 2011-10-18] (Huawei Technologies Co., Ltd.)
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-14] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [53568 2015-04-16] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [61832 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2015-09-01] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [68488 2015-08-26] (Elex do Brasil Participações Ltda)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-30] (LogMeIn, Inc.)
S4 LMIRfsClientNP; no ImagePath
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 vodafone_K3805-z_cdc_acm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_acm.sys [78336 2010-03-01] (Vodafone)
S3 vodafone_K3805-z_cdc_ecm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_ecm.sys [88576 2010-03-01] (Vodafone)
S3 vodafone_K3805-z_cpo; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cpo.sys [13824 2010-03-01] (Vodafone)
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-16 18:47 - 2015-09-16 18:47 - 01660416 _____ C:\Users\user\Downloads\AdwCleaner(1).exe
2015-09-16 18:45 - 2015-09-16 18:47 - 00031423 _____ C:\Users\user\Desktop\FRST.txt
2015-09-16 18:45 - 2015-09-16 18:45 - 00000000 ____D C:\FRST
2015-09-16 18:44 - 2015-09-16 18:44 - 02191360 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2015-09-16 18:44 - 2015-09-16 18:44 - 02191360 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2015-09-16 18:40 - 2015-09-16 18:40 - 00000207 _____ C:\Windows\tweaking.com-regbackup-LT-CGF-06-RM-Windows-7-Home-Premium-(64-bit).dat
2015-09-16 18:40 - 2015-09-16 18:40 - 00000000 ____D C:\RegBackup
2015-09-16 18:39 - 2015-09-16 18:39 - 00002242 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-09-16 18:39 - 2015-09-16 18:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-09-16 18:39 - 2015-09-16 18:39 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-09-16 18:38 - 2015-09-16 18:38 - 04687376 _____ (Tweaking.com) C:\Users\user\Downloads\tweaking.com_registry_backup_setup.exe
2015-09-16 18:21 - 2015-09-16 18:21 - 00000000 ____D C:\Users\user\AppData\Local\GWX
2015-09-16 15:58 - 2015-09-16 15:59 - 00031472 _____ C:\Users\user\Desktop\dds.txt
2015-09-16 15:58 - 2015-09-16 15:59 - 00015920 _____ C:\Users\user\Desktop\attach.txt
2015-09-16 15:51 - 2015-09-16 15:51 - 00688992 ____R (Swearware) C:\Users\user\Desktop\dds.com
2015-09-16 15:51 - 2015-09-16 15:51 - 00688992 _____ (Swearware) C:\Users\user\Downloads\dds.com
2015-09-16 15:44 - 2015-09-16 15:43 - 00688992 _____ (Swearware) C:\Users\user\Desktop\dds.scr
2015-09-16 15:43 - 2015-09-16 15:43 - 00688992 _____ (Swearware) C:\Users\user\Downloads\dds.scr
2015-09-16 14:48 - 2015-09-16 14:53 - 148151968 _____ (Microsoft Corporation) C:\Users\user\Downloads\msert.exe
2015-09-16 14:47 - 2015-09-16 14:47 - 00000061 _____ C:\Users\user\Desktop\222.txt
2015-09-16 14:27 - 2015-09-16 14:39 - 00000000 ____D C:\Users\user\AppData\Local\Mozilla
2015-09-16 14:27 - 2015-09-16 14:27 - 00000000 ____D C:\Users\user\AppData\Roaming\Mozilla
2015-09-16 14:23 - 2015-09-16 14:23 - 00000000 ____D C:\Users\user\AppData\Local\VirtualStore
2015-09-16 14:22 - 2015-09-16 18:20 - 00000112 _____ C:\Windows\setupact.log
2015-09-16 14:22 - 2015-09-16 14:22 - 00000000 _____ C:\Windows\setuperr.log
2015-09-16 14:21 - 2015-09-16 14:21 - 00833488 _____ C:\Windows\PFRO.log
2015-09-16 14:11 - 2015-09-16 14:11 - 00008968 _____ C:\Users\user\Desktop\bookmarks-2015-09-16.json
2015-09-16 13:27 - 2015-09-16 13:28 - 00019068 _____ C:\Windows\DPINST.LOG
2015-09-16 13:17 - 2015-09-16 13:17 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\SpyHunter-Installer(1).exe
2015-09-16 11:32 - 2015-09-16 11:32 - 00000000 ____D C:\Users\user\AppData\Roaming\Dropbox
2015-09-16 11:29 - 2015-09-16 14:21 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-09-16 11:29 - 2015-09-16 11:29 - 00000000 ____D C:\ProgramData\Dropbox
2015-09-16 11:28 - 2015-09-16 11:29 - 06667640 _____ (Piriform Ltd) C:\Users\user\Downloads\ccsetup509.exe
2015-09-16 11:01 - 2015-09-16 14:33 - 00000000 ____D C:\Users\user\Desktop\Dados antigos do Firefox
2015-09-15 18:29 - 2015-09-15 18:29 - 00001909 _____ C:\Users\Public\Desktop\YAC.lnk
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Windows\system32\log
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2015-09-15 18:29 - 2015-08-26 07:49 - 00068488 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-09-15 18:29 - 2015-04-16 09:55 - 00053568 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-09-15 18:14 - 2015-09-15 18:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Elex-tech
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user\Downloads\yet_another_cleaner_sk_7489594.exe
2015-09-15 17:17 - 2015-09-15 17:17 - 01660416 _____ C:\Users\user\Downloads\adwcleaner_5.007.exe
2015-09-15 17:11 - 2015-09-15 17:12 - 00000000 ____D C:\Windows\SysWOW64\vbox
2015-09-15 17:11 - 2015-09-15 17:12 - 00000000 ____D C:\Windows\system32\vbox
2015-09-15 17:11 - 2015-09-15 17:11 - 00000000 ____D C:\Users\user\AppData\Roaming\AVAST Software
2015-09-15 17:02 - 2015-09-15 17:02 - 00000000 ____D C:\ProgramData\AVAST Software
2015-09-15 17:01 - 2015-09-15 17:02 - 05685704 _____ (AVAST Software) C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
2015-09-15 15:54 - 2010-03-08 11:10 - 00013824 _____ (Kephyr) C:\Windows\system32\ffnd.exe
2015-09-15 14:42 - 2015-09-15 14:43 - 02687418 _____ (Kephyr) C:\Users\user\Downloads\freefixersetup.exe
2015-09-15 14:30 - 2015-09-15 14:34 - 00000000 ____D C:\Users\user\Downloads\30 Grandes Sucessos
2015-09-15 13:47 - 2015-09-15 13:47 - 00009784 _____ C:\Users\user\Desktop\bookmarks-2015-09-15.json
2015-09-15 12:53 - 2015-09-15 12:53 - 00008366 _____ C:\Windows\system32\.crusader
2015-09-15 11:45 - 2015-09-15 13:00 - 00000000 ____D C:\ProgramData\HitmanPro
2015-09-15 11:44 - 2015-09-15 11:45 - 11352032 _____ (SurfRight B.V.) C:\Users\user\Downloads\HitmanPro_x64.exe
2015-09-14 23:10 - 2015-09-15 14:12 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-14 23:10 - 2015-09-14 23:10 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-14 23:10 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-14 23:10 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-14 23:10 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-14 23:04 - 2015-09-14 23:07 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\user\Downloads\mbam-setup-2.1.8.1057.exe
2015-09-14 18:04 - 2015-09-14 18:04 - 00000000 _____ C:\autoexec.bat
2015-09-14 18:01 - 2015-09-14 18:01 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\SpyHunter-Installer.exe
2015-09-14 17:13 - 2015-09-14 17:13 - 00000000 _____ C:\Windows\system32\SBRC.dat
2015-09-14 17:05 - 2015-09-14 17:05 - 00000000 ____D C:\ProgramData\VIPRE
2015-09-14 16:57 - 2015-09-14 22:46 - 00000000 ____D C:\ProgramData\STOPzilla!
2015-09-14 16:57 - 2015-09-14 16:57 - 00000000 ____D C:\Program Files (x86)\iS3
2015-09-14 16:54 - 2015-09-14 16:54 - 02042328 _____ (iS3, Inc.) C:\Users\user\Downloads\STOPzillaPRO_Downloader.exe
2015-09-14 14:56 - 2015-09-14 15:44 - 03707520 _____ C:\Users\user\Desktop\tarouca_med_loj.dwg
2015-09-14 14:53 - 2015-09-14 14:57 - 23312376 _____ (SUPERAntiSpyware) C:\Users\user\Downloads\SAS_829145C1.EXE
2015-09-14 14:35 - 2012-01-26 11:14 - 00000000 ____D C:\Users\user\Desktop\media
2015-09-11 12:01 - 2015-09-11 12:04 - 00000000 ____D C:\Users\user\Desktop\F0244_PD_Vila_Mea_Franchising
2015-09-11 11:35 - 2015-09-11 11:36 - 00000000 ____D C:\Users\user\Desktop\F0255_PD_Tarouca_Franchising_2015
2015-09-11 11:21 - 2015-09-11 11:21 - 00000049 _____ C:\Users\user\Desktop\nota explicativa.txt
2015-09-10 13:39 - 2015-09-10 14:30 - 00001032 _____ C:\Users\user\Desktop\duvidas reunião.txt
2015-09-10 11:13 - 2015-09-10 11:56 - 00042240 _____ C:\Users\user\Desktop\Portas PT.dwg
2015-09-10 10:09 - 2015-09-10 10:09 - 01660416 _____ C:\Users\user\Downloads\AdwCleaner.exe
2015-09-09 11:25 - 2015-08-15 07:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-09 11:25 - 2015-08-15 07:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-09 11:25 - 2015-08-15 06:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-09-09 11:25 - 2015-08-15 06:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-09-09 11:25 - 2015-08-15 06:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-09-09 11:25 - 2015-08-15 06:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 11:25 - 2015-08-05 18:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-09 11:25 - 2015-07-15 04:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-09 11:25 - 2015-07-15 03:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-09-09 11:25 - 2015-07-09 18:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 11:25 - 2015-07-09 18:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 11:25 - 2015-07-09 18:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-09-09 11:25 - 2015-07-09 18:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-09-09 11:25 - 2015-06-25 11:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 11:25 - 2015-06-25 11:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 11:25 - 2015-06-25 11:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 11:25 - 2015-06-25 10:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-09 11:24 - 2015-09-15 10:23 - 00293280 _____ C:\Users\user\Desktop\Tarouca_DiasBetonagem.dwg
2015-09-09 11:24 - 2015-08-18 02:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-09 11:24 - 2015-08-18 02:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-09 11:24 - 2015-08-15 07:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-09 11:24 - 2015-08-15 07:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-09 11:24 - 2015-08-15 07:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-09 11:24 - 2015-08-15 07:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-09 11:24 - 2015-08-15 07:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-09 11:24 - 2015-08-15 07:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-09 11:24 - 2015-08-15 07:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-09 11:24 - 2015-08-15 07:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-09 11:24 - 2015-08-15 07:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-09 11:24 - 2015-08-15 07:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-09 11:24 - 2015-08-15 06:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-09 11:24 - 2015-08-15 06:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-09-09 11:24 - 2015-08-15 06:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-09 11:24 - 2015-08-15 06:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 11:24 - 2015-08-15 06:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-09 11:24 - 2015-08-15 06:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-09 11:24 - 2015-08-15 06:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-09 11:24 - 2015-08-15 06:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-09-09 11:24 - 2015-08-15 06:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-09-09 11:24 - 2015-08-15 06:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-09 11:24 - 2015-08-15 06:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-09 11:24 - 2015-08-15 06:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-09-09 11:24 - 2015-08-15 06:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-09-09 11:24 - 2015-08-15 06:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-09 11:24 - 2015-08-15 06:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-09 11:24 - 2015-08-15 06:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-09 11:24 - 2015-08-15 06:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-09 11:24 - 2015-08-15 06:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-09-09 11:24 - 2015-08-15 06:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-09 11:24 - 2015-08-15 06:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-09-09 11:24 - 2015-08-15 06:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-09-09 11:24 - 2015-08-15 06:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-09-09 11:24 - 2015-08-15 06:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-09 11:24 - 2015-08-15 06:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-09 11:24 - 2015-08-15 06:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-09 11:24 - 2015-08-15 06:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-09 11:24 - 2015-08-15 06:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-09 11:24 - 2015-08-15 06:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-09-09 11:24 - 2015-08-15 05:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-09 11:24 - 2015-08-15 05:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-09 11:24 - 2015-08-15 05:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-09 11:24 - 2015-08-15 05:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-09 11:24 - 2015-08-15 05:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-09 11:24 - 2015-07-23 01:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 11:24 - 2015-07-23 01:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 11:24 - 2015-07-23 01:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 11:24 - 2015-07-23 01:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 11:24 - 2015-07-23 01:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 11:24 - 2015-07-23 01:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-09-09 11:24 - 2015-07-23 01:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-09-09 11:24 - 2015-07-23 01:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 11:24 - 2015-07-23 01:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 11:24 - 2015-07-23 00:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 11:24 - 2015-07-23 00:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 11:24 - 2015-07-22 18:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-09-09 11:24 - 2015-07-22 18:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-09-09 11:24 - 2015-07-22 18:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-09-09 11:24 - 2015-07-22 18:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-09-09 11:24 - 2015-07-22 18:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-09-09 11:24 - 2015-07-22 18:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-09-09 11:24 - 2015-07-22 18:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 11:24 - 2015-07-22 17:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 11:24 - 2015-07-22 17:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 11:24 - 2015-07-22 17:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 11:24 - 2015-07-22 17:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-09-09 11:24 - 2015-07-22 17:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-09-09 11:24 - 2015-07-22 17:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 11:23 - 2015-08-27 19:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 11:23 - 2015-08-27 19:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 11:23 - 2015-08-27 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 11:23 - 2015-08-27 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 11:23 - 2015-08-27 18:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-09 11:23 - 2015-08-27 18:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-09 11:23 - 2015-08-27 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-09-09 11:23 - 2015-08-27 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-09-09 11:22 - 2015-08-04 19:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-09-09 11:22 - 2015-08-04 19:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-09-09 11:22 - 2015-08-04 18:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 11:22 - 2015-08-04 18:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 11:22 - 2015-08-04 18:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 11:22 - 2015-08-04 18:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 11:22 - 2015-08-04 18:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 11:22 - 2015-08-04 18:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-09 11:22
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Wed Sep 16, 2015 10:49 am    Post subject: Reply with quote

Your FRST.txt log has been cut off by the forum post size limiter, so you will need to post it in sections. Just look at the section that you've already posted, and send me the sections from there onwards.

The Addition.txt log is usually shorter so you should be able to post it in 1 post.

The ADWCleaner will also usually fit into one post.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Wed Sep 16, 2015 1:22 pm    Post subject: next frst Reply with quote

2015-09-09 11:22 - 2015-08-04 17:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 11:21 - 2015-09-02 04:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 11:21 - 2015-09-02 04:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 11:21 - 2015-09-02 04:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 11:21 - 2015-09-02 04:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 11:21 - 2015-09-02 03:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-09-09 11:21 - 2015-09-02 03:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-09-09 11:21 - 2015-09-02 03:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-09-09 11:21 - 2015-09-02 03:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-09-09 11:21 - 2015-09-02 02:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 11:21 - 2015-09-02 02:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 11:21 - 2015-09-02 02:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 11:21 - 2015-08-26 19:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 11:21 - 2015-08-26 19:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 11:21 - 2015-08-26 19:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 11:21 - 2015-08-26 19:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-09-09 11:21 - 2015-08-26 18:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-09-09 11:19 - 2015-09-09 11:20 - 00000000 ____D C:\Users\user\AppData\Local\Autodesk
2015-09-09 11:15 - 2015-09-09 11:15 - 00000000 ____D C:\Users\user\AppData\Local\Adobe
2015-09-08 18:23 - 2015-09-08 18:23 - 00000000 ____D C:\Users\user\AppData\Local\Macromedia
2015-09-08 18:19 - 2015-09-08 18:20 - 00000000 ____D C:\Users\user\AppData\Local\Toshiba
2015-09-08 18:19 - 2015-09-08 18:19 - 00000000 ____D C:\Users\user\AppData\Local\LogMeIn
2015-09-08 18:18 - 2015-09-08 18:18 - 00146960 _____ C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2015-09-08 11:07 - 2015-09-10 15:52 - 00283706 _____ C:\Users\user\Desktop\F0255_Controlo_Datas_Chave_20150910.xlsx
2015-09-07 13:44 - 2015-09-07 13:45 - 16948241 _____ C:\Users\user\Downloads\tarouca.rar
2015-09-04 11:49 - 2015-09-04 11:56 - 00000000 ____D C:\Users\user\Desktop\F0252_PD_Silveira
2015-09-04 09:52 - 2015-09-08 15:26 - 00000586 _____ C:\Users\user\Desktop\hoteis.txt
2015-09-02 16:29 - 2015-09-02 16:30 - 14681212 _____ C:\Users\user\Downloads\PE_AVAC_R00.rar
2015-09-01 17:23 - 2015-09-01 17:26 - 03701760 _____ C:\Users\user\Desktop\03.04.05.Planta Crts Alç2.dwg
2015-08-31 11:13 - 2015-09-14 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-16 18:28 - 2009-07-14 05:45 - 00019248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-16 18:28 - 2009-07-14 05:45 - 00019248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-16 18:27 - 2013-02-17 23:34 - 01383046 _____ C:\Windows\WindowsUpdate.log
2015-09-16 18:20 - 2010-09-30 22:44 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2015-09-16 18:20 - 2010-06-22 01:54 - 00001004 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-16 18:20 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-16 18:18 - 2012-04-03 18:45 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-16 17:57 - 2010-06-22 01:54 - 00001008 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-16 16:45 - 2013-08-09 13:58 - 00000000 ____D C:\Users\user\Desktop\ActualizaçãoServidor
2015-09-16 15:52 - 2010-06-22 01:54 - 00004004 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 15:52 - 2010-06-22 01:54 - 00003752 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-16 13:29 - 2011-08-17 11:53 - 00000000 ____D C:\Program Files (x86)\HTC
2015-09-16 13:27 - 2012-04-03 18:17 - 00000000 ____D C:\Users\Miguel Rufino\AppData\Local\Downloaded Installations
2015-09-16 11:37 - 2014-12-04 19:43 - 00000000 ____D C:\Users\user\AppData\Roaming\XnView
2015-09-16 11:37 - 2013-06-06 17:18 - 00000000 ____D C:\Users\user\AppData\Roaming\uTorrent
2015-09-16 11:37 - 2013-04-12 16:15 - 00000000 ____D C:\ProgramData\LogMeIn
2015-09-16 11:37 - 2010-07-05 09:59 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2015-09-16 11:36 - 2013-10-10 18:37 - 00000000 ____D C:\Windows\Minidump
2015-09-16 11:34 - 2013-04-12 14:46 - 00000000 ____D C:\Users\user\AppData\Local\Google
2015-09-16 11:29 - 2013-04-12 09:57 - 00001024 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-09-16 11:29 - 2012-11-01 16:20 - 00002808 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-09-16 11:29 - 2012-04-09 16:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-09-16 11:29 - 2010-07-05 09:32 - 00000000 ____D C:\Program Files (x86)\CCleaner
2015-09-15 22:31 - 2015-01-06 20:18 - 00000000 ____D C:\Users\user\Desktop\Mariani
2015-09-15 20:55 - 2013-06-26 10:26 - 00000000 ____D C:\Users\user\Downloads\Linkin Park - Greatest Hits [2013]
2015-09-15 20:51 - 2012-03-02 14:20 - 00000000 ____D C:\Users\Miguel Rufino\AppData\Roaming\GoContactSyncMOD
2015-09-15 19:15 - 2015-07-10 18:00 - 00000000 ___HD C:\$Windows.~BT
2015-09-15 17:18 - 2015-01-28 17:08 - 00000000 ____D C:\AdwCleaner
2015-09-15 15:54 - 2015-05-06 13:24 - 00000000 ____D C:\Program Files (x86)\ControlCenter4
2015-09-15 15:54 - 2010-07-05 09:44 - 00000000 ____D C:\Program Files\FolderSize
2015-09-15 15:54 - 2010-04-01 08:16 - 00000000 ____D C:\Program Files (x86)\Toshiba TEMPRO
2015-09-15 15:38 - 2009-07-14 18:58 - 00724066 _____ C:\Windows\system32\prfh0816.dat
2015-09-15 15:38 - 2009-07-14 18:58 - 00153958 _____ C:\Windows\system32\prfc0816.dat
2015-09-15 15:38 - 2009-07-14 06:13 - 01664178 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-15 15:02 - 2010-04-01 06:01 - 00000000 ____D C:\Windows\Panther
2015-09-15 09:41 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Branding
2015-09-14 18:55 - 2012-10-19 19:07 - 00002455 _____ C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-09-14 18:55 - 2012-06-01 17:22 - 00002445 _____ C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screenpresso.lnk
2015-09-14 16:47 - 2010-06-22 02:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-09-14 16:47 - 2010-06-22 02:36 - 00000000 ____D C:\Program Files (x86)\HP
2015-09-14 16:47 - 2010-06-22 02:35 - 00004631 _____ C:\ProgramData\hpzinstall.log
2015-09-14 16:34 - 2010-06-22 02:35 - 00000000 ____D C:\ProgramData\HP
2015-09-14 16:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-09-14 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-09-10 15:28 - 2013-04-26 11:16 - 00000000 ____D C:\Users\user\Desktop\fotos
2015-09-10 11:54 - 2013-05-17 12:06 - 00000000 ____D C:\Users\user\AppData\Roaming\PrimoPDF
2015-09-10 11:53 - 2015-03-18 17:33 - 00000683 _____ C:\Users\user\Documents\plot.log
2015-09-09 21:31 - 2013-04-11 18:22 - 00503024 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-09 21:27 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-09 21:27 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-09-09 18:34 - 2010-04-29 23:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-09 18:28 - 2009-07-14 03:34 - 00000615 _____ C:\Windows\win.ini
2015-09-08 18:18 - 2013-04-12 14:46 - 00001300 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-09-08 18:07 - 2010-08-03 11:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-08 18:06 - 2012-07-13 20:31 - 00001376 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-09-08 09:57 - 2013-04-12 16:03 - 00000000 ___RD C:\Users\user\Google Drive
2015-09-07 18:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2015-09-01 09:43 - 2012-07-13 20:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-31 09:28 - 2009-07-14 06:08 - 00032578 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-26 17:16 - 2013-05-10 15:24 - 00001704 _____ C:\Users\user\Desktop\Fiscalizacao Mac.lnk
2015-08-18 22:41 - 2013-01-30 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-08-18 19:56 - 2015-08-15 11:55 - 03758240 _____ C:\Users\user\Desktop\Medidas_Interiores_Loja.dwg
2015-08-18 15:27 - 2015-06-05 11:12 - 00000658 _____ C:\Users\user\Desktop\obra.txt

==================== Files in the root of some directories =======

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v
2014-11-28 15:42 - 2014-11-28 15:42 - 0000057 _____ () C:\ProgramData\Ament.ini
2010-10-22 23:46 - 2010-10-22 23:46 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-06-22 02:35 - 2015-09-14 16:47 - 0004631 _____ () C:\ProgramData\hpzinstall.log

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-09-14 16:06

==================== End of FRST.txt ============================
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Wed Sep 16, 2015 1:31 pm    Post subject: adwcleaner Reply with quote

# AdwCleaner v5.007 - Logfile created 16/09/2015 at 18:50:31
# Updated 08/09/2015 by Xplode
# Database : 2015-09-15.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : user - LT-CGF-06-RM
# Running from : C:\Users\user\Desktop\AdwCleaner(1).exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

Service Found : iSafeKrnl
Service Found : iSafeKrnlBoot
Service Found : iSafeKrnlKit
Service Found : iSafeKrnlMon
Service Found : iSafeKrnlR3
Service Found : iSafeNetFilter
Service Found : iSafeService

***** [ Folders ] *****

Folder Found : C:\Program Files (x86)\Elex-tech
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
Folder Found : C:\users\user\AppData\Roaming\Elex-tech

***** [ Files ] *****

File Found : C:\Users\Public\Desktop\YAC.lnk
File Found : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.yac.mx_0.localstorage
File Found : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.yac.mx_0.localstorage-journal
File Found : C:\users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\user Pinned\StartMenu\YAC.lnk
File Found : C:\Windows\Sysnative\log\iSafeKrnlCall.log
File Found : C:\Windows\Sysnative\drivers\iSafeKrnlBoot.sys
File Found : C:\Windows\Sysnative\drivers\iSafeNetFilter.sys

***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Elex-tech
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe

***** [ Web browsers ] *****


########## EOF - C:\AdwCleaner\AdwCleaner[S13].txt - [1655 bytes] ##########
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Wed Sep 16, 2015 7:58 pm    Post subject: Reply with quote

For some reason you posted your Addition.txt log to a separate topic, so I've copied it and put it here for easier reference.

Please post all future replies to this topic only.

I've posted your fix in the next post down in this topic.




Additional scan result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-16 18:48:09)
Running from C:\Users\user\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2010-06-22 00:17:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-944797692-3693780693-2233505248-500 - Administrator - Enabled) => C:\Users\Administrador
Convidado (S-1-5-21-944797692-3693780693-2233505248-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-944797692-3693780693-2233505248-1002 - Limited - Enabled)
Miguel Rufino (S-1-5-21-944797692-3693780693-2233505248-1001 - Administrator - Enabled) => C:\Users\Miguel Rufino
user (S-1-5-21-944797692-3693780693-2233505248-1003 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AS: Microsoft Security Essentials (Enabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\uTorrent) (Version: 3.4.4.40911 - BitTorrent Inc.)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)
7-Zip 9.21beta (HKLM-x32\...\7-Zip) (Version: - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Português (HKLM-x32\...\{AC76BA86-7AD7-1046-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Akamai NetSession Interface (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Akamai) (Version: - Akamai Technologies, Inc)
Alerta de HDD/SSD TOSHIBA (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.6 - TOSHIBA Corporation)
Alerta de HDD/SSD TOSHIBA (Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
Alerta de HDD/SSD TOSHIBA (x32 Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.26 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\...\{B5896016-3143-B94F-585D-DF75DAF1D879}) (Version: 3.0.765.0 - ATI Technologies, Inc.)
Auslogics Disk Defrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: version 3.1 - Auslogics Software Pty Ltd)
AutoCAD LT 2007 - English (HKLM-x32\...\{5783F2D7-5009-0409-0002-0060B0CE6BBA}) (Version: 17.0.54.110 - Autodesk)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.10.10(T) - TOSHIBA CORPORATION)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.35 - Broadcom Corporation)
Brother MFL-Pro Suite DCP-J4120DW (HKLM-x32\...\{7FC49664-DAA4-4E7C-ADD0-614ABB43691B}) (Version: 1.0.4.0 - Brother Industries, Ltd.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
C6300 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
ccc-core-static (x32 Version: 2010.0315.1050.17562 - Nome de sua empresa:) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.09 - Piriform)
Complemento Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Conexant Audio Driver For AMD HDMI Codec (HKLM\...\CNXT_AUDIO_HDA_HDMI) (Version: 4.98.26.0 - Conexant)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.64 - Conexant)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
CutePDF Professional 3.6 (Evaluation) (HKLM-x32\...\CutePDF Professional (Evaluation)_is1) (Version: - Acro Software Inc.)
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0328 - DT Soft Ltd)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
DWG TrueView 2012 (HKLM\...\DWG TrueView 2012) (Version: 18.2.51.0 - Autodesk)
DWG TrueView 2012 (Version: 18.2.51.0 - Autodesk) Hidden
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
Facebook Video Calling 1.2.0.287 (HKLM-x32\...\{B92C5909-1D37-4C51-8397-A28BB28E5DC3}) (Version: 1.2.287 - Skype Limited)
FARO LS 1.1.406.58 (HKLM-x32\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production)
Folder Size for Windows (64-bit) (HKLM\...\{F24FF688-7138-4CCF-A83F-71E9FB01170E}) (Version: 2.5 - Brio)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GOM Player (HKLM-x32\...\GOM Player) (Version: 2.2.69.5227 - Gretech Corporation)
Google Apps Migration For Microsoft Outlook® 3.4.27.52 (HKLM-x32\...\{65960C6E-BFA2-4FE7-A1BC-8028F3072566}) (Version: 3.4.27.52 - Google, Inc.)
Google Apps Sync™ for Microsoft Outlook® 3.7.410.1100 (HKLM-x32\...\{799A7E2B-388F-4BDE-B55B-47AF42C6440A}) (Version: 3.7.410.1100 - Google, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.93 - Google Inc.)
Google Drive (HKLM-x32\...\{12ADFB82-D5A3-43E4-B2F4-FCD9B690315B}) (Version: 1.24.9931.5480 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google SketchUp 8 (HKLM-x32\...\{D16B0559-BD37-4725-862C-DB2160A58C53}) (Version: 3.0.4998 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
gpedt.msc 1.0 (HKLM-x32\...\{10B9C608-BF7C-4CCF-A658-C01D969DCA21}_is1) (Version: - Richard)
HP Photosmart C6300 All-In-One Driver Software 13.0 Rel. 4 (HKLM\...\{E5A24F8D-40E1-45CB-B509-81186D795735}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Solutions Framework (HKLM-x32\...\{E35601C0-BA8E-4F32-919A-C7EF4CA81F67}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.021 - HTC Corporation)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.7.1002 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.01.01.1007 - Intel Corporation)
Java 8 Update 31 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java(TM) 6 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (HKLM-x32\...\{0330FC8D-EDB2-455E-A3DC-B56DD107E4BC}) (Version: 4.1.2694 - LogMeIn, Inc.)
Malwarebytes Anti-Malware versão 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Português) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 2070) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0816-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Project Professional 2010 (HKLM-x32\...\Office14.PRJPRO) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{D7A1C3CB-1F27-4EAA-98DF-D266CA6B67D3}) (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 40.0.3 (x86 pt-PT) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 pt-PT)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{033e19a4-3088-4abc-a9ea-004829cd1910}) (Version: - Nero AG)
Nero BackItUp (HKLM-x32\...\{0420F95C-11FF-4E02-B967-6CC22B188F9F}) (Version: 5.2.21001 - Nero AG)
Nero BackItUp and Burn (HKLM-x32\...\{E08CC458-41FB-4BB5-9B08-2C83DB55A5B9}) (Version: 1.2.0030 - Nero AG)
Nero BurnRights (HKLM-x32\...\{397516AE-7DFE-4F90-84E0-BD616D559434}) (Version: 3.6.26001 - Nero AG)
Nero Express (HKLM-x32\...\{6C3CF7AC-5AB0-42D9-93C0-68166A57AFB6}) (Version: 9.6.16000 - Nero AG)
Nero RescueAgent (HKLM-x32\...\{51E2F9B3-A972-4F58-B4EF-4D9676D9F5D1}) (Version: 2.6.25002 - Nero AG)
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Nokia Connectivity Cable Driver (HKLM-x32\...\{2D99A593-C841-43A7-B7C9-D6F3AE70B756}) (Version: 7.1.45.0 - Nokia)
Nokia Ovi Suite (HKLM-x32\...\Nokia Ovi Suite) (Version: 3.1.1.85 - Nokia)
Nokia Ovi Suite (x32 Version: 3.1.1.85 - Nokia) Hidden
Nokia Ovi Suite Software Updater (HKLM-x32\...\{A8F7FCEF-3CA6-4CE9-8FEA-8BB18F8686F0}) (Version: 02.07.004.45780 - Nokia Corporation)
Nokia PC Internet Access (HKLM-x32\...\Nokia PC Internet Access) (Version: 1.1.2.5 - Nokia)
Nokia PC Internet Access (x32 Version: 1.1.2.5 - Nokia) Hidden
Nuance PaperPort 12 (HKLM-x32\...\{88B5FBDC-967D-4B1F-B291-39284AE12201}) (Version: 12.1.0005 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Ovi Desktop Sync Engine (x32 Version: 1.5.266.0 - Nokia) Hidden
OviMPlatform (x32 Version: 2.7.72.0 - Nokia) Hidden
Pacote de controladores do Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D) (Version: 08/22/2008 7.0.0.0 - Nokia)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM-x32\...\{C373F7C4-05D2-4047-96D1-6AF30661C6AA}) (Version: 11.4.19.0 - Nokia)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 0.9.6 - Frank Heindörfer, Philip Chinery)
Photo Service - powered by myphotobook (HKLM-x32\...\eu.myphotobook.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1) (Version: 1.0.7-279 - myphotobook GmbH)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power Commander Control Center 3.2.0 (Test Build 1) (HKLM-x32\...\Power Commander 3 Usb_is1) (Version: - Dynojet Research, Inc.)
PrimoPDF -- by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5.0.0.19 - Nitro PDF Software)
PS_AIO_04_C6300_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30111 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
Scansoft PDF Professional (x32 Version: - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPRO_{58FA40EF-ABA9-4FED-AD3D-318A6073934D}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
Toshiba Assist (HKLM-x32\...\{1B87C40B-A60B-4EF3-9A68-706CF4B69978}) (Version: 3.00.10 - TOSHIBA)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.06.64 - TOSHIBA Corporation)
TOSHIBA ConfigFree (HKLM-x32\...\{607BE7BF-7C28-4ADB-A4A0-385962B901C3}) (Version: 8.0.28 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.2.11.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.3.64 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (HKLM-x32\...\{8E9CEA3B-EBD1-439C-A01D-830CB39613C6}) (Version: 2.00.06 - TOSHIBA Corporation)
Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.01 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.80.3.64 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.5.10 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 2.09.0001 - TOSHIBA)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.6.0.64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 x64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{A0E99122-25C1-4CA4-9063-499A2A814EB6}) (Version: 1.6.06.64 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA)
TOSHIBA Supervisor Password (HKLM-x32\...\{073B89C3-BA88-41B5-965F-B35A88EAE838}) (Version: 2.00.03 - TOSHIBA Corporation)
TOSHIBA TEMPRO (HKLM-x32\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.3.3.64 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.15 - TOSHIBA Corporation)
TRORMCLauncher (HKLM-x32\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: - )
TRORMCLauncher (Version: 1.0.0.9 - TOSHIBA) Hidden
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.2.1 - Tweaking.com)
Undelete 360 (HKLM-x32\...\Undelete 360_is1) (Version: - File Recovery Ltd.)
Unity Web Player (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Veetle TV (HKLM-x32\...\Veetle TV) (Version: 0.9.19 - Veetle, Inc)
Viber (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Viber) (Version: 4.4.0.134678 - Viber Media Inc)
Vodafone Mobile Broadband Lite (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.3.2.34962 - Vodafone)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{34795BBE-39E4-41B6-997A-B88FD7306562}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XnView 2.13 (HKLM-x32\...\XnView_is1) (Version: 2.13 - Gougelet Pierre-e)
YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: 6.7.111 - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== ATTENTION
YouSendIt Plug-in for Outlook (HKLM-x32\...\InstallShield_{20DFF861-31EE-41F6-98D5-0A992AE7D116}) (Version: 2.14.1 - YouSendIt)
YouSendIt Plug-in for Outlook (x32 Version: 2.14.1 - YouSendIt) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2014\en-US\dwgviewrficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}\InprocServer32 -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\sys\x64\TosBtExt.dll (TOSHIBA)
CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2014\dwgviewr.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{D70E31AD-2614-49F2-B0FC-ACA781D81F3E}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2012\dwgviewr.exe (Autodesk, Inc.)

==================== Restore Points =========================

16-09-2015 11:49:02 avast! antivirus system restore point
16-09-2015 13:19:44 Removed Suporte para Aplicações Apple
16-09-2015 13:21:37 Removed Apple Software Update
16-09-2015 13:22:54 Removed HTC Sync.
16-09-2015 13:27:13 Removed HTC Driver Installer.
16-09-2015 13:28:24 Removed HTC BMP USB Driver.
16-09-2015 13:30:06 Removed eBay

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0E7D2CBA-77E6-461E-A701-57C15725F819} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {0FCC9EFB-567C-4959-8E4F-DD07704A80C6} - System32\Tasks\{FE3D7656-1D54-4E9F-ABBB-C33E78F3D390} => Chrome.exe http://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.3.0.105&amp;LastError=12002
Task: {14ECC2B5-E5EF-4570-B39F-0458C7579429} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {44170157-E589-46A9-ADF0-8EAC8CB4DA87} - System32\Tasks\{5C6AC76C-4921-436D-84A0-9475D81AF6DE} => pcalua.exe -a G:\setup_vmb_lite.exe -d G:\ -c /checkApplicationPresence
Task: {5B6C31EE-0D59-40EE-8147-A7C408E1540B} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {680B6469-96BD-4A4A-9333-63542F8435B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-14] (Adobe Systems Incorporated)
Task: {6D6B047E-80B9-48B4-A9BA-8B1C7EDF001D} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {83DD901E-DA42-4065-B8E7-45D2C817C258} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {8D716E2F-5C8E-4395-99FD-70C605F2A4A2} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {9F787592-B232-403A-8193-9E009E2B1A83} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2015-08-20] (Piriform Ltd)
Task: {BC9B1A95-12D1-4823-AFA2-2A5FDB5D4963} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {C3281C8F-96BC-4A74-8051-EBB7B0556817} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {D77772D4-B619-402D-9170-5BB7417A49C2} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {DF01C8A2-C11B-4453-998A-6A216A186995} - System32\Tasks\{35632CAD-3880-4C7D-8D61-1547549F3DE0} => pcalua.exe -a C:\Miguel_Rufino\SetupDWGTrueView2012_64bit.exe -d C:\Miguel_Rufino
Task: {E06B9510-94D5-456C-9CCF-CD7FA78087BC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {E215D27B-D2AE-40F5-880A-59616A6C031C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {E589CC36-4230-41BE-9253-09C6298DBF2D} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-22] (TOSHIBA CORPORATION)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2012-07-11 16:35 - 2012-03-11 14:56 - 00086608 _____ () C:\Windows\System32\cpwmon64.dll
2010-07-05 09:59 - 2005-03-12 01:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2010-07-05 10:00 - 2009-07-31 02:58 - 00090624 _____ () C:\Windows\System32\Primomonnt.dll
2012-11-29 21:31 - 2012-11-29 21:31 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2015-05-06 13:24 - 2005-04-22 05:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2010-04-06 14:53 - 2010-04-06 14:53 - 00578936 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2015-08-24 19:28 - 2015-08-24 19:28 - 00061440 _____ () C:\Program Files (x86)\CCleaner\lang\lang-2070.dll
2010-02-05 17:44 - 2010-02-05 17:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2015-09-15 18:29 - 2015-05-25 11:32 - 00068432 _____ () C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll
2015-09-15 18:29 - 2015-08-06 04:51 - 00582144 _____ () C:\Program Files (x86)\Elex-tech\YAC\curlpp.dll
2015-09-15 18:29 - 2015-08-21 03:02 - 00176976 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unrar.dll
2015-09-15 18:29 - 2015-08-21 03:02 - 00087744 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unacev2.dll
2015-09-15 18:29 - 2015-01-13 05:31 - 00179200 _____ () C:\Program Files (x86)\Elex-tech\YAC\libpng.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 16:46 - 2013-02-14 16:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2010-10-20 17:08 - 2010-10-20 17:08 - 00122720 _____ () C:\Program Files (x86)\Microsoft Office\Office14\OUTLCTL.DLL
2015-08-14 19:18 - 2015-08-14 19:18 - 17482952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-944797692-3693780693-2233505248-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Miguel Rufino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk => C:\Windows\pss\MagicDisc.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Miguel Rufino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Miguel Rufino\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: cAudioFilterAgent => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Miguel Rufino\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: facemoods => "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
MSCONFIG\startupreg: hpqSRMon => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
MSCONFIG\startupreg: HSON => %ProgramFiles%\TOSHIBA\TBS\HSON.exe
MSCONFIG\startupreg: HTC Sync Loader => "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
MSCONFIG\startupreg: NBAgent => "c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SmartAudio => C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
MSCONFIG\startupreg: SmartFaceVWatcher => %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: TkBellExe => "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
MSCONFIG\startupreg: Toshiba Registration => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
MSCONFIG\startupreg: Toshiba TEMPRO => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosWaitSrv => %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{5EC5F4B3-B8B6-477E-B5B9-61B2E6B5F5FC}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{B63DB796-AB7F-4BEE-96D3-011199CBBEE4}] => (Allow) svchost.exe
FirewallRules: [{E882B12B-2203-4B17-BD48-722B35A7DCCB}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{8D9DC982-99E6-42E6-8CD7-22759F1653B2}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{C811B61E-B0AB-487F-8970-C47FA6C13CC2}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{4E416D95-55F5-4113-9985-E8A1B81B5B79}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{8985EF9D-F56C-4A15-BB33-B9DF933C5E0E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{10E4323A-525B-4A46-BFB4-997B4B1B3305}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{42A87A6A-FB35-402F-8C58-B740244B57BE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{A2C78E64-64DD-4E3D-B7EC-A0442182E607}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{8593E565-255B-4901-A42E-CFDDC4E6072B}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{A62A2E61-136C-448A-BA0A-B8A6FD93B702}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{930D1B87-5C20-44CC-8E66-3C8A79BC9671}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{8AC9FCFE-B798-4A0F-9FEC-D8F4E64BDB7C}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{BCBAC80D-E1E4-42B6-9566-77356F97BFD1}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{187C2E88-7107-4A86-9B1C-D14448EFA2C9}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{5A3FA787-DD72-41EC-B0DB-01D4AB5FF975}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{B543E290-E196-416C-A735-0F0F7D2EF250}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{041AFCFE-0540-4425-A50C-53A2D473DA33}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{DABE1AC1-21BD-4CE2-A240-7F0250ADFCFE}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{13E1C748-63E9-4F5A-9FB9-8B8FDF62EA0B}] => (Allow) C:\Program Files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [{0C0010D3-36F2-4597-84FD-9EB41B160BF2}] => (Allow) C:\Program Files (x86)\Common Files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [{31034427-F5C1-4814-A72B-4FDC7ABC45C1}] => (Allow) LPort=10255
FirewallRules: [TCP Query User{9193AD6F-D6B3-4B4E-B148-33E557E6791D}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{EEB845B7-57A0-41B8-A17C-80DED0F47676}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [{F679EA04-3A07-489C-9625-899006E59674}] => (Allow) LPort=49173
FirewallRules: [{592FA722-A1C6-4604-903C-7CB9AEB0979C}] => (Allow) LPort=5000
FirewallRules: [{DC12B67F-E4D9-4C41-BE65-ED36BD505FA0}] => (Allow) LPort=49164
FirewallRules: [{4D5D4DDA-33CD-489A-B837-01CA8B2E3D0B}] => (Allow) LPort=5000
FirewallRules: [{45DA38C4-63E4-46E4-838F-8441E341BE83}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AB1645EA-04C9-4C55-98A5-9629B5CE1BE3}] => (Allow) LPort=2869
FirewallRules: [{1A1FE96F-44BF-47EB-855B-F90976237A31}] => (Allow) LPort=1900
FirewallRules: [{E535C212-2CD7-4A91-B010-FCB62A756068}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{8C3DCAFA-8F34-4821-B7C1-8C89A58EF8C8}] => (Allow) C:\Program Files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [{269FF180-4C81-42CF-928F-07BCA604537D}] => (Allow) C:\Program Files (x86)\Common Files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [{AA798357-8CEB-457A-844D-3EEF3EB82F4B}] => (Allow) C:\Windows\SysWOW64\rundll32.exe
FirewallRules: [{C98C4EA3-07B7-4D86-8A7E-9E85B2D63034}] => (Allow) C:\Windows\SysWOW64\rundll32.exe
FirewallRules: [{0550D377-6C0A-4C49-9EDF-033064D705E0}] => (Allow) C:\Program Files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [{8EC3730C-A4E6-4653-9731-83162332C82F}] => (Allow) C:\Program Files (x86)\Common Files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [TCP Query User{E64AE302-8033-4B27-AD21-C81F1F9F2BED}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{7FEE20FA-7713-4380-ABFD-5A8F5D3FCC8C}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [TCP Query User{FCAC8554-9D30-4667-8ACD-FFD6E603CB09}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{4D2B0FCC-B975-41DF-9BD3-959658BDB7F6}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{4C3E2D5D-3EC9-4CA6-8403-AB9F27037AC1}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [{A6ABAC9E-8B39-4A6F-8784-6B24C133D5F3}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [TCP Query User{9AF1E4F2-A7E6-4C94-B65F-7A9A2BBD56D6}C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{4FB39E93-2204-4F41-9284-30A6EF1F348F}C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{1E13EFB6-6FD2-4ABF-958C-166BFCBA69DD}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{8C750E28-487D-464A-BD93-CCE2A5E2CBDF}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{17D1D4EB-67DE-4A0F-874A-C43A8856219F}] => (Allow) C:\Program Files (x86)\Veetle\Player\VeetleNet.exe
FirewallRules: [{932186B1-8998-4324-8322-8A9A3E892F3E}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{A84DEC3F-A558-48A3-A0A9-5D2F917BF4DF}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [TCP Query User{7DEEF1AF-A9E7-4442-B452-CBF9EF0B1C6C}C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{291B0124-19E6-48CF-9B51-5000D2AA63CD}C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{B971A810-81F2-4B01-B307-55CD5604774B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\{E5A24F8D-40E1-45CB-B509-81186D795735}\setup\hpznui40.exe
FirewallRules: [{BA82BD56-BF98-4D9F-9B3E-3A44EA1C90DC}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{6B2D9B3F-CE27-40A0-92B0-5A167ECD8F4D}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{45F11D52-0CFD-4717-BE62-A25FFD327CF6}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{2F88EF03-919A-48F1-A1EB-FF8052B44651}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{D2217BAC-5FF1-4528-A004-C421C4208FA5}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [{8A744DA8-C68E-4C40-AE3B-91ADBFBD6240}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{655204DF-4879-43F5-88D6-08FFDEDA1614}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{C3CA7290-5461-43B5-B770-6924BF53FBAA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{93F37E83-437F-475E-8D86-146D9B3C12B7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{3E829C32-9020-43EA-B309-2A302760B3B7}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{88762E55-D906-4CDE-B5F9-ADFAA1C5680E}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{EF6083CB-0EC7-4D77-AA0D-EB7B75477FA5}] => (Allow) LPort=54925
FirewallRules: [{277791C9-0694-4D9B-AB83-7A7A5A682542}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: MpKsla2bde8c8
Description: MpKsla2bde8c8
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsla2bde8c8
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 2260ij
Description: 2260ij
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: DAEMON Tools Virtual Bus
Description: DAEMON Tools Virtual Bus
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: DT Soft Ltd
Service: dtsoftbus01
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: Teredo Tunneling Pseudo-Interface
Description: Adaptador de Túnel Teredo da Microsoft
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddWin32ServiceFiles: Unable to back up image of service Avast Antivirus since QueryServiceConfig API failed

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary ngvss.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary avast! VM Monitor.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary aswSP.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary aswSnx.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary avast! Revert.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary aswRdr.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary aswMonFlt.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:28:25 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddWin32ServiceFiles: Unable to back up image of service Avast Antivirus since QueryServiceConfig API failed

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:28:25 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary ngvss.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.


System errors:
=============
Error: (09/16/2015 06:30:10 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: A chamada ScRegSetValueExW falhou por FailureCommand com o seguinte erro:
%%5

Error: (09/16/2015 06:30:04 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: A chamada ScRegSetValueExW falhou por Start com o seguinte erro:
%%5

Error: (09/16/2015 06:22:50 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: O serviço HP Network Devices Support terminou com o seguinte erro:
%%126

Error: (09/16/2015 06:20:50 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )
Description: A funcionalidade de Proteção em Tempo Real de %%860 encontrou um erro e falhou.

Funcionalidade: %%886

Código de Erro: 0x80070005

Descrição do erro: Acesso negado.

Motivo: %%892

Error: (09/16/2015 06:20:45 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: A chamada ScRegSetValueExW falhou por Start com o seguinte erro:
%%5

Error: (09/16/2015 02:32:08 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: A chamada ScRegSetValueExW falhou por FailureCommand com o seguinte erro:
%%5

Error: (09/16/2015 02:32:05 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: A chamada ScRegSetValueExW falhou por Start com o seguinte erro:
%%5

Error: (09/16/2015 02:25:43 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: O serviço HP Network Devices Support terminou com o seguinte erro:
%%126

Error: (09/16/2015 02:24:03 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )
Description: A funcionalidade de Proteção em Tempo Real de %%860 encontrou um erro e falhou.

Funcionalidade: %%886

Código de Erro: 0x80070005

Descrição do erro: Acesso negado.

Motivo: %%892

Error: (09/16/2015 02:23:41 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: A chamada ScRegSetValueExW falhou por Start com o seguinte erro:
%%5


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Percentage of memory in use: 54%
Total physical RAM: 3958.84 MB
Available physical RAM: 1814.23 MB
Total Virtual: 7915.89 MB
Available Virtual: 5009.8 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:232.65 GB) (Free:139.88 GB) NTFS
Drive d: (MR) (Fixed) (Total:232.72 GB) (Free:220.14 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Cool (Size: 465.8 GB) (Disk ID: 02C50C24)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=232.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=232.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================[/b]
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations


Last edited by Gary R on Wed Sep 16, 2015 8:28 pm; edited 1 time in total
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Wed Sep 16, 2015 8:26 pm    Post subject: Reply with quote

Please go to Control Panel > Programs > Uninstall a program and Uninstall the following:

Quote:
µTorrent
Java 8 Update 31 (64-bit)
Java 8 Update 31


Use of P2P programs is the fastest way to an infection that I know of.
Old out of date versions of Java can be, and almost always are exploited.

Reboot your computer once they're all uninstalled

Next ...


  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.

    • Copy/Paste the contents of the code box below into Notepad (don't include Code: ).


Code:

C:\Program Files (x86)\Elex-tech
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicyScripts-x32: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-04-16] (Elex do Brasil Participações Ltda)
C:\Program Files (x86)\Elex-tech
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-14] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [53568 2015-04-16] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [61832 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2015-09-01] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [68488 2015-08-26] (Elex do Brasil Participações Ltda)
C:\Program Files (x86)\Elex-tech
C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys
C:\Windows\System32\DRIVERS\iSafeNetFilter.sys
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2015-09-15 18:29 - 2015-08-26 07:49 - 00068488 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-09-15 18:29 - 2015-04-16 09:55 - 00053568 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-09-15 18:14 - 2015-09-15 18:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Elex-tech
2015-09-16 11:37 - 2013-06-06 17:18 - 00000000 ____D C:\Users\user\AppData\Roaming\uTorrent
2015-09-15 18:29 - 2015-05-25 11:32 - 00068432 _____ () C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll
2015-09-15 18:29 - 2015-08-06 04:51 - 00582144 _____ () C:\Program Files (x86)\Elex-tech\YAC\curlpp.dll
2015-09-15 18:29 - 2015-08-21 03:02 - 00176976 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unrar.dll
2015-09-15 18:29 - 2015-08-21 03:02 - 00087744 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unacev2.dll
2015-09-15 18:29 - 2015-01-13 05:31 - 00179200 _____ () C:\Program Files (x86)\Elex-tech\YAC\libpng.dll
AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939
FirewallRules: [{8A744DA8-C68E-4C40-AE3B-91ADBFBD6240}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{655204DF-4879-43F5-88D6-08FFDEDA1614}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
EmptyTemp:
Hosts:
Cmd: ipconfig /flushdns



    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt



NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system


  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log



Next ...

Please run a scan with ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

  • Please go HERE then click on Run ESET Online Scanner

Quote:
Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.


  • Select the option YES, I accept the Terms of Use then click on:
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked.
  • Now click on Advanced Settings and select the following:



    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology


  • Now click on:
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed click on Start to start the scan.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed you will be presented with a list of found threats ....

    • Click on the List of found threats link
    • Click on Export to text file
    • Save as ESET.txt to your Desktop

  • Exit out of ESET Online Scanner.
  • Post me the contents of ESET.txt please.


Summary of the logs I need from you in your next post:

  • Fixlog.txt
  • E-Set.txt


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 4:01 am    Post subject: fixlog Reply with quote

Fix result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-17 10:02:40) Run:1
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Program Files (x86)\Elex-tech
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicyScripts-x32: Restriction <======= ATTENTION
CHR HKLM SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-04-16] (Elex do Brasil Participações Ltda)
C:\Program Files (x86)\Elex-tech
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-14] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [53568 2015-04-16] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [61832 2015-08-20] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2015-09-01] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [68488 2015-08-26] (Elex do Brasil Participações Ltda)
C:\Program Files (x86)\Elex-tech
C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys
C:\Windows\System32\DRIVERS\iSafeNetFilter.sys
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2015-09-15 18:29 - 2015-08-26 07:49 - 00068488 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-09-15 18:29 - 2015-04-16 09:55 - 00053568 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-09-15 18:14 - 2015-09-15 18:14 - 00000000 ____D C:\Users\user\AppData\Roaming\Elex-tech
2015-09-16 11:37 - 2013-06-06 17:18 - 00000000 ____D C:\Users\user\AppData\Roaming\uTorrent
2015-09-15 18:29 - 2015-05-25 11:32 - 00068432 _____ () C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll
2015-09-15 18:29 - 2015-08-06 04:51 - 00582144 _____ () C:\Program Files (x86)\Elex-tech\YAC\curlpp.dll
2015-09-15 18:29 - 2015-08-21 03:02 - 00176976 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unrar.dll
2015-09-15 18:29 - 2015-08-21 03:02 - 00087744 _____ () C:\Program Files (x86)\Elex-tech\YAC\tws\unacev2.dll
2015-09-15 18:29 - 2015-01-13 05:31 - 00179200 _____ () C:\Program Files (x86)\Elex-tech\YAC\libpng.dll
AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939
FirewallRules: [{8A744DA8-C68E-4C40-AE3B-91ADBFBD6240}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{655204DF-4879-43F5-88D6-08FFDEDA1614}] => (Allow) C:\Users\user\AppData\Roaming\uTorrent\uTorrent.exe
EmptyTemp:
Hosts:
Cmd: ipconfig /flushdns
*****************


"C:\Program Files (x86)\Elex-tech" folder move:

Could not move "C:\Program Files (x86)\Elex-tech" => Scheduled to move on reboot.

C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\Machine => moved successfully
HKU\CHR HKLM SOFTWARE\Policies\Google: Restriction <======= ATTENTION\SOFTWARE\Policies\Google => key not found.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Error setting value.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => key not found.
"HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => key not found.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
iSafeService => Unable to stop service.
iSafeService => service could not remove

"C:\Program Files (x86)\Elex-tech" folder move:

Could not move "C:\Program Files (x86)\Elex-tech" => Scheduled to move on reboot.

iSafeKrnl => Service stopped successfully.
iSafeKrnl => service removed successfully
iSafeKrnlBoot => service removed successfully
iSafeKrnlKit => Service stopped successfully.
iSafeKrnlKit => service removed successfully
iSafeKrnlMon => Service stopped successfully.
iSafeKrnlMon => service removed successfully
iSafeKrnlR3 => Unable to stop service.
iSafeKrnlR3 => service removed successfully
iSafeNetFilter => Service stopped successfully.
iSafeNetFilter => service removed successfully

"C:\Program Files (x86)\Elex-tech" folder move:

Could not move "C:\Program Files (x86)\Elex-tech" => Scheduled to move on reboot.

C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys => moved successfully
C:\Windows\System32\DRIVERS\iSafeNetFilter.sys => moved successfully

"C:\Program Files (x86)\Elex-tech" folder move:

Could not move "C:\Program Files (x86)\Elex-tech" => Scheduled to move on reboot.

"C:\Windows\system32\Drivers\iSafeNetFilter.sys" => File/Folder not found.
"C:\Windows\system32\Drivers\iSafeKrnlBoot.sys" => File/Folder not found.
C:\Users\user\AppData\Roaming\Elex-tech => moved successfully
"C:\Users\user\AppData\Roaming\uTorrent" => File/Folder not found.
C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll => moved successfully
C:\Program Files (x86)\Elex-tech\YAC\curlpp.dll => moved successfully
C:\Program Files (x86)\Elex-tech\YAC\tws\unrar.dll => moved successfully
C:\Program Files (x86)\Elex-tech\YAC\tws\unacev2.dll => moved successfully
C:\Program Files (x86)\Elex-tech\YAC\libpng.dll => moved successfully
C:\ProgramData\TEMP => ":A1EDB939" ADS removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{8A744DA8-C68E-4C40-AE3B-91ADBFBD6240} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{655204DF-4879-43F5-88D6-08FFDEDA1614} => value removed successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= ipconfig /flushdns =========


Configura��o IP do Windows

Cache de resolu��o DNS limpa com �xito.

========= End of CMD: =========

EmptyTemp: => 765.5 MB temporary data Removed.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-09-17 10:07:30)<=

C:\Program Files (x86)\Elex-tech => moved successfully
C:\Program Files (x86)\Elex-tech => Is moved successfully
C:\Program Files (x86)\Elex-tech => Is moved successfully
C:\Program Files (x86)\Elex-tech => Is moved successfully

==== End of Fixlog 10:07:31 ====
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 4:03 am    Post subject: eset Reply with quote

C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\aceracebho.dll.vir Win32/BrowseFox.AE potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\aceraceUninstall.exe.vir Win32/BrowseFox.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\updateacerace.exe.vir a variant of MSIL/BrowseFox.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\56db9de0c76945638e82.dll.vir a variant of Win32/BrowseFox.CB potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\56db9de0c76945638e8264.dll.vir a variant of Win64/BrowseFox.CI potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\56db9de0c76945638e827e39885bf1ad.dll.vir a variant of Win32/BrowseFox.M potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\56db9de0c76945638e827e39885bf1ad64.dll.vir a variant of Win64/BrowseFox.CK potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\acerace.BrowserAdapter.exe.vir a variant of Win32/BrowseFox.AC potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\acerace.BrowserAdapter64.exe.vir a variant of Win64/BrowseFox.CN potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\acerace.expext.exe.vir a variant of Win32/BrowseFox.AA potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\acerace.expextdll.dll.vir a variant of Win64/BrowseFox.CJ potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\acerace.PurBrowse64.exe.vir a variant of Win64/BrowseFox.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\f2944598b89f4e10b544.dll.vir a variant of Win32/BrowseFox.CB potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\f2944598b89f4e10b5445173761572df.dll.vir a variant of Win32/BrowseFox.M potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\f2944598b89f4e10b5445173761572df64.dll.vir a variant of Win64/BrowseFox.CK potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\f2944598b89f4e10b54464.dll.vir a variant of Win64/BrowseFox.CI potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\utilacerace.exe.vir a variant of MSIL/BrowseFox.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.Bromon.dll.vir a variant of MSIL/BrowseFox.N potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.BroStats.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.BrowserAdapter.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.CompatibilityChecker.dll.vir a variant of MSIL/BrowseFox.N potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.ExpExt.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.FFUpdate.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.GCUpdate.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.IEUpdate.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\ace race\bin\plugins\acerace.PurBrowseG.dll.vir a variant of MSIL/BrowseFox.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\globalupdate.exe.vir Win32/AlteredSoftware.F potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdate.exe.vir Win32/AlteredSoftware.F potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateBroker.exe.vir Win32/AlteredSoftware.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateCrashHandler.exe.vir Win32/AlteredSoftware.F potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\globalupdateOnDemand.exe.vir Win32/AlteredSoftware.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll.vir a variant of Win32/AlteredSoftware.E potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll.vir a variant of Win32/AlteredSoftware.G potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll.vir a variant of Win32/AlteredSoftware.G potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\gmsd_pt_77\gamesdesktop_widget.exe.vir a variant of Win32/AdWare.EoRezo.AU application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\gmsd_pt_77\predm.exe.vir Win32/Adware.EoRezo application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\5926817b-1012-488a-94bb-12ed1649f24b.dll.vir a variant of Win64/Toolbar.Crossrider.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-1-6.exe.vir a variant of Win32/Toolbar.CrossRider.CD potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-1-7.exe.vir a variant of Win32/Toolbar.CrossRider.CD potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-10.exe.vir a variant of Win32/Toolbar.CrossRider.CD potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-3.exe.vir a variant of Win32/Toolbar.CrossRider.CH potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-4.exe.vir a variant of Win32/Toolbar.CrossRider.CH potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-5.exe.vir a variant of Win32/Toolbar.CrossRider.CC potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-6.exe.vir a variant of Win32/Toolbar.CrossRider.CD potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-64.exe.vir a variant of Win64/Toolbar.Crossrider.N potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\634027d3-8601-4903-b4cb-3b30d78f11ce-7.exe.vir a variant of Win32/Toolbar.CrossRider.CD potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\d1aa6bb2-e653-4359-94e1-3a809741b43c.dll.vir a variant of Win32/Toolbar.CrossRider.CG potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\Uninstall.exe.vir a variant of Win32/Toolbar.CrossRider.CU potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\UninstallBrw.exe.vir a variant of Win32/Toolbar.CrossRider.CD potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Plus_HD_1.3V07.09\utils.exe.vir a variant of Win32/Toolbar.CrossRider.CM potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\vShare\lip.exe.vir a variant of Win32/Toolbar.iMedix.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\vShare\Uninstall.exe.vir a variant of Win32/Toolbar.iMedix.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\vShare\vprot.exe.vir a variant of Win32/Toolbar.iMedix.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\vShare\vshare_toolbar.dll.vir a variant of Win32/Toolbar.iMedix.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Local\gmsd_pt_77\upgmsd_pt_77.exe.vir a variant of Win32/Adware.EoRezo.AJ application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\chrome\content\core\1591ecae29f2c62038905782a7a119ff.js.vir JS/Toolbar.Crossrider.G potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\102.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\119.js.vir JS/Toolbar.Crossrider.K potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\14.js.vir JS/Toolbar.Crossrider.O potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\178.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\179.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\180.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\184.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\195.js.vir JS/Toolbar.Crossrider.K potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\200.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\220.js.vir JS/Toolbar.Crossrider.B potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\223.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\231.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\232.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\234.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\242.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\252.js.vir JS/Toolbar.Crossrider.K potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\253.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\262.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\263.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\273.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\281.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\288.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\289.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\300.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\335.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\339.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\356.js.vir JS/Toolbar.Crossrider.K potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\376.js.vir JS/Toolbar.Crossrider.L potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\380.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\385.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\389.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\390.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\391.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\424.js.vir JS/Toolbar.Crossrider.J potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\47.js.vir JS/Toolbar.Crossrider.M potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\64.js.vir JS/Toolbar.Crossrider.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com\extensionData\plugins\91.js.vir JS/Toolbar.Crossrider.B potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\defsearchp@gmail.com\chrome\content\jquery-2.1.0.min.js.vir Win32/Toolbar.TNT2.I potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fxlk1uov.default\Extensions\fftoolbar2014@etech.com\chrome\content\toolbar.js.vir Win32/Toolbar.TNT2.I potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\mystartsearch\UninstallManager.exe.vir a variant of Win32/ELEX.CP potentially unwanted application
C:\AdwCleaner\Quarantine\C\users\user\AppData\Roaming\sweet-page\UninstallManager.exe.vir a variant of Win32/ELEX.CP potentially unwanted application
C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64.sys.vir a variant of Win64/NetFilter.A potentially unsafe application
C:\AdwCleaner\Quarantine\C\Windows\System32\drivers\{f2944598-b89f-4e10-b544-5173761572df}Gw64.sys.vir a variant of Win64/NetFilter.A potentially unsafe application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\bugreport.exe a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iImportLib.dll a variant of Win32/ELEX.BP potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\ipcproxy.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSafeAdless.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSafeBugReport.exe a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\isafeclc.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\isafeclcv.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\isafemadwc.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\isafembp.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSafeNetFilter.sys a variant of Win64/NetFilter.A potentially unsafe application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSafeRKScanShell64.dll a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\isaferpt.dll a variant of Win32/ELEX.CR potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSafeTHlp64.exe a variant of Win32/ELEX.CC potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSvc.dll a variant of Win32/ELEX.CS potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\iSvc2.dll a variant of Win32/ELEX.CQ potentially unwanted application
C:\FRST\Quarantine\C\Program Files (x86)\Elex-tech\Elex-tech\YAC\uninstall.exe a variant of Win32/ELEX.DB potentially unwanted application
C:\FRST\Quarantine\C\Windows\system32\DRIVERS\iSafeNetFilter.sys.xBAD a variant of Win64/NetFilter.A potentially unsafe application
C:\Users\Miguel Rufino\Downloads\cbsidlm-tr1_7-Free_Windows_Cleanup_Tool-SEO2-75317148.exe Win32/DownloadAdmin.D potentially unwanted application
C:\Users\Miguel Rufino\Downloads\ccsetup320.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application
C:\Users\Miguel Rufino\Downloads\ccsetup324.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application
C:\Users\Miguel Rufino\Downloads\CuteEditor.exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\Users\Miguel Rufino\Downloads\CuteWriter (3).exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\Users\Miguel Rufino\Downloads\CuteWriter.exe a variant of Win32/Bundled.Toolbar.Ask.G potentially unsafe application
C:\Users\Miguel Rufino\Downloads\setup-ltr1235.exe a variant of Win32/1AntiVirus potentially unwanted application
C:\Users\Miguel Rufino\Downloads\setup_dt.exe a variant of Win32/SmartTweak.A potentially unwanted application
C:\Users\user\Downloads\ccsetup509.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\user\Google Drive\Soft_All_CGF\ccsetup509.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\user\Google Drive\Soft_All_CGF\PDFCreator-1_9_3-setup.exe Win32/InstallMonetizer.AQ potentially unwanted application
C:\Users\user\Google Drive\Soft_All_CGF\PrimoPDF.exe Win32/OpenCandy potentially unsafe application
C:\Users\user\Google Drive\Soft_All_CGF\XnView-win.exe Win32/JoyDownloader.D potentially unwanted application
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Thu Sep 17, 2015 5:37 am    Post subject: Reply with quote

Most of the stuff found by e-set is the stuff quarantined by ADWCleaner and FRST, so for the moment it's safe, and we'll leave that in place, we'll clear it all out permanently before we finish.

So let's take care of the stuff that's not quarantined ....



  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.

    • Copy/Paste the contents of the code box below into Notepad (don't include Code:).


Code:
C:\Users\Miguel Rufino\Downloads\cbsidlm-tr1_7-Free_Windows_Cleanup_Tool-SEO2-75317148.exe
C:\Users\Miguel Rufino\Downloads\ccsetup320.exe
C:\Users\Miguel Rufino\Downloads\ccsetup324.exe
C:\Users\Miguel Rufino\Downloads\CuteEditor.exe
C:\Users\Miguel Rufino\Downloads\CuteWriter (3).exe
C:\Users\Miguel Rufino\Downloads\CuteWriter.exe
C:\Users\Miguel Rufino\Downloads\setup-ltr1235.exe
C:\Users\Miguel Rufino\Downloads\setup_dt.exe
C:\Users\user\Downloads\ccsetup509.exe
C:\Users\user\Google Drive\Soft_All_CGF\ccsetup509.exe
C:\Users\user\Google Drive\Soft_All_CGF\PDFCreator-1_9_3-setup.exe
C:\Users\user\Google Drive\Soft_All_CGF\PrimoPDF.exe
C:\Users\user\Google Drive\Soft_All_CGF\XnView-win.exe



    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt



NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system


  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log



Also ... please let me know how your computer is behaving now.

.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 6:38 am    Post subject: fixlog Reply with quote

Fix result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-17 14:45:4Cool Run:2
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\Users\Miguel Rufino\Downloads\cbsidlm-tr1_7-Free_Windows_Cleanup_Tool-SEO2-75317148.exe
C:\Users\Miguel Rufino\Downloads\ccsetup320.exe
C:\Users\Miguel Rufino\Downloads\ccsetup324.exe
C:\Users\Miguel Rufino\Downloads\CuteEditor.exe
C:\Users\Miguel Rufino\Downloads\CuteWriter (3).exe
C:\Users\Miguel Rufino\Downloads\CuteWriter.exe
C:\Users\Miguel Rufino\Downloads\setup-ltr1235.exe
C:\Users\Miguel Rufino\Downloads\setup_dt.exe
C:\Users\user\Downloads\ccsetup509.exe
C:\Users\user\Google Drive\Soft_All_CGF\ccsetup509.exe
C:\Users\user\Google Drive\Soft_All_CGF\PDFCreator-1_9_3-setup.exe
C:\Users\user\Google Drive\Soft_All_CGF\PrimoPDF.exe
C:\Users\user\Google Drive\Soft_All_CGF\XnView-win.exe
*****************

C:\Users\Miguel Rufino\Downloads\cbsidlm-tr1_7-Free_Windows_Cleanup_Tool-SEO2-75317148.exe => moved successfully
C:\Users\Miguel Rufino\Downloads\ccsetup320.exe => moved successfully
C:\Users\Miguel Rufino\Downloads\ccsetup324.exe => moved successfully
C:\Users\Miguel Rufino\Downloads\CuteEditor.exe => moved successfully
C:\Users\Miguel Rufino\Downloads\CuteWriter (3).exe => moved successfully
C:\Users\Miguel Rufino\Downloads\CuteWriter.exe => moved successfully
C:\Users\Miguel Rufino\Downloads\setup-ltr1235.exe => moved successfully
C:\Users\Miguel Rufino\Downloads\setup_dt.exe => moved successfully
C:\Users\user\Downloads\ccsetup509.exe => moved successfully
C:\Users\user\Google Drive\Soft_All_CGF\ccsetup509.exe => moved successfully
C:\Users\user\Google Drive\Soft_All_CGF\PDFCreator-1_9_3-setup.exe => moved successfully
C:\Users\user\Google Drive\Soft_All_CGF\PrimoPDF.exe => moved successfully
C:\Users\user\Google Drive\Soft_All_CGF\XnView-win.exe => moved successfully

==== End of Fixlog 14:45:50 ====



PC STATUS:
The ad banners keep coming up, and keeps changing my web page to : hxxp://pt.reimageplus.com/lp/slm/index.php?tracking=mat-low&banner=683496&adgroup=direct&ads_name=direct&keyword=direct&programid=114261&clickid=20Xa3z3OG2c6kYk506ntEe1zCAgi000.
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Thu Sep 17, 2015 8:15 am    Post subject: Reply with quote

OK, please do the following for me ....

First ...

Please run a new scan for me with FRST, and this time before you hit the Scan button make sure you check the Addition.txt option or that log will not be produced.

Post me both the new FRST.txt and Addition.txt

Next ...


  • Double click Frst64.exe to launch it.
  • FRST will start to run.

    • When the tool opens click Yes to the disclaimer.
    • Copy/Paste or Type the following line into the Search: box.

    Quote:
    Fun4IM;Bandoo;Searchnu;Searchqu;iLivid;whitesmoke;datamngr;kelkoopartners;trolltech;babylon;conduit;trovi;clientconnect;reimageplus


    • Press the Search Registry button.
    • When finished searching a log will open on your Desktop ... Search.txt
    • Rename Search.txt to RegSearch.txt (this is important, so don't forget to do it or the log will get overwritten by the next search I want you to do)
    • Please post it in your next reply.





Next ...


  • Double click Frst64.exe to launch it.
  • FRST will start to run.

    • When the tool opens click Yes to the disclaimer.
    • Copy/Paste or Type the following line into the Search: box.

    Quote:
    dnsapi.dll


    • Press the Search Files button.
    • When finished searching a log will open on your Desktop ... Search.txt
    • Please post it in your next reply.



Summary of the logs I need from you in your next post:

  • FRST.txt
  • Addition.txt
  • RegSearch.txt
  • Search.txt


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 8:51 am    Post subject: frst Reply with quote

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:15-09-2015
Ran by user (administrator) on LT-CGF-06-RM (17-09-2015 17:46:20)
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Português (Portugal)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Autodesk) C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
(Autodesk, Inc.) C:\Program Files (x86)\AutoCAD LT 2007\acadlt.exe
(Macrovision Europe Ltd.) C:\Users\user\AppData\Local\Temp\AdskCleanup.0001
(Autodesk, Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\WSCommCntr1.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-11-29] (LogMeIn, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [MobileBroadband] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [280576 2011-10-19] (Vodafone)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22344224 2015-07-29] (Google)
HKU\S-1-5-18\...\Run: [TOSHIBA Online Product Information] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-07-29] (Google)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\SysWOW64\AcSignIcon.dll [2006-03-05] (Autodesk)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutoCAD LT Startup Accelerator.lnk [2010-07-05]
ShortcutTarget: AutoCAD LT Startup Accelerator.lnk -> C:\Program Files (x86)\Common Files\Autodesk Shared\acstart17.exe (Autodesk, Inc)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-04-01]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2010-04-01]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-10-29]
ShortcutTarget: Dropbox.lnk -> C:\Users\Miguel Rufino\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2012-10-24]
ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: SBBD.exe /D \Device\HarddiskVolume2\Program Files (x86)\iS3\STOPzilla AntiVirus\Definitions /Lautocheck autochk *
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{0E4938FD-0AAE-4307-BF34-F6CA5A63D726}: [NameServer] 192.168.0.2 192.168.0.1
Tcpip\..\Interfaces\{35B37513-616A-41DE-B04C-CB43F2BA2CC4}: [NameServer] 62.169.64.129 62.169.64.130
Tcpip\..\Interfaces\{FCC87E52-CD63-4F08-A32D-A495B46CA8B6}: [DhcpNameServer] 192.168.0.1 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = google.pt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = google.pt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Microsoft\Internet Explorer\Main,Start Page = google.pt
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
SearchScopes: HKLM -> {017B0775-6C88-46AE-94C1-19A762DB2CDF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {E0C54028-5F27-42C6-93E8-236439369459} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2012-11-29] (RealDownloader)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Programa Auxiliar de Início de Sessão do Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-16] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-03-19] (<TOSHIBA>)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-16] (Google Inc.)
Toolbar: HKU\S-1-5-21-944797692-3693780693-2233505248-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-16] (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\tpmjus6e.default-1442410384943
FF NewTab: google.pt
FF Homepage: google.pt
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-14] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll [2012-05-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll [2012-05-04] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2013-02-04] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.4.53 -> c:\program files (x86)\real\realplayer\Netscape6\nprjplug.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2012-11-29] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2013-02-04] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2012-11-29] (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll [2012-01-14] (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll [2012-01-14] (Veetle Inc)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-944797692-3693780693-2233505248-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-22] (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll [2013-02-04] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-02-18] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprjplug.dll [2012-05-26] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll [2013-02-04] (RealPlayer)
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: No Name - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-02-04]
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension [2011-08-17]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\prefs.js [2015-09-14]

Chrome:
=======
CHR HomePage: Default -> google.pt
CHR StartupUrls: Default -> "google.pt"
CHR DefaultSearchURL: Default -> hxxp://www.google.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> google
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-09]
CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-09-09]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-09]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-09-09]
CHR Extension: (Documentos do Google offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-10]
CHR Extension: (RealDownloader) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2015-09-09]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2015-09-10]
CHR Extension: (Pagamentos via Chrome Web Store) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-10]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-09]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (No Name) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-28]
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\user\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [77944 2010-07-05] (Autodesk)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-16] (LogMeIn, Inc.)
S4 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-16] (LogMeIn, Inc.)
S4 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-11-29] (LogMeIn, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [633856 2011-06-08] (Nokia) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [X]
S2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 CnxtHdmiAudService; C:\Windows\System32\drivers\CHDMI64.sys [720952 2010-03-05] (Conexant Systems Inc.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [415232 2011-10-18] (Huawei Technologies Co., Ltd.)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-30] (LogMeIn, Inc.)
S4 LMIRfsClientNP; no ImagePath
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 vodafone_K3805-z_cdc_acm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_acm.sys [78336 2010-03-01] (Vodafone)
S3 vodafone_K3805-z_cdc_ecm; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cdc_ecm.sys [88576 2010-03-01] (Vodafone)
S3 vodafone_K3805-z_cpo; C:\Windows\System32\DRIVERS\vodafone_K3805-z_cpo.sys [13824 2010-03-01] (Vodafone)
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-17 12:59 - 2015-09-17 12:59 - 00046544 _____ C:\Users\user\Desktop\ESET.txt
2015-09-17 10:19 - 2015-09-17 10:19 - 00000000 ____D C:\Program Files (x86)\ESET
2015-09-17 10:18 - 2015-09-17 10:18 - 02870984 _____ (ESET) C:\Users\user\Downloads\esetsmartinstaller_enu.exe
2015-09-17 09:51 - 2015-09-17 15:39 - 00000228 _____ C:\Users\user\Desktop\spy.txt
2015-09-16 18:48 - 2015-09-16 18:48 - 00056163 _____ C:\Users\user\Desktop\Addition.txt
2015-09-16 18:48 - 2015-09-16 18:47 - 01660416 _____ C:\Users\user\Desktop\AdwCleaner(1).exe
2015-09-16 18:47 - 2015-09-16 18:47 - 01660416 _____ C:\Users\user\Downloads\AdwCleaner(1).exe
2015-09-16 18:45 - 2015-09-17 17:46 - 00029196 _____ C:\Users\user\Desktop\FRST.txt
2015-09-16 18:45 - 2015-09-17 17:46 - 00000000 ____D C:\FRST
2015-09-16 18:44 - 2015-09-16 18:44 - 02191360 _____ (Farbar) C:\Users\user\Downloads\FRST64.exe
2015-09-16 18:44 - 2015-09-16 18:44 - 02191360 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2015-09-16 18:40 - 2015-09-16 18:40 - 00000207 _____ C:\Windows\tweaking.com-regbackup-LT-CGF-06-RM-Windows-7-Home-Premium-(64-bit).dat
2015-09-16 18:40 - 2015-09-16 18:40 - 00000000 ____D C:\RegBackup
2015-09-16 18:39 - 2015-09-16 18:39 - 00002242 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-09-16 18:39 - 2015-09-16 18:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-09-16 18:39 - 2015-09-16 18:39 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-09-16 18:38 - 2015-09-16 18:38 - 04687376 _____ (Tweaking.com) C:\Users\user\Downloads\tweaking.com_registry_backup_setup.exe
2015-09-16 18:21 - 2015-09-16 18:21 - 00000000 ____D C:\Users\user\AppData\Local\GWX
2015-09-16 15:58 - 2015-09-16 15:59 - 00031472 _____ C:\Users\user\Desktop\dds.txt
2015-09-16 15:58 - 2015-09-16 15:59 - 00015920 _____ C:\Users\user\Desktop\attach.txt
2015-09-16 15:51 - 2015-09-16 15:51 - 00688992 ____R (Swearware) C:\Users\user\Desktop\dds.com
2015-09-16 15:51 - 2015-09-16 15:51 - 00688992 _____ (Swearware) C:\Users\user\Downloads\dds.com
2015-09-16 15:44 - 2015-09-16 15:43 - 00688992 _____ (Swearware) C:\Users\user\Desktop\dds.scr
2015-09-16 15:43 - 2015-09-16 15:43 - 00688992 _____ (Swearware) C:\Users\user\Downloads\dds.scr
2015-09-16 14:48 - 2015-09-16 14:53 - 148151968 _____ (Microsoft Corporation) C:\Users\user\Downloads\msert.exe
2015-09-16 14:47 - 2015-09-16 14:47 - 00000061 _____ C:\Users\user\Desktop\222.txt
2015-09-16 14:27 - 2015-09-16 14:39 - 00000000 ____D C:\Users\user\AppData\Local\Mozilla
2015-09-16 14:27 - 2015-09-16 14:27 - 00000000 ____D C:\Users\user\AppData\Roaming\Mozilla
2015-09-16 14:23 - 2015-09-16 14:23 - 00000000 ____D C:\Users\user\AppData\Local\VirtualStore
2015-09-16 14:22 - 2015-09-17 14:51 - 00000448 _____ C:\Windows\setupact.log
2015-09-16 14:22 - 2015-09-16 14:22 - 00000000 _____ C:\Windows\setuperr.log
2015-09-16 14:21 - 2015-09-17 10:06 - 00834704 _____ C:\Windows\PFRO.log
2015-09-16 14:11 - 2015-09-16 14:11 - 00008968 _____ C:\Users\user\Desktop\bookmarks-2015-09-16.json
2015-09-16 13:27 - 2015-09-17 09:50 - 00038134 _____ C:\Windows\DPINST.LOG
2015-09-16 13:17 - 2015-09-16 13:17 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\SpyHunter-Installer(1).exe
2015-09-16 11:32 - 2015-09-16 11:32 - 00000000 ____D C:\Users\user\AppData\Roaming\Dropbox
2015-09-16 11:29 - 2015-09-16 14:21 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-09-16 11:29 - 2015-09-16 11:29 - 00000000 ____D C:\ProgramData\Dropbox
2015-09-16 11:01 - 2015-09-16 14:33 - 00000000 ____D C:\Users\user\Desktop\Dados antigos do Firefox
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\Windows\system32\log
2015-09-15 18:29 - 2015-09-15 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user\Downloads\yet_another_cleaner_sk_7489594.exe
2015-09-15 17:17 - 2015-09-15 17:17 - 01660416 _____ C:\Users\user\Downloads\adwcleaner_5.007.exe
2015-09-15 17:11 - 2015-09-15 17:12 - 00000000 ____D C:\Windows\SysWOW64\vbox
2015-09-15 17:11 - 2015-09-15 17:12 - 00000000 ____D C:\Windows\system32\vbox
2015-09-15 17:11 - 2015-09-15 17:11 - 00000000 ____D C:\Users\user\AppData\Roaming\AVAST Software
2015-09-15 17:02 - 2015-09-15 17:02 - 00000000 ____D C:\ProgramData\AVAST Software
2015-09-15 17:01 - 2015-09-15 17:02 - 05685704 _____ (AVAST Software) C:\Users\user\Downloads\avast_free_antivirus_setup_online.exe
2015-09-15 15:54 - 2010-03-08 11:10 - 00013824 _____ (Kephyr) C:\Windows\system32\ffnd.exe
2015-09-15 14:42 - 2015-09-15 14:43 - 02687418 _____ (Kephyr) C:\Users\user\Downloads\freefixersetup.exe
2015-09-15 14:30 - 2015-09-15 14:34 - 00000000 ____D C:\Users\user\Downloads\30 Grandes Sucessos
2015-09-15 13:47 - 2015-09-15 13:47 - 00009784 _____ C:\Users\user\Desktop\bookmarks-2015-09-15.json
2015-09-15 12:53 - 2015-09-15 12:53 - 00008366 _____ C:\Windows\system32\.crusader
2015-09-15 11:45 - 2015-09-15 13:00 - 00000000 ____D C:\ProgramData\HitmanPro
2015-09-15 11:44 - 2015-09-15 11:45 - 11352032 _____ (SurfRight B.V.) C:\Users\user\Downloads\HitmanPro_x64.exe
2015-09-14 23:10 - 2015-09-15 14:12 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-14 23:10 - 2015-09-14 23:10 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-14 23:10 - 2015-09-14 23:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-14 23:10 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-14 23:10 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-14 23:10 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-14 23:04 - 2015-09-14 23:07 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\user\Downloads\mbam-setup-2.1.8.1057.exe
2015-09-14 18:04 - 2015-09-14 18:04 - 00000000 _____ C:\autoexec.bat
2015-09-14 18:01 - 2015-09-14 18:01 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\user\Downloads\SpyHunter-Installer.exe
2015-09-14 17:13 - 2015-09-14 17:13 - 00000000 _____ C:\Windows\system32\SBRC.dat
2015-09-14 17:05 - 2015-09-14 17:05 - 00000000 ____D C:\ProgramData\VIPRE
2015-09-14 16:57 - 2015-09-14 22:46 - 00000000 ____D C:\ProgramData\STOPzilla!
2015-09-14 16:57 - 2015-09-14 16:57 - 00000000 ____D C:\Program Files (x86)\iS3
2015-09-14 16:54 - 2015-09-14 16:54 - 02042328 _____ (iS3, Inc.) C:\Users\user\Downloads\STOPzillaPRO_Downloader.exe
2015-09-14 14:56 - 2015-09-14 15:44 - 03707520 _____ C:\Users\user\Desktop\tarouca_med_loj.dwg
2015-09-14 14:53 - 2015-09-14 14:57 - 23312376 _____ (SUPERAntiSpyware) C:\Users\user\Downloads\SAS_829145C1.EXE
2015-09-14 14:35 - 2012-01-26 11:14 - 00000000 ____D C:\Users\user\Desktop\media
2015-09-11 12:01 - 2015-09-11 12:04 - 00000000 ____D C:\Users\user\Desktop\F0244_PD_Vila_Mea_Franchising
2015-09-11 11:35 - 2015-09-11 11:36 - 00000000 ____D C:\Users\user\Desktop\F0255_PD_Tarouca_Franchising_2015
2015-09-11 11:21 - 2015-09-11 11:21 - 00000049 _____ C:\Users\user\Desktop\nota explicativa.txt
2015-09-10 13:39 - 2015-09-10 14:30 - 00001032 _____ C:\Users\user\Desktop\duvidas reunião.txt
2015-09-10 11:13 - 2015-09-10 11:56 - 00042240 _____ C:\Users\user\Desktop\Portas PT.dwg
2015-09-10 10:09 - 2015-09-10 10:09 - 01660416 _____ C:\Users\user\Downloads\AdwCleaner.exe
2015-09-09 11:25 - 2015-08-15 07:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-09 11:25 - 2015-08-15 07:04 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-09 11:25 - 2015-08-15 06:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-09-09 11:25 - 2015-08-15 06:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-09-09 11:25 - 2015-08-15 06:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-09-09 11:25 - 2015-08-15 06:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 11:25 - 2015-08-05 18:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 11:25 - 2015-08-05 18:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-09-09 11:25 - 2015-07-15 04:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-09 11:25 - 2015-07-15 03:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-09-09 11:25 - 2015-07-09 18:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 11:25 - 2015-07-09 18:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 11:25 - 2015-07-09 18:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-09-09 11:25 - 2015-07-09 18:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-09-09 11:25 - 2015-06-25 11:06 - 00115136 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 11:25 - 2015-06-25 11:01 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 11:25 - 2015-06-25 11:01 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 11:25 - 2015-06-25 10:44 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-09-09 11:24 - 2015-09-15 10:23 - 00293280 _____ C:\Users\user\Desktop\Tarouca_DiasBetonagem.dwg
2015-09-09 11:24 - 2015-08-18 02:42 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-09 11:24 - 2015-08-18 02:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-09-09 11:24 - 2015-08-15 07:48 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-09 11:24 - 2015-08-15 07:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-09 11:24 - 2015-08-15 07:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-09 11:24 - 2015-08-15 07:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-09 11:24 - 2015-08-15 07:17 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-09 11:24 - 2015-08-15 07:17 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-09 11:24 - 2015-08-15 07:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-09 11:24 - 2015-08-15 07:09 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-09 11:24 - 2015-08-15 07:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-09-09 11:24 - 2015-08-15 07:06 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-09 11:24 - 2015-08-15 07:04 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-09 11:24 - 2015-08-15 07:00 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-09 11:24 - 2015-08-15 06:57 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-09 11:24 - 2015-08-15 06:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-09-09 11:24 - 2015-08-15 06:53 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-09 11:24 - 2015-08-15 06:46 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 11:24 - 2015-08-15 06:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-09 11:24 - 2015-08-15 06:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-09 11:24 - 2015-08-15 06:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-09-09 11:24 - 2015-08-15 06:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-09-09 11:24 - 2015-08-15 06:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-09-09 11:24 - 2015-08-15 06:39 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-09 11:24 - 2015-08-15 06:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-09-09 11:24 - 2015-08-15 06:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-09-09 11:24 - 2015-08-15 06:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-09-09 11:24 - 2015-08-15 06:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-09-09 11:24 - 2015-08-15 06:24 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-09 11:24 - 2015-08-15 06:23 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-09 11:24 - 2015-08-15 06:22 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-09 11:24 - 2015-08-15 06:22 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-09 11:24 - 2015-08-15 06:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-09-09 11:24 - 2015-08-15 06:16 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-09 11:24 - 2015-08-15 06:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-09-09 11:24 - 2015-08-15 06:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-09-09 11:24 - 2015-08-15 06:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-09-09 11:24 - 2015-08-15 06:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-09-09 11:24 - 2015-08-15 06:07 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-09 11:24 - 2015-08-15 06:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-09-09 11:24 - 2015-08-15 06:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-09-09 11:24 - 2015-08-15 06:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-09-09 11:24 - 2015-08-15 06:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-09-09 11:24 - 2015-08-15 05:55 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-09 11:24 - 2015-08-15 05:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-09-09 11:24 - 2015-08-15 05:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-09 11:24 - 2015-08-15 05:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-09-09 11:24 - 2015-08-15 05:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-09-09 11:24 - 2015-07-23 01:06 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 11:24 - 2015-07-23 01:06 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 11:24 - 2015-07-23 01:06 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 11:24 - 2015-07-23 01:03 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-09-09 11:24 - 2015-07-23 01:03 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01390592 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 11:24 - 2015-07-23 01:02 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 11:24 - 2015-07-23 01:02 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 11:24 - 2015-07-23 01:02 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-09-09 11:24 - 2015-07-23 01:01 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-09-09 11:24 - 2015-07-23 01:01 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 11:24 - 2015-07-23 01:01 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 11:24 - 2015-07-23 00:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 11:24 - 2015-07-23 00:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:52 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 11:24 - 2015-07-23 00:51 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 11:24 - 2015-07-22 18:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-09-09 11:24 - 2015-07-22 18:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-09-09 11:24 - 2015-07-22 18:54 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-09-09 11:24 - 2015-07-22 18:53 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-09-09 11:24 - 2015-07-22 18:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-09-09 11:24 - 2015-07-22 18:52 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-09-09 11:24 - 2015-07-22 18:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-09-09 11:24 - 2015-07-22 18:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-09-09 11:24 - 2015-07-22 18:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 18:42 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 11:24 - 2015-07-22 17:45 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 11:24 - 2015-07-22 17:44 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 11:24 - 2015-07-22 17:44 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 11:24 - 2015-07-22 17:34 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-09-09 11:24 - 2015-07-22 17:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-09-09 11:24 - 2015-07-22 17:31 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 11:24 - 2015-07-22 17:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 11:23 - 2015-08-27 19:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 11:23 - 2015-08-27 19:18 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 11:23 - 2015-08-27 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 11:23 - 2015-08-27 19:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 11:23 - 2015-08-27 18:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-09-09 11:23 - 2015-08-27 18:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-09-09 11:23 - 2015-08-27 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-09-09 11:23 - 2015-08-27 18:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-09-09 11:22 - 2015-08-04 19:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-09-09 11:22 - 2015-08-04 19:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-09-09 11:22 - 2015-08-04 18:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 11:22 - 2015-08-04 18:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 11:22 - 2015-08-04 18:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 11:22 - 2015-08-04 18:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 11:22 - 2015-08-04 18:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 11:22 - 2015-08-04 18:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-09-09 11:22 - 2015-08-04 17:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 11:21 - 2015-09-02 04:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 11:21 - 2015-09-02 04:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 11:21 - 2015-09-02 04:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 11:21 - 2015-09-02 04:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 11:21 - 2015-09-02 03:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-09-09 11:21 - 2015-09-02 03:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-09-09 11:21 - 2015-09-02 03:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-09-09 11:21 - 2015-09-02 03:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-09-09 11:21 - 2015-09-02 02:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 11:21 - 2015-09-02 02:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 11:21 - 2015-09-02 02:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 11:21 - 2015-08-26 19:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 11:21 - 2015-08-26 19:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 11:21 - 2015-08-26 19:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 11:21 - 2015-08-26 19:06 - 00037376 _____ (Microsoft Corporation
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 8:55 am    Post subject: frst partII Reply with quote

2015-09-09 11:21 - 2015-08-26 19:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 11:21 - 2015-08-26 19:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-09-09 11:21 - 2015-08-26 18:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-09-09 11:21 - 2015-08-26 18:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-09-09 11:19 - 2015-09-09 11:20 - 00000000 ____D C:\Users\user\AppData\Local\Autodesk
2015-09-09 11:15 - 2015-09-09 11:15 - 00000000 ____D C:\Users\user\AppData\Local\Adobe
2015-09-08 18:23 - 2015-09-08 18:23 - 00000000 ____D C:\Users\user\AppData\Local\Macromedia
2015-09-08 18:19 - 2015-09-08 18:20 - 00000000 ____D C:\Users\user\AppData\Local\Toshiba
2015-09-08 18:19 - 2015-09-08 18:19 - 00000000 ____D C:\Users\user\AppData\Local\LogMeIn
2015-09-08 18:18 - 2015-09-08 18:18 - 00146960 _____ C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2015-09-08 11:07 - 2015-09-17 14:37 - 00283719 _____ C:\Users\user\Desktop\F0255_Controlo_Datas_Chave_20150910.xlsx
2015-09-07 13:44 - 2015-09-07 13:45 - 16948241 _____ C:\Users\user\Downloads\tarouca.rar
2015-09-04 11:49 - 2015-09-04 11:56 - 00000000 ____D C:\Users\user\Desktop\F0252_PD_Silveira
2015-09-04 09:52 - 2015-09-08 15:26 - 00000586 _____ C:\Users\user\Desktop\hoteis.txt
2015-09-02 16:29 - 2015-09-02 16:30 - 14681212 _____ C:\Users\user\Downloads\PE_AVAC_R00.rar
2015-09-01 17:23 - 2015-09-01 17:26 - 03701760 _____ C:\Users\user\Desktop\03.04.05.Planta Crts Alç2.dwg
2015-08-31 11:13 - 2015-09-14 13:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-17 17:18 - 2012-04-03 18:45 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-17 16:59 - 2013-02-17 23:34 - 01514022 _____ C:\Windows\WindowsUpdate.log
2015-09-17 16:57 - 2010-06-22 01:54 - 00001008 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-17 16:01 - 2015-05-06 13:26 - 00013405 _____ C:\Windows\BRRBCOM.INI
2015-09-17 15:56 - 2010-06-22 01:54 - 00001004 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-17 15:00 - 2009-07-14 05:45 - 00019248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-17 15:00 - 2009-07-14 05:45 - 00019248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-17 14:52 - 2010-09-30 22:44 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2015-09-17 14:51 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-17 13:15 - 2013-08-09 13:58 - 00000000 ____D C:\Users\user\Desktop\ActualizaçãoServidor
2015-09-17 10:07 - 2015-01-29 12:04 - 00000008 __RSH C:\ProgramData\ntuser.pol
2015-09-17 10:03 - 2009-07-14 04:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-09-17 10:03 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2015-09-17 09:48 - 2010-04-01 07:53 - 00000000 ____D C:\Program Files (x86)\Java
2015-09-16 22:54 - 2015-01-06 20:18 - 00000000 ____D C:\Users\user\Desktop\Mariani
2015-09-16 18:50 - 2015-01-28 17:08 - 00000000 ____D C:\AdwCleaner
2015-09-16 15:52 - 2010-06-22 01:54 - 00004004 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-16 15:52 - 2010-06-22 01:54 - 00003752 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-16 13:29 - 2011-08-17 11:53 - 00000000 ____D C:\Program Files (x86)\HTC
2015-09-16 13:27 - 2012-04-03 18:17 - 00000000 ____D C:\Users\Miguel Rufino\AppData\Local\Downloaded Installations
2015-09-16 11:37 - 2014-12-04 19:43 - 00000000 ____D C:\Users\user\AppData\Roaming\XnView
2015-09-16 11:37 - 2013-04-12 16:15 - 00000000 ____D C:\ProgramData\LogMeIn
2015-09-16 11:37 - 2010-07-05 09:59 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2015-09-16 11:36 - 2013-10-10 18:37 - 00000000 ____D C:\Windows\Minidump
2015-09-16 11:34 - 2013-04-12 14:46 - 00000000 ____D C:\Users\user\AppData\Local\Google
2015-09-16 11:29 - 2013-04-12 09:57 - 00001024 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-09-16 11:29 - 2012-11-01 16:20 - 00002808 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-09-16 11:29 - 2012-04-09 16:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-09-16 11:29 - 2010-07-05 09:32 - 00000000 ____D C:\Program Files (x86)\CCleaner
2015-09-15 20:55 - 2013-06-26 10:26 - 00000000 ____D C:\Users\user\Downloads\Linkin Park - Greatest Hits [2013]
2015-09-15 20:51 - 2012-03-02 14:20 - 00000000 ____D C:\Users\Miguel Rufino\AppData\Roaming\GoContactSyncMOD
2015-09-15 19:15 - 2015-07-10 18:00 - 00000000 ___HD C:\$Windows.~BT
2015-09-15 15:54 - 2015-05-06 13:24 - 00000000 ____D C:\Program Files (x86)\ControlCenter4
2015-09-15 15:54 - 2010-07-05 09:44 - 00000000 ____D C:\Program Files\FolderSize
2015-09-15 15:54 - 2010-04-01 08:16 - 00000000 ____D C:\Program Files (x86)\Toshiba TEMPRO
2015-09-15 15:38 - 2009-07-14 18:58 - 00724066 _____ C:\Windows\system32\prfh0816.dat
2015-09-15 15:38 - 2009-07-14 18:58 - 00153958 _____ C:\Windows\system32\prfc0816.dat
2015-09-15 15:38 - 2009-07-14 06:13 - 01664178 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-15 15:02 - 2010-04-01 06:01 - 00000000 ____D C:\Windows\Panther
2015-09-15 09:41 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Branding
2015-09-14 18:55 - 2012-10-19 19:07 - 00002455 _____ C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-09-14 18:55 - 2012-06-01 17:22 - 00002445 _____ C:\Users\Miguel Rufino\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screenpresso.lnk
2015-09-14 16:47 - 2010-06-22 02:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-09-14 16:47 - 2010-06-22 02:36 - 00000000 ____D C:\Program Files (x86)\HP
2015-09-14 16:47 - 2010-06-22 02:35 - 00004631 _____ C:\ProgramData\hpzinstall.log
2015-09-14 16:34 - 2010-06-22 02:35 - 00000000 ____D C:\ProgramData\HP
2015-09-14 16:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2015-09-14 15:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-09-10 15:28 - 2013-04-26 11:16 - 00000000 ____D C:\Users\user\Desktop\fotos
2015-09-10 11:54 - 2013-05-17 12:06 - 00000000 ____D C:\Users\user\AppData\Roaming\PrimoPDF
2015-09-10 11:53 - 2015-03-18 17:33 - 00000683 _____ C:\Users\user\Documents\plot.log
2015-09-09 21:31 - 2013-04-11 18:22 - 00503024 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-09 21:27 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-09 21:27 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-09-09 18:34 - 2010-04-29 23:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-09-09 18:28 - 2009-07-14 03:34 - 00000615 _____ C:\Windows\win.ini
2015-09-08 18:18 - 2013-04-12 14:46 - 00001300 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-09-08 18:07 - 2010-08-03 11:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-08 18:06 - 2012-07-13 20:31 - 00001376 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-09-08 09:57 - 2013-04-12 16:03 - 00000000 ___RD C:\Users\user\Google Drive
2015-09-07 18:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2015-09-01 09:43 - 2012-07-13 20:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-31 09:28 - 2009-07-14 06:08 - 00032578 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-26 17:16 - 2013-05-10 15:24 - 00001704 _____ C:\Users\user\Desktop\Fiscalizacao Mac.lnk
2015-08-18 22:41 - 2013-01-30 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-08-18 19:56 - 2015-08-15 11:55 - 03758240 _____ C:\Users\user\Desktop\Medidas_Interiores_Loja.dwg
2015-08-18 15:27 - 2015-06-05 11:12 - 00000658 _____ C:\Users\user\Desktop\obra.txt

==================== Files in the root of some directories =======

2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v
2014-11-28 15:42 - 2014-11-28 15:42 - 0000057 _____ () C:\ProgramData\Ament.ini
2010-10-22 23:46 - 2010-10-22 23:46 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-06-22 02:35 - 2015-09-14 16:47 - 0004631 _____ () C:\ProgramData\hpzinstall.log

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-09-14 16:06

==================== End of FRST.txt ============================
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 8:57 am    Post subject: addition Reply with quote

Additional scan result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-17 17:47:52)
Running from C:\Users\user\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2010-06-22 00:17:46)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-944797692-3693780693-2233505248-500 - Administrator - Enabled) => C:\Users\Administrador
Convidado (S-1-5-21-944797692-3693780693-2233505248-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-944797692-3693780693-2233505248-1002 - Limited - Enabled)
Miguel Rufino (S-1-5-21-944797692-3693780693-2233505248-1001 - Administrator - Enabled) => C:\Users\Miguel Rufino
user (S-1-5-21-944797692-3693780693-2233505248-1003 - Administrator - Enabled) => C:\Users\user

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AS: Microsoft Security Essentials (Enabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 4.65 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0465-000001000000}) (Version: 4.65.00.0 - Igor Pavlov)
7-Zip 9.21beta (HKLM-x32\...\7-Zip) (Version: - )
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Português (HKLM-x32\...\{AC76BA86-7AD7-1046-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Akamai NetSession Interface (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Akamai) (Version: - Akamai Technologies, Inc)
Alerta de HDD/SSD TOSHIBA (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.6 - TOSHIBA Corporation)
Alerta de HDD/SSD TOSHIBA (Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
Alerta de HDD/SSD TOSHIBA (x32 Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.26 - Atheros Communications Inc.)
ATI Catalyst Install Manager (HKLM\...\{B5896016-3143-B94F-585D-DF75DAF1D879}) (Version: 3.0.765.0 - ATI Technologies, Inc.)
Auslogics Disk Defrag (HKLM-x32\...\{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1) (Version: version 3.1 - Auslogics Software Pty Ltd)
AutoCAD LT 2007 - English (HKLM-x32\...\{5783F2D7-5009-0409-0002-0060B0CE6BBA}) (Version: 17.0.54.110 - Autodesk)
Autodesk DWG TrueView 2014 (HKLM\...\DWG TrueView 2014) (Version: 19.1.18.0 - Autodesk)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.10.10(T) - TOSHIBA CORPORATION)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.35 - Broadcom Corporation)
Brother MFL-Pro Suite DCP-J4120DW (HKLM-x32\...\{7FC49664-DAA4-4E7C-ADD0-614ABB43691B}) (Version: 1.0.4.0 - Brother Industries, Ltd.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
C6300 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
ccc-core-static (x32 Version: 2010.0315.1050.17562 - Nome de sua empresa:) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.09 - Piriform)
Complemento Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Conexant Audio Driver For AMD HDMI Codec (HKLM\...\CNXT_AUDIO_HDA_HDMI) (Version: 4.98.26.0 - Conexant)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.64 - Conexant)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
CutePDF Professional 3.6 (Evaluation) (HKLM-x32\...\CutePDF Professional (Evaluation)_is1) (Version: - Acro Software Inc.)
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.46.1.0328 - DT Soft Ltd)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
DWG TrueView 2012 (HKLM\...\DWG TrueView 2012) (Version: 18.2.51.0 - Autodesk)
DWG TrueView 2012 (Version: 18.2.51.0 - Autodesk) Hidden
DWG TrueView 2014 (Version: 19.1.18.0 - Autodesk) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Facebook Video Calling 1.2.0.287 (HKLM-x32\...\{B92C5909-1D37-4C51-8397-A28BB28E5DC3}) (Version: 1.2.287 - Skype Limited)
FARO LS 1.1.406.58 (HKLM-x32\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production)
Folder Size for Windows (64-bit) (HKLM\...\{F24FF688-7138-4CCF-A83F-71E9FB01170E}) (Version: 2.5 - Brio)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GOM Player (HKLM-x32\...\GOM Player) (Version: 2.2.69.5227 - Gretech Corporation)
Google Apps Migration For Microsoft Outlook® 3.4.27.52 (HKLM-x32\...\{65960C6E-BFA2-4FE7-A1BC-8028F3072566}) (Version: 3.4.27.52 - Google, Inc.)
Google Apps Sync™ for Microsoft Outlook® 3.7.410.1100 (HKLM-x32\...\{799A7E2B-388F-4BDE-B55B-47AF42C6440A}) (Version: 3.7.410.1100 - Google, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.93 - Google Inc.)
Google Drive (HKLM-x32\...\{12ADFB82-D5A3-43E4-B2F4-FCD9B690315B}) (Version: 1.24.9931.5480 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google SketchUp 8 (HKLM-x32\...\{D16B0559-BD37-4725-862C-DB2160A58C53}) (Version: 3.0.4998 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
gpedt.msc 1.0 (HKLM-x32\...\{10B9C608-BF7C-4CCF-A658-C01D969DCA21}_is1) (Version: - Richard)
HP Photosmart C6300 All-In-One Driver Software 13.0 Rel. 4 (HKLM\...\{E5A24F8D-40E1-45CB-B509-81186D795735}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Solutions Framework (HKLM-x32\...\{E35601C0-BA8E-4F32-919A-C7EF4CA81F67}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HTC Driver Installer (HKLM-x32\...\{6D6664A9-3342-4948-9B7E-034EFE366F0F}) (Version: 3.0.0.021 - HTC Corporation)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.7.1002 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.01.01.1007 - Intel Corporation)
Java(TM) 6 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (HKLM-x32\...\{0330FC8D-EDB2-455E-A3DC-B56DD107E4BC}) (Version: 4.1.2694 - LogMeIn, Inc.)
Malwarebytes Anti-Malware versão 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Português) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 2070) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0816-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Project Professional 2010 (HKLM-x32\...\Office14.PRJPRO) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{D7A1C3CB-1F27-4EAA-98DF-D266CA6B67D3}) (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 40.0.3 (x86 pt-PT) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 pt-PT)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{033e19a4-3088-4abc-a9ea-004829cd1910}) (Version: - Nero AG)
Nero BackItUp (HKLM-x32\...\{0420F95C-11FF-4E02-B967-6CC22B188F9F}) (Version: 5.2.21001 - Nero AG)
Nero BackItUp and Burn (HKLM-x32\...\{E08CC458-41FB-4BB5-9B08-2C83DB55A5B9}) (Version: 1.2.0030 - Nero AG)
Nero BurnRights (HKLM-x32\...\{397516AE-7DFE-4F90-84E0-BD616D559434}) (Version: 3.6.26001 - Nero AG)
Nero Express (HKLM-x32\...\{6C3CF7AC-5AB0-42D9-93C0-68166A57AFB6}) (Version: 9.6.16000 - Nero AG)
Nero RescueAgent (HKLM-x32\...\{51E2F9B3-A972-4F58-B4EF-4D9676D9F5D1}) (Version: 2.6.25002 - Nero AG)
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Nokia Connectivity Cable Driver (HKLM-x32\...\{2D99A593-C841-43A7-B7C9-D6F3AE70B756}) (Version: 7.1.45.0 - Nokia)
Nokia Ovi Suite (HKLM-x32\...\Nokia Ovi Suite) (Version: 3.1.1.85 - Nokia)
Nokia Ovi Suite (x32 Version: 3.1.1.85 - Nokia) Hidden
Nokia Ovi Suite Software Updater (HKLM-x32\...\{A8F7FCEF-3CA6-4CE9-8FEA-8BB18F8686F0}) (Version: 02.07.004.45780 - Nokia Corporation)
Nokia PC Internet Access (HKLM-x32\...\Nokia PC Internet Access) (Version: 1.1.2.5 - Nokia)
Nokia PC Internet Access (x32 Version: 1.1.2.5 - Nokia) Hidden
Nuance PaperPort 12 (HKLM-x32\...\{88B5FBDC-967D-4B1F-B291-39284AE12201}) (Version: 12.1.0005 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Ovi Desktop Sync Engine (x32 Version: 1.5.266.0 - Nokia) Hidden
OviMPlatform (x32 Version: 2.7.72.0 - Nokia) Hidden
Pacote de controladores do Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D) (Version: 08/22/2008 7.0.0.0 - Nokia)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM-x32\...\{C373F7C4-05D2-4047-96D1-6AF30661C6AA}) (Version: 11.4.19.0 - Nokia)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 0.9.6 - Frank Heindörfer, Philip Chinery)
Photo Service - powered by myphotobook (HKLM-x32\...\eu.myphotobook.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1) (Version: 1.0.7-279 - myphotobook GmbH)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power Commander Control Center 3.2.0 (Test Build 1) (HKLM-x32\...\Power Commander 3 Usb_is1) (Version: - Dynojet Research, Inc.)
PrimoPDF -- by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5.0.0.19 - Nitro PDF Software)
PS_AIO_04_C6300_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
RealDownloader (x32 Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30111 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
Scansoft PDF Professional (x32 Version: - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPRO_{58FA40EF-ABA9-4FED-AD3D-318A6073934D}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
Toshiba Assist (HKLM-x32\...\{1B87C40B-A60B-4EF3-9A68-706CF4B69978}) (Version: 3.00.10 - TOSHIBA)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.06.64 - TOSHIBA Corporation)
TOSHIBA ConfigFree (HKLM-x32\...\{607BE7BF-7C28-4ADB-A4A0-385962B901C3}) (Version: 8.0.28 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.2.11.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.3.64 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (HKLM-x32\...\{8E9CEA3B-EBD1-439C-A01D-830CB39613C6}) (Version: 2.00.06 - TOSHIBA Corporation)
Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.01 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.80.3.64 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.5.10 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 2.09.0001 - TOSHIBA)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.6.0.64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 x64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{A0E99122-25C1-4CA4-9063-499A2A814EB6}) (Version: 1.6.06.64 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA)
TOSHIBA Supervisor Password (HKLM-x32\...\{073B89C3-BA88-41B5-965F-B35A88EAE838}) (Version: 2.00.03 - TOSHIBA Corporation)
TOSHIBA TEMPRO (HKLM-x32\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.3.3.64 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.15 - TOSHIBA Corporation)
TRORMCLauncher (HKLM-x32\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: - )
TRORMCLauncher (Version: 1.0.0.9 - TOSHIBA) Hidden
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.2.1 - Tweaking.com)
Undelete 360 (HKLM-x32\...\Undelete 360_is1) (Version: - File Recovery Ltd.)
Unity Web Player (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Veetle TV (HKLM-x32\...\Veetle TV) (Version: 0.9.19 - Veetle, Inc)
Viber (HKU\S-1-5-21-944797692-3693780693-2233505248-1003\...\Viber) (Version: 4.4.0.134678 - Viber Media Inc)
Vodafone Mobile Broadband Lite (HKLM-x32\...\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.3.2.34962 - Vodafone)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{34795BBE-39E4-41B6-997A-B88FD7306562}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XnView 2.13 (HKLM-x32\...\XnView_is1) (Version: 2.13 - Gougelet Pierre-e)
YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: 6.7.111 - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== ATTENTION
YouSendIt Plug-in for Outlook (HKLM-x32\...\InstallShield_{20DFF861-31EE-41F6-98D5-0A992AE7D116}) (Version: 2.14.1 - YouSendIt)
YouSendIt Plug-in for Outlook (x32 Version: 2.14.1 - YouSendIt) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2014\en-US\dwgviewrficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}\InprocServer32 -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\sys\x64\TosBtExt.dll (TOSHIBA)
CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2014\dwgviewr.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\CLSID\{D70E31AD-2614-49F2-B0FC-ACA781D81F3E}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2012\dwgviewr.exe (Autodesk, Inc.)

==================== Restore Points =========================

16-09-2015 11:49:02 avast! antivirus system restore point
16-09-2015 13:19:44 Removed Suporte para Aplicações Apple
16-09-2015 13:21:37 Removed Apple Software Update
16-09-2015 13:22:54 Removed HTC Sync.
16-09-2015 13:27:13 Removed HTC Driver Installer.
16-09-2015 13:28:24 Removed HTC BMP USB Driver.
16-09-2015 13:30:06 Removed eBay
17-09-2015 09:45:55 Removed Java 8 Update 31 (64-bit)
17-09-2015 09:48:05 Removed Java 8 Update 31
17-09-2015 09:49:41 Removed HTC Driver Installer.

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-09-17 10:04 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0E7D2CBA-77E6-461E-A701-57C15725F819} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {0FCC9EFB-567C-4959-8E4F-DD07704A80C6} - System32\Tasks\{FE3D7656-1D54-4E9F-ABBB-C33E78F3D390} => Chrome.exe http://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.3.0.105&amp;LastError=12002
Task: {14ECC2B5-E5EF-4570-B39F-0458C7579429} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {44170157-E589-46A9-ADF0-8EAC8CB4DA87} - System32\Tasks\{5C6AC76C-4921-436D-84A0-9475D81AF6DE} => pcalua.exe -a G:\setup_vmb_lite.exe -d G:\ -c /checkApplicationPresence
Task: {5B6C31EE-0D59-40EE-8147-A7C408E1540B} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {680B6469-96BD-4A4A-9333-63542F8435B7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-14] (Adobe Systems Incorporated)
Task: {6D6B047E-80B9-48B4-A9BA-8B1C7EDF001D} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {83DD901E-DA42-4065-B8E7-45D2C817C258} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {8D716E2F-5C8E-4395-99FD-70C605F2A4A2} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {9F787592-B232-403A-8193-9E009E2B1A83} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2015-08-20] (Piriform Ltd)
Task: {BC9B1A95-12D1-4823-AFA2-2A5FDB5D4963} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {C3281C8F-96BC-4A74-8051-EBB7B0556817} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {D77772D4-B619-402D-9170-5BB7417A49C2} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-944797692-3693780693-2233505248-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {DF01C8A2-C11B-4453-998A-6A216A186995} - System32\Tasks\{35632CAD-3880-4C7D-8D61-1547549F3DE0} => pcalua.exe -a C:\Miguel_Rufino\SetupDWGTrueView2012_64bit.exe -d C:\Miguel_Rufino
Task: {E06B9510-94D5-456C-9CCF-CD7FA78087BC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {E215D27B-D2AE-40F5-880A-59616A6C031C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {E589CC36-4230-41BE-9253-09C6298DBF2D} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-22] (TOSHIBA CORPORATION)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2012-07-11 16:35 - 2012-03-11 14:56 - 00086608 _____ () C:\Windows\System32\cpwmon64.dll
2010-07-05 09:59 - 2005-03-12 01:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2010-07-05 10:00 - 2009-07-31 02:58 - 00090624 _____ () C:\Windows\System32\Primomonnt.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-11-29 21:31 - 2012-11-29 21:31 - 00038608 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2015-05-06 13:24 - 2005-04-22 05:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2010-04-06 14:53 - 2010-04-06 14:53 - 00578936 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2010-02-05 17:44 - 2010-02-05 17:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 16:46 - 2013-02-14 16:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2010-10-20 17:08 - 2010-10-20 17:08 - 00122720 _____ () C:\Program Files (x86)\Microsoft Office\Office14\OUTLCTL.DLL
2015-09-17 17:26 - 2015-09-17 17:26 - 00697884 _____ () C:\Users\user\AppData\Local\Temp\AdskCleanup.0001.dir.0000\~df394b.tmp
2015-09-17 17:26 - 2015-09-17 17:26 - 00575488 _____ () C:\Users\user\AppData\Local\Temp\AdskCleanup.0001.dir.0000\~deb7ab.tmp
2006-03-05 13:44 - 2006-03-05 13:44 - 03389544 _____ () C:\Program Files (x86)\AutoCAD LT 2007\axdb.dll
2015-08-14 19:18 - 2015-08-14 19:18 - 17482952 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-944797692-3693780693-2233505248-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Miguel Rufino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk => C:\Windows\pss\MagicDisc.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Miguel Rufino^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Miguel Rufino\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: cAudioFilterAgent => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
MSCONFIG\startupreg: Facebook Update => "C:\Users\Miguel Rufino\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
MSCONFIG\startupreg: facemoods => "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
MSCONFIG\startupreg: hpqSRMon => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
MSCONFIG\startupreg: HSON => %ProgramFiles%\TOSHIBA\TBS\HSON.exe
MSCONFIG\startupreg: HTC Sync Loader => "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
MSCONFIG\startupreg: NBAgent => "c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SmartAudio => C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
MSCONFIG\startupreg: SmartFaceVWatcher => %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: TkBellExe => "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
MSCONFIG\startupreg: Toshiba Registration => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
MSCONFIG\startupreg: Toshiba TEMPRO => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosWaitSrv => %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{5EC5F4B3-B8B6-477E-B5B9-61B2E6B5F5FC}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{B63DB796-AB7F-4BEE-96D3-011199CBBEE4}] => (Allow) svchost.exe
FirewallRules: [{E882B12B-2203-4B17-BD48-722B35A7DCCB}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{8D9DC982-99E6-42E6-8CD7-22759F1653B2}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
FirewallRules: [{C811B61E-B0AB-487F-8970-C47FA6C13CC2}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
FirewallRules: [{4E416D95-55F5-4113-9985-E8A1B81B5B79}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{8985EF9D-F56C-4A15-BB33-B9DF933C5E0E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{10E4323A-525B-4A46-BFB4-997B4B1B3305}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{42A87A6A-FB35-402F-8C58-B740244B57BE}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{A2C78E64-64DD-4E3D-B7EC-A0442182E607}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{8593E565-255B-4901-A42E-CFDDC4E6072B}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{A62A2E61-136C-448A-BA0A-B8A6FD93B702}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{930D1B87-5C20-44CC-8E66-3C8A79BC9671}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{8AC9FCFE-B798-4A0F-9FEC-D8F4E64BDB7C}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{BCBAC80D-E1E4-42B6-9566-77356F97BFD1}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{187C2E88-7107-4A86-9B1C-D14448EFA2C9}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{5A3FA787-DD72-41EC-B0DB-01D4AB5FF975}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{B543E290-E196-416C-A735-0F0F7D2EF250}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{041AFCFE-0540-4425-A50C-53A2D473DA33}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{DABE1AC1-21BD-4CE2-A240-7F0250ADFCFE}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{13E1C748-63E9-4F5A-9FB9-8B8FDF62EA0B}] => (Allow) C:\Program Files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [{0C0010D3-36F2-4597-84FD-9EB41B160BF2}] => (Allow) C:\Program Files (x86)\Common Files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [{31034427-F5C1-4814-A72B-4FDC7ABC45C1}] => (Allow) LPort=10255
FirewallRules: [TCP Query User{9193AD6F-D6B3-4B4E-B148-33E557E6791D}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{EEB845B7-57A0-41B8-A17C-80DED0F47676}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [{F679EA04-3A07-489C-9625-899006E59674}] => (Allow) LPort=49173
FirewallRules: [{592FA722-A1C6-4604-903C-7CB9AEB0979C}] => (Allow) LPort=5000
FirewallRules: [{DC12B67F-E4D9-4C41-BE65-ED36BD505FA0}] => (Allow) LPort=49164
FirewallRules: [{4D5D4DDA-33CD-489A-B837-01CA8B2E3D0B}] => (Allow) LPort=5000
FirewallRules: [{45DA38C4-63E4-46E4-838F-8441E341BE83}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AB1645EA-04C9-4C55-98A5-9629B5CE1BE3}] => (Allow) LPort=2869
FirewallRules: [{1A1FE96F-44BF-47EB-855B-F90976237A31}] => (Allow) LPort=1900
FirewallRules: [{E535C212-2CD7-4A91-B010-FCB62A756068}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{8C3DCAFA-8F34-4821-B7C1-8C89A58EF8C8}] => (Allow) C:\Program Files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [{269FF180-4C81-42CF-928F-07BCA604537D}] => (Allow) C:\Program Files (x86)\Common Files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [{AA798357-8CEB-457A-844D-3EEF3EB82F4B}] => (Allow) C:\Windows\SysWOW64\rundll32.exe
FirewallRules: [{C98C4EA3-07B7-4D86-8A7E-9E85B2D63034}] => (Allow) C:\Windows\SysWOW64\rundll32.exe
FirewallRules: [{0550D377-6C0A-4C49-9EDF-033064D705E0}] => (Allow) C:\Program Files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe
FirewallRules: [{8EC3730C-A4E6-4653-9731-83162332C82F}] => (Allow) C:\Program Files (x86)\Common Files\nokia\service layer\a\nsl_host_process.exe
FirewallRules: [TCP Query User{E64AE302-8033-4B27-AD21-C81F1F9F2BED}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{7FEE20FA-7713-4380-ABFD-5A8F5D3FCC8C}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [TCP Query User{FCAC8554-9D30-4667-8ACD-FFD6E603CB09}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{4D2B0FCC-B975-41DF-9BD3-959658BDB7F6}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{4C3E2D5D-3EC9-4CA6-8403-AB9F27037AC1}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [{A6ABAC9E-8B39-4A6F-8784-6B24C133D5F3}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [TCP Query User{9AF1E4F2-A7E6-4C94-B65F-7A9A2BBD56D6}C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{4FB39E93-2204-4F41-9284-30A6EF1F348F}C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\miguel rufino\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{1E13EFB6-6FD2-4ABF-958C-166BFCBA69DD}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{8C750E28-487D-464A-BD93-CCE2A5E2CBDF}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{17D1D4EB-67DE-4A0F-874A-C43A8856219F}] => (Allow) C:\Program Files (x86)\Veetle\Player\VeetleNet.exe
FirewallRules: [{932186B1-8998-4324-8322-8A9A3E892F3E}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{A84DEC3F-A558-48A3-A0A9-5D2F917BF4DF}] => (Allow) C:\Users\Miguel Rufino\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [TCP Query User{7DEEF1AF-A9E7-4442-B452-CBF9EF0B1C6C}C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{291B0124-19E6-48CF-9B51-5000D2AA63CD}C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\miguel rufino\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{B971A810-81F2-4B01-B307-55CD5604774B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\{E5A24F8D-40E1-45CB-B509-81186D795735}\setup\hpznui40.exe
FirewallRules: [{BA82BD56-BF98-4D9F-9B3E-3A44EA1C90DC}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{6B2D9B3F-CE27-40A0-92B0-5A167ECD8F4D}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{45F11D52-0CFD-4717-BE62-A25FFD327CF6}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{2F88EF03-919A-48F1-A1EB-FF8052B44651}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{D2217BAC-5FF1-4528-A004-C421C4208FA5}C:\users\user\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\user\appdata\local\akamai\netsession_win.exe
FirewallRules: [{C3CA7290-5461-43B5-B770-6924BF53FBAA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{93F37E83-437F-475E-8D86-146D9B3C12B7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{3E829C32-9020-43EA-B309-2A302760B3B7}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{88762E55-D906-4CDE-B5F9-ADFAA1C5680E}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{EF6083CB-0EC7-4D77-AA0D-EB7B75477FA5}] => (Allow) LPort=54925
FirewallRules: [{277791C9-0694-4D9B-AB83-7A7A5A682542}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: MpKsla2bde8c8
Description: MpKsla2bde8c8
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: MpKsla2bde8c8
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: 2260ij
Description: 2260ij
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 2Cool
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Photosmart C6300 series
Description: Photosmart C6300 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: DAEMON Tools Virtual Bus
Description: DAEMON Tools Virtual Bus
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: DT Soft Ltd
Service: dtsoftbus01
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: Teredo Tunneling Pseudo-Interface
Description: Adaptador de Túnel Teredo da Microsoft
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/17/2015 02:45:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nome da aplicação com falha: plugin-container.exe, versão: 40.0.3.5716, carimbo de data/hora: 0x55ddb213
Nome do módulo com falha: mozglue.dll, versão: 40.0.3.5716, carimbo de data/hora: 0x55dda062
Código de excepção: 0x80000003
Desvio de falha: 0x0000e250
ID do processo com falha: 0x588
Data/hora de início da aplicação com falha: 0xplugin-container.exe0
Caminho da aplicação com falha: plugin-container.exe1
Caminho do módulo com falha: plugin-container.exe2
ID do Relatório: plugin-container.exe3

Error: (09/17/2015 10:19:31 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: A geração do contexto de activação falhou para "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Erro no ficheiro de manifesto ou política C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2 na linha C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Uma versão de componente necessária para a aplicação entra em conflito com outra versão de componente já activa.
Os componentes em conflito são:.
Componente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Componente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (09/17/2015 10:19:27 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: A geração do contexto de activação falhou para "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Erro no ficheiro de manifesto ou política C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2 na linha C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Uma versão de componente necessária para a aplicação entra em conflito com outra versão de componente já activa.
Os componentes em conflito são:.
Componente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Componente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (09/17/2015 10:02:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nome da aplicação com falha: plugin-container.exe, versão: 40.0.3.5716, carimbo de data/hora: 0x55ddb213
Nome do módulo com falha: mozglue.dll, versão: 40.0.3.5716, carimbo de data/hora: 0x55dda062
Código de excepção: 0x80000003
Desvio de falha: 0x0000e250
ID do processo com falha: 0x15a0
Data/hora de início da aplicação com falha: 0xplugin-container.exe0
Caminho da aplicação com falha: plugin-container.exe1
Caminho do módulo com falha: plugin-container.exe2
ID do Relatório: plugin-container.exe3

Error: (09/17/2015 09:50:05 AM) (Source: MsiInstaller) (EventID: 11721) (User: LT-CGF-06-RM)
Description: Produto: HTC Driver Installer -- Erro 1721. Existe um problema com este pacote do Windows Installer. Um programa necessário para concluir esta instalação não pôde ser executado. Contacte o pessoal de suporte ou o fabricante do pacote. Acção: _F71906EC_15A3_4FD7_AC60_46DD6938A96E, localização: C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe, comando: /uninstall

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddWin32ServiceFiles: Unable to back up image of service Avast Antivirus since QueryServiceConfig API failed

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary ngvss.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary avast! VM Monitor.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary aswSP.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.

Error: (09/16/2015 01:30:06 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Falha nos Serviços de Criptografia ao processar a chamada OnIdentity() no Objecto Escritor de Sistema.

Details:
AddLegacyDriverFiles: Unable to back up image of binary aswSnx.

System Error:
O sistema não conseguiu localizar o ficheiro especificado.
.


System errors:
=============
Error: (09/17/2015 02:54:44 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: O serviço HP Network Devices Support terminou com o seguinte erro:
%%126

Error: (09/17/2015 02:52:43 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Falhou o carregamento dos seguintes controladores de início de arranque ou de início do sistema:
iSafeKrnlMon

Error: (09/17/2015 02:52:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: O serviço HP Support Solutions Framework Service falhou o arranque devido ao seguinte erro:
%%1053

Error: (09/17/2015 02:52:10 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Foi atingido o tempo limite (30000 milissegundos) ao aguardar pela ligação do serviço HP Support Solutions Framework Service.

Error: (09/17/2015 02:51:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: O serviço YAC Service falhou o arranque devido ao seguinte erro:
%%2

Error: (09/17/2015 10:27:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: O serviço eapihdrv falhou o arranque devido ao seguinte erro:
%%1275

Error: (09/17/2015 10:27:23 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: O carregamento de \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys foi bloqueado devido a incompatibilidade com este sistema. Contacte o fabricante de software para obter uma versão compatível do controlador.

Error: (09/17/2015 10:27:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: O serviço eapihdrv falhou o arranque devido ao seguinte erro:
%%1275

Error: (09/17/2015 10:27:23 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: O carregamento de \??\C:\Users\user\AppData\Local\Temp\ehdrv.sys foi bloqueado devido a incompatibilidade com este sistema. Contacte o fabricante de software para obter uma versão compatível do controlador.

Error: (09/17/2015 10:27:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: O serviço eapihdrv falhou o arranque devido ao seguinte erro:
%%1275


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 430 @ 2.27GHz
Percentage of memory in use: 53%
Total physical RAM: 3958.84 MB
Available physical RAM: 1857.63 MB
Total Virtual: 7915.89 MB
Available Virtual: 5579.37 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:232.65 GB) (Free:138.71 GB) NTFS
Drive d: (MR) (Fixed) (Total:232.72 GB) (Free:220.14 GB) NTFS
Drive f: (2.0.4.45685_RC1) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Cool (Size: 465.8 GB) (Disk ID: 02C50C24)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=232.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=232.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 9:14 am    Post subject: regsearch Reply with quote

Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-17 18:04:03)
Running from C:\Users\user\Desktop
Boot Mode: Normal

================== Search Registry: "Fun4IM;Bandoo;Searchnu;Searchqu;iLivid;whitesmoke;datamngr;kelkoopartners;trolltech;babylon;conduit;trovi;clientconnect reimageplus" ===========


===================== Search result for "Searchqu" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
""="ISearchQueryHelper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
""="ISearchQueryHelper"


===================== Search result for "whitesmoke" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B760674538A35F241999134C94EA70A1]
"9550B61D73DB527468C2BD12065AC835"="C:\Program Files (x86)\Google\Google SketchUp 8\Materials\Colors-Named\0129_WhiteSmoke.skm"


===================== Search result for "trolltech" ==========

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Trolltech]


===================== Search result for "babylon" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"


===================== Search result for "conduit" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\AecbElecBase70\DisplayRepresentations\AecbDbDispRepConduit1Line]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\AecbElecBase70\DisplayRepresentations\AecbDbDispRepConduitFitting1Line]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\AecbElecBase70\DisplayRepresentations\AecbDbDispRepConduitFittingHaloedLine]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\AecbElecBase70\DisplayRepresentations\AecbDbDispRepConduitHaloedLine]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\General\ObjectStyleMap]
"AecbDbConduitFitting"="AecbDbConduitFittingStyle"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\General\ObjectStyleMap]
"AecbDbConduit"="AecbDbConduitStyle"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\General\Preferences\LayerKey\Defaults]
"CONDUITFITTING"="CONDUIT FITTING"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\AEC\7.5\General\Preferences\LayerKey\Defaults]
"CONDUIT"="CONDUIT"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitHaloedLine"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduitFittingStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitFittingHaloedLine"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDictConduitStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDictConduitFittingStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDictConduitPartCatPrefStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitFittingModel"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbCompSpecConduitFitting"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduitStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduitPartCatPrefStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduit"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitFitting2Line"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitFitting"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDictConduitStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDictConduitFittingStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduitHaloedLine"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduitModel"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDictConduitRiseDropStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbQueryAecbDbConduitFitting"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduitFitting2Line"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitFittingStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbQueryAecbDbConduit"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitPartCatPrefStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispPropsConduit"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispPropsConduitHaloedLine"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbQueryAecbDbConduitFitting"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitFittingModel"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDictConduitRiseDropStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbConduit"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbConduitPartCatPrefStyle"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduit2Line"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbCompSpecConduit"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitHaloedLine"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitFittingHaloedLine"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R12\dwgviewr-B001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduit1Line"="AecbElecBase70"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\AecbElecBase60\DisplayRepresentations\AecbDbDispRepConduit1Line]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\AecbElecBase60\DisplayRepresentations\AecbDbDispRepConduitFitting1Line]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\AecbElecBase60\DisplayRepresentations\AecbDbDispRepConduitFittingHaloedLine]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\AecbElecBase60\DisplayRepresentations\AecbDbDispRepConduitHaloedLine]

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\General\ObjectStyleMap]
"AecbDbConduitFitting"="AecbDbConduitFittingStyle"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\General\ObjectStyleMap]
"AecbDbConduit"="AecbDbConduitStyle"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\General\Preferences\LayerKey\Defaults]
"CONDUITFITTING"="CONDUIT FITTING"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\General\Preferences\LayerKey\Defaults]
"CONDUIT"="CONDUIT"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduitRiseDropStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitFittingModel"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbQueryAecbDbConduit"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduitPartCatPrefStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitHaloedLine"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispPropsConduit"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbConduitStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbCompSpecConduit"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduit1Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDbDispRepConduitModel"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbCompSpecConduitFitting"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv]
"AecbDictConduitRiseDropStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbQueryAecbDbConduitFitting"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduitHaloedLine"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitRiseDropStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduitFitting2Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduitFitting1Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDictConduitFittingStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduit2Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbConduitFitting"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDictConduitStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispRepConduit1Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv40]
"AecbDbDispPropsConduitHaloedLine"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitModel"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDictConduitStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispPropsConduit"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbCompSpecConduitFitting"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitFittingModel"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDictConduitFittingStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbConduitRiseDropStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDictConduitPartCatPrefStyle"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduit1Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitFitting2Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbDbDispRepConduitFitting1Line"="AecbElecBase60"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\RedirectedAppnames\AecbBldSrv45]
"AecbQueryAecbDbConduit"="AecbElecBase60"

====== End of Search ======
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 9:16 am    Post subject: search Reply with quote

Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-17 18:09:17)
Running from C:\Users\user\Desktop
Boot Mode: Normal

================== Search Files: "dnsapi.dll" =============

C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.21673_none_4aa4e997e6a8ddc0\dnsapi.dll
[2011-04-13 23:55][2011-03-03 06:12] 0270336 ____A (Microsoft Corporation) 1F79F611109C2B97260B68FD6B4FC7DD [File is digitally signed]

C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17570_none_4a184beecd8df1f1\dnsapi.dll
[2011-04-13 23:55][2011-03-03 06:38] 0270336 ____A (Microsoft Corporation) B40420876B9288E0A1C8CCA8A84E5DC9 [File is digitally signed]

C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnsapi.dll
[2011-04-16 00:16][2010-11-20 13:18] 0270336 ____A (Microsoft Corporation) 59DF156711A76BCB993253EC6C9BBF41 [File is digitally signed]

C:\Windows\winsxs\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.21673_none_40503f45b2481bc5\dnsapi.dll
[2011-04-13 23:55][2011-03-03 07:12] 0357888 ____A (Microsoft Corporation) DCC0888655823103F19EF8FFD330080D [File is digitally signed]

C:\Windows\winsxs\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17570_none_3fc3a19c992d2ff6\dnsapi.dll
[2011-04-13 23:55][2011-03-03 07:24] 0357888 ____A (Microsoft Corporation) 492D07D79E7024CA310867B526D9636D [File is digitally signed]

C:\Windows\winsxs\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac\dnsapi.dll
[2011-04-16 00:16][2010-11-20 14:26] 0357888 ____A (Microsoft Corporation) A52B6CC24063CC83C78C0E6F24DEEC01 [File is digitally signed]

C:\Windows\SysWOW64\dnsapi.dll
[2011-04-13 23:55][2011-03-03 06:38] 0270336 ____A (Microsoft Corporation) B40420876B9288E0A1C8CCA8A84E5DC9 [File is digitally signed]

C:\Windows\System32\dnsapi.dll
[2011-04-13 23:55][2011-03-03 07:24] 0357888 ____A (Microsoft Corporation) 492D07D79E7024CA310867B526D9636D [File is digitally signed]

====== End of Search ======
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 9:19 am    Post subject: pc status Reply with quote

the page with the following url also keeps poping up:
hxxp://yxo.warmportrait.com/sd/dw32.html?u=http%3A%2F%2Finb.csrvrgroup.com%2FWhiteLabelBidRequestHandlerServlet%3Foid%3D1%26width%3D1%26height%3D100%26pubid%3D9700%26tagid%3D1043%26noaop%3D1%26revmod%3DCRD%26cb%3Dcybabw%26encoded%3D1%26cirf%3Dhttp%3A%2F%2Fspywarewarrior.com%2Fviewtopic.php%3Fp%3D234101%26pstn%3D97001043&p=name&a=&c=9700-1043&b=firefox&bv=40&r=spywarewarrior.com&ua=0&n=convertmedia&mpa=0&mp=0


And then changes to an other url with ads
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Thu Sep 17, 2015 2:38 pm    Post subject: Reply with quote

OK, let's try again ...

First ...

Please go to Control Panel > Programs > Uninstall a program and Uninstall the following:

Quote:
Java(TM) 6 Update 17


Reboot your computer once it has uninstalled

Next ...


  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.

    • Copy/Paste the contents of the code box below into Notepad (don't include Code: Select all).


Code:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
S2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [X]
C:\Program Files (x86)\Elex-tech
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
C:\Windows\system32\drivers\hitmanpro37.sys
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Program Files (x86)\Elex-tech
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user\Downloads\yet_another_cleaner_sk_7489594.exe
2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v
[-HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Trolltech]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
emptytemp:
hosts:
cmd: ipconfig /flushdns



    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt



NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system


  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log



Next ...


  • Double click Frst64.exe to launch it.
  • FRST will start to run.

    • When the tool opens click Yes to the disclaimer.
    • Copy/Paste or Type the following line into the Search: box.

    Quote:
    YAC;Yet Another Cleaner;Yet Another Cleaner!;ELEX DO BRASIL


    • Press the Search Registry button.
    • When finished searching a log will open on your Desktop ... Search.txt
    • Please post it in your next reply.



Next ...

Let’s try to Reset your Router to its default configuration.

  • This can be done by inserting something like an opened paper clip into a small hole labeled Reset that's usually found at the back of the router.
  • Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
  • If you don’t know your router's default password, you can look it up. HERE
  • You will need to reconfigure any security settings you had in place prior to the reset.
  • You may also need to ask your Internet Service Provider (ISP) which DNS servers your network should be using.


Note: After resetting your router, it is important to set a non-default password, and if possible, username, on the router. This should help to stop your router from being hijacked again.

Summary of the logs I need from you in your next post:

  • Fixlog.txt
  • Search.txt


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 3:36 pm    Post subject: fixlog Reply with quote

Fix result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-18 00:21:37) Run:3
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CHR HKLM SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
S2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [X]
C:\Program Files (x86)\Elex-tech
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
C:\Windows\system32\drivers\hitmanpro37.sys
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Program Files (x86)\Elex-tech
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user Downloads\yet_another_cleaner_sk_7489594.exe
2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v
[-HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Trolltech]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
emptytemp:
hosts:
cmd: ipconfig /flushdns
*****************
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 3:37 pm    Post subject: search Reply with quote

Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-18 00:34:07)
Running from C:\Users\user\Desktop
Boot Mode: Normal

================== Search Registry: "YAC;Yet Another Cleaner;Yet Another Cleaner!;ELEX DO BRASIL" ===========


===================== Search result for "YAC" ==========

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.18766 (win7sp1_gdr.150217-1551)\ComponentFamilies\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_none_25eaed2788918204\f256!api-ms-win-core-synch-l1-_58d5510126a3d0a3]
"6sXb6uPJRj2xNQI5h9YAcdVzhWyV0ct0rH22Pj/SOO0="="0x36002E0031002E0037003600300031002E0032003200340031003100"

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.18766 (win7sp1_gdr.150217-1551)\ComponentFamilies\amd64_microsoft-windows-shell32_31bf3856ad364e35_none_85ff5baee9a910d9\f256!shell32.dll]
"MuAHeZ/IlpDAblCnVfdDjQyGHwO3KvryAch0UWxlYG4="="0x36002E0031002E0037003600300031002E0032003200360033003900"

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.18766 (win7sp1_gdr.150217-1551)\ComponentFamilies\amd64_wpf-presentationhostdll_31bf3856ad364e35_none_36352623048c4111\f256!presentationhostdll.dll]
"ENlcYacXD9gkidP3CDif7jKWlJHuPdbwoCBsG1IV0j4="="0x36002E0031002E0037003600300031002E0032003100390032003100"

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.18766 (win7sp1_gdr.150217-1551)\ComponentFamilies\x86_microsoft-windows-advapi32.resources_31bf3856ad364e35_pt-pt_ade16b79dabdcc28\f256!advapi32.dll.mui]
"MegGK+UMnOr9NBYAcSn0LjtAiQujD0AvAIdMPreVMJk="="0x36002E0031002E0037003600300031002E0031003800380036003900"

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.18766 (win7sp1_gdr.150217-1551)\ComponentFamilies\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_none_c9cc51a3d03410ce\f256!api-ms-win-core-delayload_5b32cbd018269771]
"avPEYacD09WG1mGw8H6Qfv4uj+zUy+sw1u7qNNhc7kk="="0x36002E0031002E0037003600300031002E0032003200360031003600"

[HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\DWG TrueView\R9\dwgviewr-A001:409\AEC\6.7\AecScheduleData60\Unwanted Class Filter\AcDbBlockArrayActionEntity]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\ProgID]
""="X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A71E7639-85D3-4DE0-BF09-DCB9C1D4CB35}]
""="AcadBlockArrayActionEntity"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0006302D-0000-0000-C000-000000000046}]
""="_PropertyAccessor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DECDC76-448C-4255-8CF2-FE6A015D08C6}]
""="IAcadBlockArrayActionEntity"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E6095C98-9313-4CE5-ADD6-C385AAC19872}]
""="IAcadBlockArrayActionEntity"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{BA99AE52-D539-362F-B78C-4E84C14158BF}\4.0.0.0]
"Class"="System.Security.Permissions.SecurityAction"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42795DC9-8BB4-4990-B46D-CBAF99943812}]
""="AcadBlockArrayActionEntity"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\VersionIndependentProgID]
""="X509Enrollment.CX509EnrollmentPolicyActiveDirectory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FE9F084-1511-3052-BE7C-9010B522C10E}]
""="_QueryAccessibilityHelpEventArgs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7197B56B-5FA1-31EF-B38B-62FEE737277F}]
""="IContextPropertyActivator"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B848D512-62C5-42FB-89B3-126098FCD11B}]
""="IGrooveTransportSecurityAccountDiagnosticsEntryEnum"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FE917559-CE0D-41a6-A470-8EF40051A85D}]
""="IRegistryAccessor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\X509Enrollment.CX509EnrollmentPolicyActiveDirectory\CurVer]
""="X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DA90054B2080CE47BE7827AFC41D96E]
"D25192C69FF32B34484EB953CFB05F2C"="C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\RegistryAccess.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6414876250E69FF3395387C6C7F05BEB\Features]
"F_compilers_core_amd64"="`yFM`V.(j?5]i'AKuKOKJQ-fL.MGAAWWvkZC2t!Y(91'3NpGO@ya,]$={]vm(~u-_m8U!AL*w{j!wgZZ-mu'YIdC'AnZb-nwxX'gK?QEZcsQX9?=Z!pPD],5lM4p.ricy@JuL~@&9rDLpn@yjcvcW9{`5Gu3.3))c6N1LYaC!9DW`G*oh(@NNetFx_Full_amd64"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Autodesk\AutoCAD LT\R12\ACADLT-5001:409\AEC\5.0\AecScheduleData50\Unwanted Class Filter\AcDbBlockArrayActionEntity]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Elex-tech\YAC]
"path"="C:\Program Files (x86)\Elex-tech\YAC\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Registration\{90140000-003B-0000-0000-0000000FF1CE}]
"Current"="UABMAEUAQQBTAEUAIABOAE8AVABFADoAIABZAG8AdQByACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAcwBvAGYAdAB3AGEAcgBlACAAaQBzACAAcwB1AGIAagBlAGMAdAAgAHQAbwAgAHQAaABlACAAdABlAHIAbQBzACAAYQBuAGQAIABjAG8AbgBkAGkAdABpAG8AbgB

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\User Settings\Outlook_AutoDiscover\Create\Software\Microsoft\Office\14.0\Outlook\AutoDiscover]
"yahoo.com.sg"="C:\PROGRA~2\MIF5BA~1\Office14\OUTLOO~1\YAC50A~1.XML"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\User Settings\{90140000-003B-0000-0000-0000000FF1CE}\Create\Software\Microsoft\Office\14.0]
"Current"="UABMAEUAQQBTAEUAIABOAE8AVABFADoAIABZAG8AdQByACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAcwBvAGYAdAB3AGEA

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
"DisplayName"="YAC(Yet Another Cleaner!)"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
"UninstallString"="C:\Program Files (x86)\Elex-tech\YAC\uninstall.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
"InstallLocation"="C:\Program Files (x86)\Elex-tech\YAC\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{42795DC9-8BB4-4990-B46D-CBAF99943812}]
""="AcadBlockArrayActionEntity"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\VersionIndependentProgID]
""="X509Enrollment.CX509EnrollmentPolicyActiveDirectory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{2FE9F084-1511-3052-BE7C-9010B522C10E}]
""="_QueryAccessibilityHelpEventArgs"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{7197B56B-5FA1-31EF-B38B-62FEE737277F}]
""="IContextPropertyActivator"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{B848D512-62C5-42FB-89B3-126098FCD11B}]
""="IGrooveTransportSecurityAccountDiagnosticsEntryEnum"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{FE917559-CE0D-41a6-A470-8EF40051A85D}]
""="IRegistryAccessor"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ISAFEKRNLKIT\0000]
"DeviceDesc"="YAC Kit Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ISAFEKRNLR3\0000]
"DeviceDesc"="YAC Ring3 Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsata\Parameters\Device]
"EnableQueryAccessAlignment"="1"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvstor\Parameters\Device]
"EnableQueryAccessAlignment"="1"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ISAFEKRNLKIT\0000]
"DeviceDesc"="YAC Kit Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ISAFEKRNLR3\0000]
"DeviceDesc"="YAC Ring3 Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\amdsata\Parameters\Device]
"EnableQueryAccessAlignment"="1"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\nvstor\Parameters\Device]
"EnableQueryAccessAlignment"="1"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLKIT\0000]
"DeviceDesc"="YAC Kit Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLR3\0000]
"DeviceDesc"="YAC Ring3 Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\amdsata\Parameters\Device]
"EnableQueryAccessAlignment"="1"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\nvstor\Parameters\Device]
"EnableQueryAccessAlignment"="1"

[HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-944797692-3693780693-2233505248-1003\02epmrqapzbz]
"DeviceId"="<Data><User username="02EPMRQAPZBZ"><Pwd Det="false">AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAo2kSqwfqFkGB7mhN57+LfgQAAAACAAAAAAAQZgAAAAEAACAAAADLermvjhfn0PZTAYV4HrQ/WewqGy6GZutLYQESleklfwAAAAAOgAAAAAIAACAAAACkVpkpamltHKg8xr8QuqRfWMLDHGkl+FD5EGaaW5oXwzAAAACzEtip+nOzk4yHrS8WtxtWEPEL4CA4cjZ8iC3rc+dHdXzUadFskPVYR89U+aCey0hAAAAAytQWKemW9wq8CEjL85fE4sVoz61UrgOUI9NEbTvWD2oOn/eJfuVHA9k4dd6hohmbzkMOgsUN2gvpcricsSUtFw==</Pwd><Certificate targetname="WindowsLive:(cert):name=02epmrqapzbz;serviceuri=msn-messenger-didc" keyword="Microsoft_WindowsLive:certificate:" type="1">PABDAGUAcgB0AEkAbgBmAG8APgA8AEsAZQB5AHAAYQBpAHIAPgBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEARgBjAHoAbwBCAGsAZQBiAHAAVQBpAHAASgBqADgAUgBEAEoAKwBWAEcAQQBRAE
"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Microsoft Antimalware]
"CachedProxyAccessType "="1"

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Microsoft\Office\14.0\Outlook\AutoDiscover]
"yahoo.co.th"="C:\PROGRA~2\MIF5BA~1\Office14\OUTLOO~1\YACB7D~1.XML"

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\PhotoPrintingWizard\Xerox 7335]
"PrintTicket"="<?xml version="1.0"?>
<psf:PrintTicket xmlns:psf="http://schemas.microsoft.com/windows/2003/08/printing/printschemaframework" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" </psf:ParameterInit><psf:Feature name="psk:DocumentCollate">
"

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\RealNetworks\RealDownloader\1.3\Preferences\MountPoints\DT_RCAPlugins\PluginHandlerData\PluginInfo0]
""="{LoadMultiple~N1~ComponentName~Shttp://ns.real.com/gemini.v1:FileListActor~PluginFilename~Sconverterapp.dll~Compo

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\RealNetworks\RealDownloader\1.3\Preferences\MountPoints\DT_RCAPlugins\PluginHandlerData\PluginInfo2]
""="ponentCLSID~XAsxsBLTG40+6yQFYuLVxDA==}
[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Classes\Interface\{DEDDD7BD-4763-41D2-9AAA-B2C143457CA4}]
""="IModalityActionAvailabilityChangedEventData"

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Classes\Wow6432Node\Interface\{DEDDD7BD-4763-41D2-9AAA-B2C143457CA4}]
""="IModalityActionAvailabilityChangedEventData"

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\Interface\{DEDDD7BD-4763-41D2-9AAA-B2C143457CA4}]
""="IModalityActionAvailabilityChangedEventData"

[HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003_Classes\Wow6432Node\Interface\{DEDDD7BD-4763-41D2-9AAA-B2C143457CA4}]
""="IModalityActionAvailabilityChangedEventData"

[HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-944797692-3693780693-2233505248-1003\02epmrqapzbz]
"DeviceId"="<Data><User username="02EPMRQAPZBZ"><Pwd Det="false">AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAo2kSqwfqFkGB7mhN57+LfgQAAAACAAAAAAAQZgAAAAEAACAAAADLermvjhfn0PZTAYV4HrQ"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Microsoft Antimalware]
"CachedProxyAccessType "="1"

===================== Search result for "Yet Another Cleaner" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
"DisplayName"="YAC(Yet Another Cleaner!)"


===================== Search result for "Yet Another Cleaner!" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
"DisplayName"="YAC(Yet Another Cleaner!)"


===================== Search result for "ELEX DO BRASIL" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
"publisher"="ELEX DO BRASIL PARTICIPAÇÕES LTDA"

====== End of Search ======
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Thu Sep 17, 2015 3:42 pm    Post subject: Reply with quote

Can you check you've posted all the fixlog.txt I can see the fixlist I gave you, but I don't see the results of the fix.

If you have posted all that was produced, then can you please run the fix again and post me the new fixlog.txt
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Thu Sep 17, 2015 3:47 pm    Post subject: router Reply with quote

Hi, I dont have a "normal" router because Im not at home. This is my work pc and from monday to friday I use a mobile internet (MOBILE HOTSPOT).
Probably what Im about to say is very stupid but I think that nobody hijacked my router, this happened when I tried to download some music.
best regards and thanks for all the help that youre giving me
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Thu Sep 17, 2015 9:06 pm    Post subject: Reply with quote

OK don't worry about the router, I was just covering all options.

Just run the "fix" portion again, because the last log you posted me doesn't look as if any of the commands were executed by FRST.

I've repeated the instructions for it below ...


  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.

    • Copy/Paste the contents of the code box below into Notepad (don't include Code: Select all).


Code:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
S2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [X]
C:\Program Files (x86)\Elex-tech
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
C:\Windows\system32\drivers\hitmanpro37.sys
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Program Files (x86)\Elex-tech
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user\Downloads\yet_another_cleaner_sk_7489594.exe
2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v
[-HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Trolltech]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
emptytemp:
hosts:
cmd: ipconfig /flushdns



    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt



NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system


  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log


_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Fri Sep 18, 2015 12:38 am    Post subject: fixlog Reply with quote

Fix result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-18 09:33:22) Run:4
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CHR HKLM SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL =
CHR HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
S2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [X]
C:\Program Files (x86)\Elex-tech
S3 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
C:\Windows\system32\drivers\hitmanpro37.sys
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Program Files (x86)\Elex-tech
S1 MpKsla2bde8c8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys [X]
C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys
2015-09-15 18:06 - 2015-09-15 18:08 - 00916008 _____ () C:\Users\user Downloads\yet_another_cleaner_sk_7489594.exe
2015-04-19 13:20 - 2015-04-19 13:20 - 0005872 _____ () C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v
[-HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Trolltech]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
emptytemp:
hosts:
cmd: ipconfig /flushdns
*****************

HKU\CHR HKLM SOFTWARE\Policies\Google: Restriction <======= ATTENTION\SOFTWARE\Policies\Google => key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKU\S-1-5-21-944797692-3693780693-2233505248-1003\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh => key not found.
iSafeService => service not found.
"C:\Program Files (x86)\Elex-tech" => File/Folder not found.
hitmanpro37 => service not found.
"C:\Windows\system32\drivers\hitmanpro37.sys" => File/Folder not found.
iSafeKrnlMon => service not found.
"C:\Program Files (x86)\Elex-tech" => File/Folder not found.
MpKsla2bde8c8 => service not found.
"C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3230B0B5-D106-4EA4-A040-983A8DE52645}\MpKsla2bde8c8.sys" => File/Folder not found.
"C:\Users\user Downloads\yet_another_cleaner_sk_7489594.exe" => File/Folder not found.
"C:\Users\user\AppData\Roaming\Cv27xmSs7KZs2DnVJ5fcXnUnU0v" => File/Folder not found.
HKEY_USERS\S-1-5-21-944797692-3693780693-2233505248-1003\Software\Trolltech => key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B} => key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC} => key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B} => key not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC} => key not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= ipconfig /flushdns =========


Configura��o IP do Windows

Cache de resolu��o DNS limpa com �xito.

========= End of CMD: =========

EmptyTemp: => 56.2 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 09:33:42 ====
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Fri Sep 18, 2015 4:41 am    Post subject: Reply with quote


  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.

    • Copy/Paste the contents of the code box below into Notepad (don't include Code:).


Code:
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Elex-tech]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLKIT\0000]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLR3\0000]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
C:\Program Files (x86)\Elex-tech



    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt



NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system


  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log



Are you still seeing Ads ???

If you are ...


  • What browser are you using (IE, Firefox, Chrome, etc) ???
  • If you use a different browser doo you still see Ads ???

_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Fri Sep 18, 2015 6:36 am    Post subject: fixlog Reply with quote

Fix result of Farbar Recovery Scan Tool (x64) Version:15-09-2015
Ran by user (2015-09-18 15:31:44) Run:5
Running from C:\Users\user\Desktop
Loaded Profiles: user (Available Profiles: Miguel Rufino & user & Administrador)
Boot Mode: Normal
==============================================

fixlist content:
*****************
[-HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Elex-tech]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLKIT\0000]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLR3\0000]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe]
C:\Program Files (x86)\Elex-tech
*****************

HKEY_LOCAL_MACHINE SOFTWARE\Wow6432Node\Elex-tech => could not removekey.: incorrect path.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe => key removed successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot => key removed successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLKIT\0000 => key removed successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFEKRNLR3\0000 => key removed successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iSafe => key not found.
"C:\Program Files (x86)\Elex-tech" => File/Folder not found.

==== End of Fixlog 15:31:44 ====




I only see ads in firefox, in chrome no ads apear.
I dont know if it matters but when Im in facebook no ads apear even in firefox
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Fri Sep 18, 2015 9:19 am    Post subject: Reply with quote

Try running Firefox in "safe mode" and see if you still get redirected.

To do so ....


  • Click Help > Restart with Add-Ons Disabled
  • You will be asked if you're sure you want to disable add-ons, click Restart
  • When Firefox restarts you will be prompted with the following ....





  • Do not check any of the boxes, just click on Continue in Safe Mode


Now try browsing for a while and see if you get any ads popping up.

What we're trying to establish is whether Firefox itself is infected, or whether one of your add-ons is causing the problem.

By browsing in Firefox Safe Mode, all your add-ons are disabled.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Fri Sep 18, 2015 9:30 am    Post subject: firefox safe mode Reply with quote

Even in safe mode the ads continue...
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Fri Sep 18, 2015 12:20 pm    Post subject: Reply with quote

OK, in that case I think we need to uninstall Firefox and to install a new clean copy.


  • Please go to Control Panel > Programs > Uninstall a program
  • Uninstall Firefox

    • When prompted, put a check mark in the box that says Remove my Firefox personal data and customizations.



Now reboot your computer.

When fully rebooted, download a new clean copy of Firefox ... English ... Portugues

Browse for a while and let me know if you're still seeing ads.
_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Fri Sep 18, 2015 12:59 pm    Post subject: deleting firefox Reply with quote

Ive uninstalled firefox like you said but it all remain the same. But I was never asked to delete my old information, so probably wansnt deleted.
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Fri Sep 18, 2015 3:52 pm    Post subject: firefox Reply with quote

Ive tried again and after instaling firefox Ive deleted it again in CONTROL PANEL, then I went to %localappdata% and deleted Modzilla (I've done this before I contact you) and then I went to %programfiles% and deleted modzilla.
After that i rebooted and now everything seems to be working fine. Very Happy
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Fri Sep 18, 2015 8:03 pm    Post subject: Reply with quote

Good, I'm glad to hear your computer is now running OK.

In that case, all we need to do now is a little tidying up to remove the programs we've been using to clean your machine.

  • Please download delfix and save it to your desktop.
  • Right-click on delfix.exe and select " Run as administrator " to run it.
  • Check the following boxes ...

    • Remove disinfection tools
    • Purge system restore

    ... then click on Run.
  • Once it has finished, a notepad file named DelFix.txt will open. Post the contents of this notepad in your next reply.
  • The log can also be located at the root of the system drive, C:\DelFix.txt.


As far as I can see, your computer looks clear of infection now.

Are you still noticing any problems ?

  • If you are let me know about them.
  • If not it's time to make your computer more secure.


Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.

_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Mariani
Junior Member


Joined: 16 Sep 2015
Last Visit: 19 Sep 2015
Posts: 25

PostPosted: Sat Sep 19, 2015 5:33 am    Post subject: delfix Reply with quote

# DelFix v1.011 - Logfile created 19/09/2015 at 14:30:58
# Updated 18/08/2015 by Xplode
# Username : user - LT-CGF-06-RM
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\RegBackup
Deleted : C:\TDSSKiller.3.1.0.5_16.09.2015_14.46.35_log.txt
Deleted : C:\Users\user\Desktop\Addition.txt
Deleted : C:\Users\user\Desktop\AdwCleaner(1).exe
Deleted : C:\Users\user\Desktop\dds.com
Deleted : C:\Users\user\Desktop\dds.scr
Deleted : C:\Users\user\Desktop\dds.txt
Deleted : C:\Users\user\Desktop\Fixlog.txt
Deleted : C:\Users\user\Desktop\Fixlog1.txt
Deleted : C:\Users\user\Desktop\FRST.txt
Deleted : C:\Users\user\Desktop\FRST64.exe
Deleted : C:\Users\user\Desktop\Search.txt
Deleted : C:\Users\user\Downloads\AdwCleaner(1).exe
Deleted : C:\Users\user\Downloads\AdwCleaner.exe
Deleted : C:\Users\user\Downloads\adwcleaner_4.109.exe
Deleted : C:\Users\user\Downloads\adwcleaner_5.007.exe
Deleted : C:\Users\user\Downloads\dds.com
Deleted : C:\Users\user\Downloads\dds.scr
Deleted : C:\Users\user\Downloads\esetsmartinstaller_enu.exe
Deleted : C:\Users\user\Downloads\FRST64.exe
Deleted : HKLM\SOFTWARE\AdwCleaner

~ Cleaning system restore ...

Deleted : RP #779 [avast! antivirus system restore point | 09/16/2015 10:49:02]
Deleted : RP #780 [Removed Suporte para Aplicações Apple | 09/16/2015 12:19:44]
Deleted : RP #781 [Removed Apple Software Update | 09/16/2015 12:21:37]
Deleted : RP #782 [Removed HTC Sync. | 09/16/2015 12:22:54]
Deleted : RP #783 [Removed HTC Driver Installer. | 09/16/2015 12:27:13]
Deleted : RP #784 [Removed HTC BMP USB Driver. | 09/16/2015 12:28:24]
Deleted : RP #785 [Removed eBay | 09/16/2015 12:30:06]
Deleted : RP #786 [Removed Java 8 Update 31 (64-bit) | 09/17/2015 08:45:55]
Deleted : RP #787 [Removed Java 8 Update 31 | 09/17/2015 08:48:05]
Deleted : RP #788 [Removed HTC Driver Installer. | 09/17/2015 08:49:41]
Deleted : RP #789 [Removed Java(TM) 6 Update 17 | 09/17/2015 23:09:59]
Deleted : RP #790 [Windows Update | 09/18/2015 14:38:58]

New restore point created !

########## - EOF - ##########
Back to top
View user's profile Send private message
Gary R
Moderator


Joined: 03 May 2005
Last Visit: 16 Nov 2017
Posts: 10190
Location: Yorkshire

PostPosted: Sat Sep 19, 2015 7:33 am    Post subject: Reply with quote

Looks like everything went as planned.


Quote:
This topic is now closed.

If you are the originator of this topic, and you need it re-opened please pm a moderator, including a link to this topic.


If you have been helped and wish to donate to help with the costs of this volunteer site, please read Spyware Warrior Donations

Gary R

_________________
Gary R Administrator at Malware Removal University


If you've been helped, please donate to help with the costs of this volunteer site .... Spyware Warrior Donations
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   This topic is locked: you cannot edit posts or make replies.    Spyware Warrior Forum Index -> Help with spyware removal All times are GMT - 8 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



smartBlue Style © 2002 Smartor
Powered by phpBB © 2001, 2002 phpBB Group