Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Russian popups and redirects


  • This topic is locked This topic is locked
8 replies to this topic

#1 blindmetal

blindmetal

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:12 PM

Posted 03 July 2015 - 10:23 AM

Hello. Something was installed in my computer that keeps redirecting the sites I visit both in Chrome and in Firefox. It also popups lots of russian ads while I'm browsing all the time. I ran lots of scans (adwcleaner, jrt, malwarebytes and others) but it is still here. I have even reinstalled windows (restored to factory conditions) but it didn't help.

Here are the FRST logs:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01
Ran by lelezinha (administrator) on Leticia on 03-07-2015 12:11:32
Running from C:\Users\lelezinha\Downloads
Loaded Profiles: lelezinha (Available Profiles: lelezinha)
Platform: Windows 8.1 Single Language (X64) OS Language: Português (Brasil)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudService.exe
(DELL Inc.) C:\Program Files (x86)\Wyse\PocketCloud\WyseRemoteAccess.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Dell Inc.) C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Waves Audio Ltd.) C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16422_x64__8wekyb3d8bbwe\glcnd.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7510232 2014-01-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1374936 2014-01-13] (Realtek Semiconductor)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe [285272 2013-12-31] (Waves Audio Ltd.)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3777696 2014-01-16] (Dell Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-07-24] (McAfee, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [133760 2014-01-08] (Atheros Communications)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3695450386-1216431171-2023144531-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-3695450386-1216431171-2023144531-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.com/?pc=DCJB
SearchScopes: HKU\S-1-5-21-3695450386-1216431171-2023144531-1001 -> DefaultScope {5DDF30B9-7C42-4E3C-A974-86F28367216F} URL =
SearchScopes: HKU\S-1-5-21-3695450386-1216431171-2023144531-1001 -> {5DDF30B9-7C42-4E3C-A974-86F28367216F} URL =
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2013-07-24] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2013-07-24] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 80.82.64.136 8.8.8.8
Tcpip\..\Interfaces\{40A53EFA-5B99-463C-85B8-E6124687BFE3}: [DhcpNameServer] 80.82.64.136 8.8.8.8
Tcpip\..\Interfaces\{CE1E4EB0-5FA0-4E36-9A53-8837142C3039}: [DhcpNameServer] 10.42.0.251 10.42.0.252

FireFox:
========
FF ProfilePath: C:\Users\lelezinha\AppData\Roaming\Mozilla\Firefox\Profiles\vvn7t6zh.default
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2013-07-24] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2013-07-24] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-07-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-07-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\buscape.xml [2015-07-01]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mercadolivre.xml [2015-07-01]

Chrome:
=======
CHR Profile: C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-03]
CHR Extension: (Google Docs) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-03]
CHR Extension: (Google Drive) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-03]
CHR Extension: (YouTube) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-03]
CHR Extension: (Google Search) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-03]
CHR Extension: (Google Sheets) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-03]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-03]
CHR Extension: (Google Wallet) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-03]
CHR Extension: (Gmail) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 0270221435925287mcinstcleanup; C:\Windows\TEMP\027022~1.EXE [834664 2013-07-30] (McAfee, Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [318592 2014-01-08] (Windows ® Win 7 DDK provider) [File not signed]
S3 DellProdRegManager; C:\Program Files (x86)\Dell Product Registration\regmgrsvc.exe [293440 2014-04-01] (Aviata, Inc.)
S2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [202744 2014-04-10] (Dell Inc.)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [326856 2013-07-10] (McAfee, Inc.)
R2 Intel® Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-12-10] (Intel Corporation)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [175464 2013-07-24] (McAfee, Inc.)
R3 McAWFwk; c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-24] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [326856 2013-07-10] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [602944 2013-07-05] (McAfee, Inc.)
R2 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [326856 2013-07-10] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [326856 2013-07-10] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [326856 2013-07-10] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1025232 2013-12-11] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.)
R2 My Dell Client Framework; C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.exe [168960 2014-01-10] (Dell Inc.) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [253776 2013-07-30] (CyberLink)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-08] (Realtek Semiconductor)
S2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1915920 2014-04-04] (SoftThinks SAS)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-09-09] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-09-09] (Microsoft Corporation)
R2 WysePocketCloud; C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudService.exe [16176 2013-08-22] ()
R2 WyseRemoteAccess; C:\Program Files (x86)\Wyse\PocketCloud\WyseRemoteAccess.exe [1785344 2013-08-19] (DELL Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2013-12-12] (Qualcomm Atheros Communications, Inc.)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-01-08] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-24] (OSR Open Systems Resources, Inc.)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-08-07] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [411944 2013-11-26] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96112 2013-11-26] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-28] (NVIDIA Corporation)
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [41200 2014-01-15] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-09-09] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-03 12:11 - 2015-07-03 12:12 - 00016327 _____ C:\Users\lelezinha\Downloads\FRST.txt
2015-07-03 12:10 - 2015-07-03 12:11 - 00000000 ____D C:\FRST
2015-07-03 12:10 - 2015-07-03 12:10 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Mozilla
2015-07-03 12:10 - 2015-07-03 12:10 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Mozilla
2015-07-03 12:09 - 2015-07-03 12:09 - 02112512 _____ (Farbar) C:\Users\lelezinha\Downloads\FRST64.exe
2015-07-03 12:09 - 2015-07-03 12:09 - 00242832 _____ C:\Users\lelezinha\Downloads\Firefox Setup Stub 39.0.exe
2015-07-03 12:09 - 2015-07-03 12:09 - 00001177 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-03 12:09 - 2015-07-03 12:09 - 00001165 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\Users\Todos os Usuários\Mozilla
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\ProgramData\Mozilla
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-03 11:54 - 2015-07-03 11:55 - 00000000 ____D C:\AdwCleaner
2015-07-03 11:53 - 2015-07-03 11:53 - 00049783 _____ C:\Users\lelezinha\Desktop\Result.txt
2015-07-03 11:52 - 2015-07-03 11:53 - 00049783 _____ C:\Users\lelezinha\Downloads\Result.txt
2015-07-03 11:51 - 2015-07-03 11:51 - 02244096 _____ C:\Users\lelezinha\Downloads\AdwCleaner.exe
2015-07-03 11:51 - 2015-07-03 11:51 - 00892928 _____ (Farbar) C:\Users\lelezinha\Downloads\MiniToolBox.exe
2015-07-03 11:14 - 2015-07-03 11:26 - 00000000 ____D C:\Users\lelezinha\Documents\PRojeto
2015-07-03 11:14 - 2015-07-03 11:14 - 00000000 ____D C:\Users\lelezinha\Documents\projetos referencias
2015-07-03 11:14 - 2015-07-02 21:45 - 00000000 ____D C:\Users\lelezinha\Documents\muito util
2015-07-03 11:13 - 2015-07-03 11:14 - 00000000 ____D C:\Users\lelezinha\Documents\IMG
2015-07-03 11:09 - 2015-07-03 11:13 - 00000000 ____D C:\Users\lelezinha\Documents\programas
2015-07-03 11:08 - 2015-07-03 11:36 - 00000000 ____D C:\Users\lelezinha\Documents\diplo
2015-07-03 11:06 - 2015-07-03 11:06 - 00000000 ____D C:\Users\lelezinha\Documents\site
2015-07-03 09:57 - 2015-07-03 09:57 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-03 09:57 - 2015-07-03 09:57 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-07-03 09:57 - 2015-07-03 09:57 - 00002069 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2015-07-03 09:56 - 2015-07-03 09:59 - 00000000 ____D C:\Users\Todos os Usuários\Adobe
2015-07-03 09:56 - 2015-07-03 09:59 - 00000000 ____D C:\ProgramData\Adobe
2015-07-03 09:56 - 2015-07-03 09:56 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-07-03 09:55 - 2015-07-03 09:58 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Adobe
2015-07-03 09:42 - 2015-07-03 09:42 - 00000000 ____D C:\Windows\System32\Tasks\Aviata
2015-07-03 09:41 - 2015-07-03 09:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-07-03 09:13 - 2015-07-03 11:32 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3695450386-1216431171-2023144531-1001
2015-07-03 09:13 - 2015-07-03 11:25 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-03 09:13 - 2015-07-03 09:25 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-03 09:13 - 2015-07-03 09:20 - 00004066 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-03 09:13 - 2015-07-03 09:20 - 00003830 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-03 09:13 - 2015-07-03 09:13 - 00002279 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-03 09:13 - 2015-07-03 09:13 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Google
2015-07-03 09:13 - 2015-07-03 09:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-03 09:13 - 2015-07-03 09:13 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-03 09:12 - 2015-07-03 09:13 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Deployment
2015-07-03 09:12 - 2015-07-03 09:12 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Apps\2.0
2015-07-03 09:10 - 2015-07-03 09:10 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C7685AF-666B-4AC6-8D9A-25BC05F3DA51}
2015-07-03 09:10 - 2015-07-03 09:10 - 00000000 __SHD C:\Users\lelezinha\AppData\Local\EmieUserList
2015-07-03 09:10 - 2015-07-03 09:10 - 00000000 __SHD C:\Users\lelezinha\AppData\Local\EmieSiteList
2015-07-03 09:10 - 2015-07-03 09:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\Todos os Usuários\Atheros
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\Documents\Bluetooth Folder
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Power2Go8
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\NVIDIA Corporation
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\BMExplorer
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Aviata
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\ProgramData\Atheros
2015-07-03 09:08 - 2015-07-03 09:58 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Adobe
2015-07-03 09:08 - 2015-07-03 09:08 - 00001424 _____ C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-03 09:08 - 2015-07-03 09:08 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-07-03 09:08 - 2015-07-03 09:08 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Atheros
2015-07-03 09:08 - 2015-07-03 09:08 - 00000000 ____D C:\Users\lelezinha\AppData\Local\VirtualStore
2015-07-03 09:07 - 2015-07-03 11:29 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Packages
2015-07-03 09:07 - 2015-07-03 09:08 - 00000000 ____D C:\Users\lelezinha
2015-07-03 09:07 - 2015-07-03 09:07 - 00000020 ___SH C:\Users\lelezinha\ntuser.ini
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Modelos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Meus Documentos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Menu Iniciar
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Documents\Minhas Músicas
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Documents\Minhas Imagens
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Documents\Meus Vídeos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Dados de Aplicativos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Configurações Locais
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\AppData\Local\Histórico
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\AppData\Local\Dados de Aplicativos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Ambiente de Rede
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Ambiente de Impressão
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 ____D C:\Users\lelezinha\AppData\Local\NVIDIA
2015-07-03 09:07 - 2014-09-09 17:15 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-07-03 09:07 - 2014-03-18 07:37 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-07-03 09:07 - 2014-03-18 07:16 - 00000369 _____ C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-07-03 09:07 - 2014-03-18 07:16 - 00000369 _____ C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-07-03 09:07 - 2014-01-08 17:39 - 37660368 _____ (Dropbox, Inc.) C:\Users\lelezinha\Desktop\Install Dropbox.exe
2015-07-03 09:07 - 2013-08-22 12:36 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-07-03 09:07 - 2013-08-22 12:36 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-07-03 06:38 - 2015-07-03 06:38 - 00000000 _____ C:\Recovery.txt
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\AppData\Local\Histórico
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\AppData\Local\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Modelos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Menu Iniciar
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Documentos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Public\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Public\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Public\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Modelos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Meus Documentos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Menu Iniciar
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Configurações Locais
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\AppData\Local\Histórico
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\AppData\Local\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Ambiente de Rede
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Ambiente de Impressão
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Histórico
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Modelos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Menu Iniciar
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Documentos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Program Files\Common Files\Sistema
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Program Files\Arquivos Comuns
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Arquivos de Programas

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-03 12:00 - 2013-08-22 12:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-03 11:29 - 2013-08-22 12:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-03 10:17 - 2014-09-09 12:32 - 00365702 _____ C:\Windows\WindowsUpdate.log
2015-07-03 09:45 - 2014-03-18 07:07 - 01797166 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-03 09:45 - 2014-03-18 06:29 - 00774900 _____ C:\Windows\system32\prfh0416.dat
2015-07-03 09:45 - 2014-03-18 06:29 - 00158494 _____ C:\Windows\system32\prfc0416.dat
2015-07-03 09:41 - 2013-08-22 11:46 - 00014546 _____ C:\Windows\setupact.log
2015-07-03 09:10 - 2014-09-09 12:58 - 00000000 ____D C:\Users\Todos os Usuários\McAfee
2015-07-03 09:10 - 2014-09-09 12:58 - 00000000 ____D C:\ProgramData\McAfee
2015-07-03 09:08 - 2014-09-09 16:34 - 00000000 ____D C:\Windows\Panther
2015-07-03 09:08 - 2014-09-09 12:58 - 00000000 ____D C:\Program Files (x86)\McAfee
2015-07-03 09:08 - 2013-08-22 10:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-03 09:06 - 2014-09-09 13:00 - 00000000 ____D C:\Program Files (x86)\Dell Backup and Recovery
2015-07-03 06:38 - 2013-08-22 12:36 - 00262144 _____ C:\Windows\system32\config\BCD-Template
2015-07-03 01:40 - 2013-08-22 12:36 - 00000000 ____D C:\Windows\rescache
2015-07-03 01:39 - 2013-08-22 12:36 - 00000000 ____D C:\Program Files\Windows NT
2015-07-03 01:39 - 2013-08-22 11:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-03 01:39 - 2013-08-22 11:44 - 00345464 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-03 01:39 - 2013-08-22 10:36 - 00000000 __RHD C:\Users\Default

==================== Files in the root of some directories =======

2014-09-09 12:24 - 2014-09-09 12:24 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-09-09 12:45 - 2014-09-09 12:46 - 0000121 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-09-09 12:41 - 2014-09-09 12:42 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-09-09 12:42 - 2014-09-09 12:43 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2014-09-09 12:43 - 2014-09-09 12:45 - 0000108 _____ () C:\ProgramData\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}.log
2014-09-09 12:41 - 2014-09-09 12:41 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

Some files in TEMP:
====================
C:\Users\lelezinha\AppData\Local\Temp\Quarantine.exe
C:\Users\lelezinha\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-09 12:22

==================== End of log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:28-06-2015 01
Ran by lelezinha at 2015-07-03 12:12:32
Running from C:\Users\lelezinha\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-3695450386-1216431171-2023144531-500 - Administrator - Disabled)
Convidado (S-1-5-21-3695450386-1216431171-2023144531-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3695450386-1216431171-2023144531-1003 - Limited - Enabled)
lelezinha (S-1-5-21-3695450386-1216431171-2023144531-1001 - Administrator - Enabled) => C:\Users\lelezinha

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Português (HKLM-x32\...\{AC76BA86-7AD7-1046-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Atualizações da NVIDIA 11.10.11 (Version: 11.10.11 - NVIDIA Corporation) Hidden
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
Dell Backup and Recovery - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.7.1.2 - Dell Inc.)
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.7.1.2 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP)
Dell Product Registration (HKLM-x32\...\{17FFE63C-6734-4950-B488-134B5A2505F7}) (Version: 2.04.0280 - Aviata Inc.)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.1 - Synaptics Incorporated)
Dell Update (HKLM-x32\...\{9E4750A7-90F6-4181-8A8A-B1ADF4216E93}) (Version: 1.0.1059.0 - Dell Inc.)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
DSC/AA Factory Installer (Version: 3.5.6426.22 - PC-Doctor, Inc.) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.23.1766 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
McAfee AntiVirus (HKLM-x32\...\MSC) (Version: 12.8.409 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 pt-BR) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 pt-BR)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla)
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
My Dell Client Framework (HKLM-x32\...\InstallShield_{05F1B866-2372-4E82-9AA8-C64FB11CEF8B}) (Version: 1.0.0.3 - Dell)
My Dell Client Framework (x32 Version: 1.0.0.3 - Dell) Hidden
NVIDIA Driver de gráficos 332.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.91 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Painel de controle da NVIDIA 332.91 (Version: 332.91 - NVIDIA Corporation) Hidden
PocketCloud (HKLM-x32\...\{D9752C7D-A595-4687-A0D5-362E9C311C55}) (Version: 2.7.14 - Wyse Technology)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.314 - Qualcomm Atheros Communications)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.1.18 - Dell Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.39054 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7161 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 10:25 - 2013-08-22 10:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {15F8A2AE-7415-4C14-B5FE-0F23B1B0E7D0} - System32\Tasks\PocketCloudVirtualChannel => C:\Program Files (x86)\Wyse\PocketCloud\WPCRDPVirtualChannelServer.exe [2013-08-22] ()
Task: {26B0660F-4580-4EEC-956D-E63C5491BDF8} - System32\Tasks\Dell\Dell Product Registration => C:\Program Files (x86)\Dell Product Registration\prodreg.exe [2014-04-01] (Aviata Inc)
Task: {47A66114-5D9B-4FEF-919A-F9AC06970642} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {4A84F08D-EB96-49E1-ACCE-DEA59F671B5B} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2014-01-15] (Synaptics Incorporated)
Task: {6EC870D3-5D89-4B42-9F3A-DE3CD0518BDA} - System32\Tasks\PCDBackgroundMonSetup => C:\Program Files\My Dell\pcdrcui.exe [2014-01-10] (PC-Doctor, Inc.)
Task: {880B07A6-4731-49F2-8AA9-B91C1775F966} - System32\Tasks\Aviata\PowerRegister\Dell Reminder (lelezinha) => C:\Program Files (x86)\Dell Product Registration\prodreg.exe [2014-04-01] (Aviata Inc)
Task: {8F96D5E8-5B43-426F-8DB3-48DFF8F69B24} - System32\Tasks\Dell\Dell Product Registration Update => C:\Program Files (x86)\Dell Product Registration\prodreg.exe [2014-04-01] (Aviata Inc)
Task: {ACC632C2-0F96-4D68-AB03-50968C69846D} - System32\Tasks\PocketCloudUpdater => C:\Program
Task: {B214890F-F5E1-4B86-B228-471960FCDCA3} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-03-05] (CyberLink)
Task: {B26B84B5-A7F9-48F5-8D9A-3DC6894E2073} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-22] (CyberLink Corp.)
Task: {D7FF0B79-3E79-4929-A991-5AA2E2353101} - System32\Tasks\PocketCloud => C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudDesktopApp.exe [2013-08-22] ()
Task: {EF508898-323A-42A1-B016-8EF754348CAD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-03] (Google Inc.)
Task: {F7E8AEEB-1506-43A2-8C21-3DE759913903} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-03] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2014-09-09 12:54 - 2014-03-24 09:30 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-08-22 11:40 - 2013-08-22 11:40 - 00016176 _____ () C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudService.exe
2013-08-22 11:40 - 2013-08-22 11:40 - 00040240 _____ () C:\Program Files (x86)\Wyse\PocketCloud\AetherServiceLib.dll
2013-08-22 11:40 - 2013-08-22 11:40 - 00046384 _____ () C:\Program Files (x86)\Wyse\PocketCloud\AetherHelperLib.dll
2014-01-10 14:53 - 2014-01-10 14:53 - 00016384 _____ () C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.Interfaces.dll
2014-01-10 14:53 - 2014-01-10 14:53 - 00081408 _____ () C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.Objects.dll
2014-01-10 14:53 - 2014-01-10 14:53 - 00815616 _____ () C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.Resources.dll
2014-01-10 15:24 - 2014-01-10 15:24 - 00052736 _____ () C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.Client.Pulse.Agent.Plugins.SelfUpdate.dll
2014-01-10 15:24 - 2014-01-10 15:24 - 00019968 _____ () C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.Client.Pulse.Agent.Common.dll
2014-09-09 13:02 - 2014-03-12 12:22 - 00020256 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBROverlayIcon.dll
2014-09-09 13:02 - 2014-03-12 12:22 - 00019232 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBROverlayNotBackuped.dll
2014-01-08 01:00 - 2014-01-08 01:00 - 00011264 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2014-01-08 00:58 - 2014-01-08 00:58 - 00086016 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Modules\Map\MAP.dll
2014-01-08 01:03 - 2014-01-08 01:03 - 00012928 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ActivateDesktop.exe
2014-09-09 12:46 - 2013-12-10 12:27 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2014-09-09 12:42 - 2013-03-05 00:40 - 00626240 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-03-05 11:41 - 2013-03-05 11:41 - 00015424 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-03-17 01:34 - 2015-03-17 01:34 - 20722336 _____ () C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.dll
2015-03-17 01:34 - 2015-03-17 01:34 - 00322208 _____ () C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll
2015-03-17 01:34 - 2015-03-17 01:34 - 34089120 _____ () C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll
2015-07-03 09:13 - 2015-06-20 02:46 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libglesv2.dll
2015-07-03 09:13 - 2015-06-20 02:46 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\libegl.dll
2015-07-03 09:13 - 2015-06-20 02:46 - 15003976 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.130\PepperFlash\pepflashplayer.dll

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3695450386-1216431171-2023144531-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows Photo Viewer\Papel de Parede do Visualizador de Fotos do Windows.jpg
DNS Servers: 80.82.64.136 - 8.8.8.8

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{96CE8AC7-9B63-4BE8-943A-59DE90F1DCFF}] => (Allow) C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudDesktopApp.exe
FirewallRules: [{6A1A165C-87FC-4E2F-A762-6EA3D86F4AF9}] => (Allow) C:\Program Files (x86)\Wyse\PocketCloud\AetherWindowsService.exe
FirewallRules: [{141BC402-F138-4031-B739-3BB0D43CD1F1}] => (Allow) C:\Program Files (x86)\Wyse\PocketCloud\WyseRemoteAccess.exe
FirewallRules: [{B5D736DE-08B5-43DE-850D-3F8D38648979}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{3FB06A8E-3233-41BB-912D-A2132D8C9F2C}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD Cinema\PowerDVDCinema12.exe
FirewallRules: [{1F697995-744C-4238-90E8-36E09D9B70F2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{5B81D6F4-7F2E-450D-9499-98736A48C16D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{4A7A4078-DA3F-49AA-A2FF-BC481E1567F1}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{FFEC3FC9-5689-4EA3-A825-CAC0C43B67A0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{375D078C-2A4C-4806-A866-1E2A9ED7D0DC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{292BDF1B-62A2-4073-BA14-C0055B405895}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{DA0966CC-2FEC-4AC3-AC5F-0D721FE4461B}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{91CE4FDC-1CC2-4B8A-933B-26EC1CB4D6C6}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{8AA941A1-6735-48B6-A231-C58409B8F158}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{856512AB-38AD-4919-9A5C-42372F50244C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C5BA4BE7-2BCF-4B67-BD4D-0FB2DBA0013F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/03/2015 11:29:18 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Leticia)
Description: Falha na ativação do aplicativo microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.People com o erro: -2147009280. Veja o log Microsoft-Windows-TWinUI/Operational para obter informações adicionais.

Error: (07/03/2015 09:04:33 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (07/03/2015 09:04:29 AM) (Source: Windows Search Service Profile Notification) (EventID: 2) (User: )
Description: Não foi possível remover os dados indexados do Windows Search Service para o usuário '202000x80000000000000569ApplicationLeticia15005__binLength4C006500740069006300690061005C00410064006D0069006E006900730074007200610064006F00720000003000780038003000300034003200310030003300000000000000' devido à exclusão do perfil de usuário. Código de erro %2.

%3.

Error: (07/03/2015 09:04:20 AM) (Source: AVLogEvent) (EventID: 5005) (User: AUTORIDADE NT)
Description: Content is missing.
Error Code:a7f42014


System errors:
=============
Error: (07/03/2015 11:29:13 AM) (Source: DCOM) (EventID: 10001) (User: Leticia)
Description: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.315616Windows.Networking.BackgroundTransfer.Internal.BackgroundTransferTask.ClassId.3Não DisponívelNão Disponível

Error: (07/03/2015 01:39:09 AM) (Source: volmgr) (EventID: 46) (User: )
Description: Falha na inicialização do despejo de memória!

Error: (09/09/2014 01:18:55 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: específico do aplicativoLocalAtivação{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}AUTORIDADE NTSISTEMAS-1-5-18LocalHost (Usando LRPC)Não DisponívelNão Disponível


Microsoft Office:
=========================
Error: (07/03/2015 11:29:18 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Leticia)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.People-2147009280

Error: (07/03/2015 09:04:33 AM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\System32\bitsperf.dll8

Error: (07/03/2015 09:04:29 AM) (Source: Windows Search Service Profile Notification) (EventID: 2) (User: )
Description: 202000x80000000000000569ApplicationLeticia15005__binLength4C006500740069006300690061005C00410064006D0069006E006900730074007200610064006F00720000003000780038003000300034003200310030003300000000000000

Error: (07/03/2015 09:04:20 AM) (Source: AVLogEvent) (EventID: 5005) (User: AUTORIDADE NT)
Description: a7f42014


==================== Memory info ===========================

Processor: Intel® Core™ i5-4210U CPU @ 1.70GHz
Percentage of memory in use: 33%
Total physical RAM: 8095.82 MB
Available physical RAM: 5406.01 MB
Total Pagefile: 10015.82 MB
Available Pagefile: 7112.27 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:921.33 GB) (Free:875.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 53A31657)

Partition: GPT Partition Type.

==================== End of log ============================

Attached Files


Edited by blindmetal, 03 July 2015 - 10:35 AM.


BC AdBot (Login to Remove)

 


#2 blindmetal

blindmetal
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:12 PM

Posted 04 July 2015 - 10:12 AM

Can anyone help?

 

Here are the adwcleaner, JRT and Malwarebytes logs:

 

# AdwCleaner v4.207 - Relatório criado 04/07/2015 às 11:55:26
# Atualizado 21/06/2015 por Xplode
# Base de dados : 2015-07-02.1 [Servidor]
# Sistema operacional : Windows 8.1 Single Language  (x64)
# Usuário : lelezinha - LETICIA
# Executando de : C:\Users\lelezinha\Downloads\AdwCleaner.exe
# Opção : Verificar

***** [ Serviços ] *****


***** [ Arquivos / Pastas ] *****


***** [ Tarefas agendadas ] *****


***** [ Atalhos ] *****


***** [ Registro ] *****


***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.17037


-\\ Mozilla Firefox v39.0 (x86 pt-BR)


-\\ Google Chrome v43.0.2357.130

[C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Web data] - Encontrado [Search Provider] : hxxp://br.ask.com/web?q={searchTerms}
[C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Web data] - Encontrado [Search Provider] : hxxp://www.key-find.com/web/?type=dspp&ts=1423426906&from=cor&uid=WDCXWD10JPVX-75JC3T0_WXW1E54UVTR4E54UVTR4&q={searchTerms}
[C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Encontrado [Homepage] : hxxp://www.google.com/","homepage_is_newtabpage":false,"pinned_tabs":[],"protection":{"macs":{"browser":{"show_home_button":"5F4585AB2C35F4CD9203F6B03AC7CEF9281AF8DFD146DB0F87F8B6A261626F2B"},"default_search_provider":{"keyword":"F5A7CCB1FF142B67E81A97CC1F92ACC5A993D85B07704B1CD326FB813CFBF735","name":"1CA38021E9C8A8EA72497096A0C47ABA662DDF9EF1EA57317858672EDD36611A","search_url":"72523C68A8757B6BF565BC68751FFF0C44861F32A3A0D43B81EC0E87AC778909"},"default_search_provider_data":{"template_url_data":"BF0CBAFEB28600D2492585DC55C05C79F2D823476B466A7BB28323FC81C971ED"},"extensions":{"settings":{"aapocclcgogkmnckokdopfmhonfmgoek":"19433A7D7CD0562079F9A04363EAA81289B8F37A6DECFAB8FA6FC3511A1A0085","ahfgeienlihckogmohjhadlkjgocpleb":"E50CAADF24E7CAFF8BD9181139891BC91D468DB10C88AD0B696523FB286B6B1E","aohghmighlieiainnegkcijnfilokake":"A043A9CA3B45BB0D80C14953AE2BB11A82252BA8D78974827577348F5FDD5CA6","apdfllckaahabafndbhieahigkjlhalf":"620E508CD2575E4CDC397191A36DAE8254E9A37620A3435175F0C3B043C7949D","bepbmhgboaologfdajaanbcjmnhjmhfn":"86D9086A29F5486F7449B622123DCB96C839A5C9BA2DB8BF4A962E33AF92BA0E","blpcfgokakmgnkcojhhkbfbldkacnbeo":"B49CA1BAFF1C4667AAD401D53482BE48DCF08D518C8CCC48614887913989AFEC","coobgpohoikkiipiblmjeljniedjpjpf":"5649E9DC754D1A9990A92990065F35D5480E3D62AEE2745A6015CEA63C2560F0","eemcgdkfndhakfknompkggombfjjjeno":"89728D057BFEF14D3A5C409AB5168FB3D2790669CA3DA9FB1C8CD5C05607E0F1","ejpkomickkjembahgobhliimpadckgef":"5E264816F8CA3C9BD2642A8449044C780CA151D78905274F0B5311D574370AB5","ennkphjdgehloodpbhlhldgbnhmacadg":"D5A1653463BD16054586B8069434622DF09ED95B2D7B8EF4E5E9E63E9948A17E","felcaaldnbdncclmgdcncolpebgiejap":"29329CB1D1FE4AF971B63B81C4879ABA0AC49069B511B05029C3A6D2584E47A3","fheoggkfdfchfphceeifdbepaooicaho":"9606EDDC1CD6FF404A43AD05547544549310FCF9496EC71923363864DD1A8135","gfdkimpbcpahaombhbimeihdjnejgicl":"54598DD8B1159753FE4456B4FD28DB5B374561A780C56A9B11EADEB09FA52563","kmendfapggjehodndflmmgagdbamhnfd":"57FACF5395469CBF81550DD2BF728054116499370FFF31C8F36E5B9CFF5B7774","lccekmodgklaepjeofjdjpbminllajkg":"961291D8C2E5869A437CF0CADCC25AED2A724DF61C4489C95FE32562F4509AC6","mfehgcgbbipciphmccgaenjidiccnmng":"8E0F281DAFB594F6672BBC6B38B641B2E14E2416783E56ABE2F984C3891CD582","mfffpogegjflfpflabcdkioaeobkgjik":"6133F8A625FCA048873F4F3DD849A8FBEC85418CC4F51039B170012737E0A2D3","mgndgikekgjfcpckkfioiadnlibdjbkf":"6B1E05F41506AC851914C4D3555E08C3E6EB6A8753E326A7EF30792CC9A184A6","mhjfbmdgcfjbbpaeojofohoefgiehjai":"E8FB24EDC21159B5B0CA7A0395467169F7CA508788CC7D8416799C016CAACC7E","nbpagnldghgfoolbancepceaanlmhfmd":"16F6FD732CE3665BBD5FCAAA803DD12D626B5C87068BE2E46C4EE0A9D5374C51","neajdppkdcdipfabeoofebfddakdcjhd":"62A153C7C1E3BF0A179001FB4F73E27D95ED5CED7601ACDE6B52E57EBF8DE635","nkeimhogjdpnpccoofpliimaahmaaome":"532A09D07982D35ED396C190CAA3A5C58D7BB6A8DE366379676FB8C3D3AFF50A","nmmhkkegccagdldgiimedpiccmgmieda":"FA8EC6F0F06F7D61EFD1D3976859EC6B5B8CC67D36905D9429C7342FCE60F57B","pafkbggdmjlpgkdkcbjmhmfcdpncadgh":"FD7E59A89D692B9607779368ADDA458639A17254A87992E2D0D9BB449A5C4D71","pjkljhegncpnkpknbcohdijeoejaedia":"19C8491350B670704D26DCC1EF7CE3B703D4F20AE5EA3E7D47A27AFA4E77626E"}},"google":{"services":{"last_username":"9A95F0C06AC8CA89AE937D350A3EC896DF57C4026BDD11CE9D9C76451CA7B008","username":"9E74F00392B35EF544EDA71223CA2739E2104319862BF71F6B39A76495483854"}},"homepage":"F1D2BA387506682B17C47D56C163FBFE59DF0916704BA2241E41DC721B0FEAB7","homepage_is_newtabpage":"0BC55E5F174F58CCB36791CBF5F92357D28D9188B8F079B06A19933D469EA0D5","pinned_tabs":"8CB4F2BFD2B094BD3CFCBC2F4D8843F11466823BE2761549138689CB34204554","prefs":{"preference_reset_time":"3D9F262E35EDDA8CE4B3A3CCBF3068619E18376E7ED073910FB97161929BC673"},"profile":{"reset_prompt_memento":"85347FBB8F0B219A5C428EF5F6AC673CF8A0C4D46403BF82FBFDF678B30E0711"},"safebrowsing":{"incidents_sent":"C01AB7B73A8D5AA8A4D8E6FA48909CDF51DF808A2D27A36BC0F3D407A7FC1EBF"},"search_provider_overrides":"4C21FD3BDA3171BA60CF104A558FE84C4F3E5C89B36715603A8695B42E2FDF34","session":{"restore_on_startup":"C2B23FD121029C27A99983BBA89F200B452A34A33C6E4A6CB5879A0D8ECCED0B","startup_urls":"D0B468312EEC4257D7E36264F5F5F6E45CE0289A4D8BDC486F7D96088196E30D"},"software_reporter":{"prompt_reason":"E771A0314CC18B834AA7DF278F7C9F2B8913F6FA9DB00BDF97405B647576C6C1","prompt_seed":"7CCED1A163C912AB2467C1BD946E89D5444BD29FF7135E86A3606E925F0D4491","prompt_version":"8AE4AB835765FA2E69DD294F7755A780B6DD88FDC4829460E769AE9FE028DE2C"},"sync":{"remaining_rollback_tries":"6FE4D55D99A10F2D9967D1C2E2D0F6B13488C741E3D8FC520806672CF1241559"}},"super_mac":"FB213619BD49D9FD4246253725058DE1DDDCB3391B0D8CA89E94BE0253EDD933"},"session":{"restore_on_startup":5,"startup_urls":["hxxp://www1.delta-search.com/?affID=119352&tt=gc_&babsrc=HP_ss&mntrId=50130023142C127D
[C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Encontrado [Startup_URLs] : D0B468312EEC4257D7E36264F5F5F6E45CE0289A4D8BDC486F7D96088196E30D"},"software_reporter":{"prompt_reason":"E771A0314CC18B834AA7DF278F7C9F2B8913F6FA9DB00BDF97405B647576C6C1","prompt_seed":"7CCED1A163C912AB2467C1BD946E89D5444BD29FF7135E86A3606E925F0D4491","prompt_version":"8AE4AB835765FA2E69DD294F7755A780B6DD88FDC4829460E769AE9FE028DE2C"},"sync":{"remaining_rollback_tries":"6FE4D55D99A10F2D9967D1C2E2D0F6B13488C741E3D8FC520806672CF1241559"}},"super_mac":"FB213619BD49D9FD4246253725058DE1DDDCB3391B0D8CA89E94BE0253EDD933"},"session":{"restore_on_startup":5,"startup_urls":["hxxp://www1.delta-search.com/?affID=119352&tt=gc_&babsrc=HP_ss&mntrId=50130023142C127D

*************************

AdwCleaner[R0].txt - [766 bytes] - [03/07/2015 11:54:38]
AdwCleaner[R1].txt - [6760 bytes] - [04/07/2015 11:55:26]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [6819 bytes] ##########
 

JRT log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.2.9 (07.04.2015:1)
OS: Windows 8.1 Single Language x64
Ran by lelezinha on 04/07/2015 at 11:48:09,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks

Successfully deleted: [Task] C:\Windows\system32\tasks\PCDEventLauncherTask
Successfully deleted: [Task] C:\Windows\system32\tasks\PCDoctorBackgroundMonitorTask



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\pcdr



~~~ Chrome


[C:\Users\lelezinha\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\lelezinha\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\lelezinha\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\lelezinha\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04/07/2015 at 11:53:58,10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Malwarebytes log:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Data da verificação: 04/07/2015
Hora da verificação: 10:32
Arquivo de registro: result mawarebites.txt
Administrador: Sim

Versão: 2.1.8.1057
Banco de dados de malware: v2015.07.04.02
Banco de dados de rootkit: v2015.07.03.01
Licença: Gratuita
Proteção contra malware: Desabilitado
Proteção contra website malicioso: Desabilitado
Autoproteção: Desabilitado

Sistema operacional: Windows 8.1
CPU: x64
Sistema de arquivos: NTFS
Usuário: lelezinha

Tipo de verificação: Verificação da ameaça
Resultado: Concluído
Objetos verificados: 342199
Tempo decorrido: 23 min, 7 seg

Memória: Habilitado
Inicialização: Habilitado
Sistema de arquivos: Habilitado
Arquivos compactados: Habilitado
Rootkits: Desabilitado
Heurística: Habilitado
PUP: Habilitado
PUM: Habilitado

Processos: 0
(Nenhum item malicioso detectado)

Módulos: 0
(Nenhum item malicioso detectado)

Chaves de registro: 0
(Nenhum item malicioso detectado)

Valores de registro: 0
(Nenhum item malicioso detectado)

Dados de registro: 2
Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|DhcpNameServer, 80.82.64.136 8.8.8.8, Bom: (), Ruim: (80.82.64.136),,[ead8aa3390face6856f3abac9c6a8b75]
Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{40A53EFA-5B99-463C-85B8-E6124687BFE3}|DhcpNameServer, 80.82.64.136 8.8.8.8, Bom: (), Ruim: (80.82.64.136),,[07bbd6077a1046f0301950075fa7e41c]

Pastas: 0
(Nenhum item malicioso detectado)

Arquivos: 0
(Nenhum item malicioso detectado)

Setores físicos: 0
(Nenhum item malicioso detectado)


(end)



#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:12 PM

Posted 06 July 2015 - 08:50 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Reset Chrome...
Open Google Chrome, click on menu icon google-chrome-setting-icon.png which is located right side top of the google chrome.
 
Click "Settings" then "Show advanced settings" at the bottom of the screen.
 
Click "Reset browser settings" button.
 
Clear your cache and cookies
https://support.google.com/chromebook/answer/183083?hl=en
Select "From the beginning of time"

Restart Chrome.
===

Temporarily disable your AV program so it does not interfere.
Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides.

Download Zeok tool from here

When the download appears, save to the Desktop.
On the Desktop, right-click the Zoek.exe file and select: Run as Administrator
(Give it a few seconds to appear.)

Next, copy/paste the entire script inside the code box below to the input field of Zoek:
createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b
Now...
Close any open Browsers.
Click the Run script button, and wait. It takes a few minutes to run all the script.

When the tool finishes, the zoek-results.log is opened in Notepad.
The log is also found on the systemdrive, normally C:\
If a reboot is needed, the log is opened after the reboot.

Please attach the zoek-results.log in your reply.

Also, please provide an update on how the computer is behaving after running the above script.

===

#4 blindmetal

blindmetal
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:12 PM

Posted 06 July 2015 - 08:56 PM

It seems it stopped, but my internet connection is really really slow now. Don't know if it has something to do with the cleaning. I guess so.

 

Here is the log:

 

 
Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by lelezinha on 06/07/2015 at 22:00:34,33.
Microsoft Windows 8.1 Single Language 6.3.9600  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\lelezinha\Desktop\zoek.exe [Scan all users] [Script inserted] 
 
==== System Restore Info ======================
 
06/07/2015 22:01:41 Zoek.exe System Restore Point Created Successfully.
 
==== Empty Folders Check ======================
 
C:\Users\lelezinha\AppData\Local\VirtualStore deleted successfully
 
==== Deleting CLSID Registry Keys ======================
 
 
==== Deleting CLSID Registry Values ======================
 
 
==== Deleting Services ======================
 
 
==== Batch Command(s) Run By Tool======================
 
 
==== Deleting Files \ Folders ======================
 
C:\PROGRA~3\Package Cache deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
 
==== Firefox Extensions Registry ======================
 
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}"="C:\Program Files (x86)\McAfee\SiteAdvisor" [06/07/2015 03:43]
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}"="C:\Program Files (x86)\McAfee\SiteAdvisor" [06/07/2015 03:43]
 
==== Firefox Extensions ======================
 
AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
==== Firefox Plugins ======================
 
 
==== Chromium Look ======================
 
Google Chrome Version: 43.0.2357.130
 
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
fheoggkfdfchfphceeifdbepaooicaho - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx[04/06/2015 09:52]
 
Cat 1920x1080 - lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpkomickkjembahgobhliimpadckgef
Chrome Hotword Shared Module - lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg
 
==== Set IE to Default ======================
 
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
 
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
 
==== All HKCU SearchScopes ======================
 
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{5DDF30B9-7C42-4E3C-A974-86F28367216F} Unknown  Url="Not_Found"
 
==== Deleting CLSID Registry Keys ======================
 
HKEY_USERS\S-1-5-21-3695450386-1216431171-2023144531-1001\Software\Microsoft\Internet Explorer\SearchScopes\{5DDF30B9-7C42-4E3C-A974-86F28367216F} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{5DDF30B9-7C42-4E3C-A974-86F28367216F} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5DDF30B9-7C42-4E3C-A974-86F28367216F} deleted successfully
 
==== Deleting CLSID Registry Values ======================
 
 
==== Empty IE Cache ======================
 
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\lelezinha\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\lelezinha\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\lelezinha\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\lelezinha\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
 
==== Empty FireFox Cache ======================
 
C:\Users\lelezinha\AppData\Local\Mozilla\Firefox\Profiles\vvn7t6zh.default\cache2 emptied successfully
 
==== Empty Chrome Cache ======================
 
C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
 
==== Empty All Flash Cache ======================
 
Flash Cache Emptied Successfully
 
==== Empty All Java Cache ======================
 
No Java Cache Found
 
==== C:\zoek_backup content ======================
 
C:\zoek_backup (files=7 folders=8 7349133 bytes)
 
==== Empty Temp Folders ======================
 
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\lelezinha\AppData\Local\Temp will be emptied at reboot
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot
 
==== After Reboot ======================
 
==== Empty Temp Folders ======================
 
C:\Windows\Temp successfully emptied
C:\Users\LELEZI~1\AppData\Local\Temp successfully emptied
 
==== Empty Recycle Bin ======================
 
C:\$RECYCLE.BIN successfully emptied
 
==== EOF on 06/07/2015 at 22:13:39,90 ======================

Attached Files


Edited by blindmetal, 06 July 2015 - 09:03 PM.


#5 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:12 PM

Posted 07 July 2015 - 07:33 AM

Please run the Farbar tool one more time and post a fresh log for my review.

#6 blindmetal

blindmetal
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:12 PM

Posted 07 July 2015 - 09:46 PM

Internet connection is normal once again, by the way.

 

Here's the log:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01
Ran by lelezinha (administrator) on LETICIA on 07-07-2015 23:32:08
Running from C:\Users\lelezinha\Downloads
Loaded Profiles: lelezinha (Available Profiles: lelezinha)
Platform: Windows 8.1 Single Language (X64) OS Language: Português (Brasil)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(DELL Inc.) C:\Program Files (x86)\Wyse\PocketCloud\WyseRemoteAccess.exe
(Dell Inc.) C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
() C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Waves Audio Ltd.) C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(PC-Doctor, Inc.) C:\Program Files\My Dell\pcdrcui.exe
(Aviata Inc) C:\Program Files (x86)\Dell Product Registration\prodreg.exe
(Aviata Inc) C:\Program Files (x86)\Dell Product Registration\prodreg.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(PC-Doctor, Inc.) C:\Program Files\My Dell\pcdrrealtime.p5x
(Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7510232 2014-01-17] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1374936 2014-01-13] (Realtek Semiconductor)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe [285272 2013-12-31] (Waves Audio Ltd.)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3777696 2014-01-16] (Dell Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3730344 2015-06-30] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [133760 2014-01-08] (Atheros Communications)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2015-07-07]
ShortcutTarget: $McRebootA5E6DEAA56$.lnk ->  (No File)
ShellIconOverlayIdentifiers: [DBARFileBackuped] -> {831cebdd-6baf-4432-be76-9e0989c14aef} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DBARFileNotBackuped] -> {275e4fd7-21ef-45cf-a836-832e5d2cc1b3} => C:\Windows\system32\mscoree.dll [2013-08-22] (Microsoft Corporation)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKU\S-1-5-21-3695450386-1216431171-2023144531-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.com/?pc=DCJB
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3695450386-1216431171-2023144531-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
Tcpip\Parameters: [DhcpNameServer] 189.6.0.78 189.6.0.73
Tcpip\..\Interfaces\{40A53EFA-5B99-463C-85B8-E6124687BFE3}: [DhcpNameServer] 189.6.0.78 189.6.0.73
Tcpip\..\Interfaces\{CE1E4EB0-5FA0-4E36-9A53-8837142C3039}: [DhcpNameServer] 10.42.0.251 10.42.0.252
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF ProfilePath: C:\Users\lelezinha\AppData\Roaming\Mozilla\Firefox\Profiles\vvn7t6zh.default
FF Homepage: hxxp://br.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_29&param1=1&param2=f%3D1%26b%3DFirefox%26cc%3Dbr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0E0C0FyE0B0B0FzztDtD0FyEzz0AtA0DtN0D0Tzu0StCtBzztAtN1L2XzutAtFtCtDtFtCtDtFtCtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StC0B0FyB0ByC0BtCtGyC0DzyyBtGtD0EyDtBtGyEyCyC0BtGtAyCtAtDyCyDzyyDzyyE0FyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtD0E0EtD0C0EyDtG0B0F0A0EtGyE0BtCyCtGzz0DzytDtGzy0EtAyEtC0FtC0BtB0AzztD2QtN0A0LzuyE%26cr%3D1975942399%26a%3Dwncy_pwrisofs_15_29%26os%3DWindows 8.1 Single Language
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-07-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-07-06] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\buscape.xml [2015-07-01]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mercadolivre.xml [2015-07-01]
FF Extension: No Name - C:\Program Files (x86)\McAfee\SiteAdvisor [2015-07-04]
StartMenuInternet: FIREFOX.EXE - firefox.exe
 
Chrome: 
=======
CHR Profile: C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Cat 1920x1080) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpkomickkjembahgobhliimpadckgef [2015-07-04]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-03]
CHR Extension: (Google Wallet) - C:\Users\lelezinha\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-03]
StartMenuInternet: Google Chrome - chrome.exe
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 0068151436280336mcinstcleanup; C:\Users\lelezinha\AppData\Local\Temp\0068151436280336mcinst.exe [883024 2015-05-04] (McAfee, Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [318592 2014-01-08] (Windows ® Win 7 DDK provider) [File not signed]
R2 avgfws; C:\Program Files (x86)\AVG\AVG2015\avgfws.exe [1528432 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3518376 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [314304 2015-06-30] (AVG Technologies CZ, s.r.o.)
S3 DellProdRegManager; C:\Program Files (x86)\Dell Product Registration\regmgrsvc.exe [293440 2014-04-01] (Aviata, Inc.)
S2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [202744 2014-04-10] (Dell Inc.)
R2 Intel® Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-12-10] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 My Dell Client Framework; C:\Program Files (x86)\Dell\My Dell Client Framework\Dell.ClientFramework.exe [168960 2014-01-10] (Dell Inc.) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [253776 2013-07-30] (CyberLink)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-08] (Realtek Semiconductor)
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1915920 2014-04-04] (SoftThinks SAS)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-09-09] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-09-09] (Microsoft Corporation)
R2 WysePocketCloud; C:\Program Files (x86)\Wyse\PocketCloud\PocketCloudService.exe [16176 2013-08-22] ()
R2 WyseRemoteAccess; C:\Program Files (x86)\Wyse\PocketCloud\WyseRemoteAccess.exe [1785344 2013-08-19] (DELL Inc.) [File not signed]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2013-12-12] (Qualcomm Atheros Communications, Inc.)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [21152 2015-03-27] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\system32\DRIVERS\avgfwd6a.sys [67552 2015-04-14] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [293296 2015-06-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [226784 2015-06-10] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [295400 2015-06-15] (AVG Technologies CZ, s.r.o.)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-01-08] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-24] (OSR Open Systems Resources, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [80160 2015-02-13] (McAfee, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-28] (NVIDIA Corporation)
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [41200 2014-01-15] (Synaptics Incorporated)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-07-05] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-09-09] (Microsoft Corporation)
U3 McMPFSvc; No ImagePath
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-07-07 11:45 - 2015-07-07 11:45 - 00000000 ____D C:\Program Files\McAfee
2015-07-07 11:32 - 2015-07-07 11:32 - 00000000 ____D C:\Users\Todos os Usuários\Autodesk
2015-07-07 11:32 - 2015-07-07 11:32 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Autodesk
2015-07-07 11:32 - 2015-07-07 11:32 - 00000000 ____D C:\ProgramData\Autodesk
2015-07-07 11:21 - 2015-07-07 11:29 - 00000000 ____D C:\Users\lelezinha\AppData\Local\CrashDumps
2015-07-07 11:21 - 2015-07-07 11:21 - 00000000 ____D C:\Users\lelezinha\Desktop\cad instalador
2015-07-07 11:21 - 2015-07-07 11:21 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\PowerISO
2015-07-07 11:19 - 2015-07-07 11:19 - 00000826 _____ C:\Users\Public\Desktop\PowerISO.lnk
2015-07-07 11:19 - 2015-07-07 11:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2015-07-07 11:19 - 2015-07-07 11:19 - 00000000 ____D C:\Program Files\PowerISO
2015-07-07 11:19 - 2015-06-07 23:59 - 00127760 _____ (Power Software Ltd) C:\Windows\system32\Drivers\scdemu.sys
2015-07-07 11:18 - 2015-07-07 11:18 - 04153323 _____ C:\Users\lelezinha\Downloads\PowerISO6-x64.jse
2015-07-07 11:01 - 2015-07-07 11:01 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-07-07 10:56 - 2015-07-07 10:56 - 00000290 _____ C:\Windows\wininit.ini
2015-07-07 10:40 - 2015-07-07 11:00 - 00046080 ___SH C:\Users\lelezinha\Desktop\Thumbs.db
2015-07-07 10:24 - 2015-07-07 10:24 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\AVG2015
2015-07-07 10:24 - 2015-07-07 10:24 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-07 10:23 - 2015-07-07 10:24 - 00000000 ____D C:\Users\Todos os Usuários\AVG2015
2015-07-07 10:23 - 2015-07-07 10:24 - 00000000 ____D C:\ProgramData\AVG2015
2015-07-07 10:23 - 2015-07-07 10:23 - 00001001 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-07-07 10:23 - 2015-07-07 10:23 - 00000000 ___HD C:\$AVG
2015-07-07 10:23 - 2015-07-07 10:23 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\TuneUp Software
2015-07-07 10:23 - 2015-07-07 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-07-07 10:21 - 2015-07-07 10:21 - 00000000 ____D C:\Program Files (x86)\AVG
2015-07-07 10:17 - 2015-07-07 23:33 - 00000000 ____D C:\Users\Todos os Usuários\MFAData
2015-07-07 10:17 - 2015-07-07 23:33 - 00000000 ____D C:\ProgramData\MFAData
2015-07-07 10:17 - 2015-07-07 11:02 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Avg2015
2015-07-07 10:17 - 2015-07-07 10:17 - 05017672 _____ (AVG Technologies) C:\Users\lelezinha\Downloads\avg_free_stb_all_2015_ltst_639.exe
2015-07-07 10:17 - 2015-07-07 10:17 - 00000000 ____D C:\Users\lelezinha\AppData\Local\MFAData
2015-07-06 22:17 - 2015-07-06 22:17 - 00005593 _____ C:\Users\lelezinha\Desktop\zoek-results.log
2015-07-06 22:13 - 2015-07-06 22:13 - 00000000 ____D C:\Users\lelezinha\AppData\Local\VirtualStore
2015-07-06 22:01 - 2015-07-06 22:13 - 00005593 _____ C:\zoek-results.log
2015-07-06 22:00 - 2015-07-06 22:10 - 00000000 ____D C:\zoek_backup
2015-07-06 22:00 - 2015-07-06 21:59 - 01308672 _____ C:\Users\lelezinha\Desktop\zoek.exe
2015-07-06 21:59 - 2015-07-06 21:59 - 01308672 _____ C:\Users\lelezinha\Downloads\zoek.exe
2015-07-06 21:54 - 2015-07-07 11:59 - 00001090 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-07-06 21:54 - 2015-07-07 11:21 - 00002279 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-07-06 21:54 - 2015-07-07 11:00 - 00001086 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-07-06 21:54 - 2015-07-06 21:54 - 00004062 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-06 21:54 - 2015-07-06 21:54 - 00003826 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-06 21:54 - 2015-07-06 21:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-06 21:53 - 2015-07-06 21:53 - 00931408 _____ (Google Inc.) C:\Users\lelezinha\Downloads\ChromeSetup.exe
2015-07-06 20:48 - 2015-07-06 20:49 - 00296960 _____ C:\Windows\Minidump\070615-18171-01.dmp
2015-07-06 20:48 - 2015-07-06 20:48 - 695973169 _____ C:\Windows\MEMORY.DMP
2015-07-06 20:48 - 2015-07-06 20:48 - 00000000 ____D C:\Windows\Minidump
2015-07-05 15:16 - 2015-07-07 23:33 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\PCDr
2015-07-05 15:04 - 2015-07-07 23:34 - 00000000 ____D C:\Users\Todos os Usuários\PCDr
2015-07-05 15:04 - 2015-07-05 15:05 - 00000000 ____D C:\ProgramData\PCDr
2015-07-05 11:30 - 2015-07-05 11:43 - 06563592 _____ (Piriform Ltd) C:\Users\lelezinha\Downloads\ccsetup507(1).exe.part
2015-07-05 11:12 - 2015-07-05 11:12 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\ESET
2015-07-05 11:12 - 2015-07-05 11:12 - 00000000 ____D C:\Users\lelezinha\AppData\Local\ESET
2015-07-05 10:53 - 2015-07-05 10:54 - 00001275 _____ C:\Users\lelezinha\Desktop\ZHPCleaner.txt
2015-07-05 10:51 - 2015-07-05 10:53 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\ZHP
2015-07-05 10:51 - 2015-07-05 10:51 - 00000883 _____ C:\Users\lelezinha\Desktop\ZHPCleaner.lnk
2015-07-05 10:50 - 2015-07-05 10:50 - 00002729 _____ C:\Users\lelezinha\Desktop\RKreport_SCN_07052015_104856.log
2015-07-05 10:42 - 2015-07-05 10:50 - 00000000 ____D C:\Users\Todos os Usuários\RogueKiller
2015-07-05 10:42 - 2015-07-05 10:50 - 00000000 ____D C:\ProgramData\RogueKiller
2015-07-05 10:42 - 2015-07-05 10:42 - 01845248 _____ C:\Users\lelezinha\Desktop\ZHPCleaner.exe
2015-07-05 10:42 - 2015-07-05 10:42 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys
2015-07-05 10:41 - 2015-07-05 10:41 - 17853688 _____ C:\Users\lelezinha\Desktop\RogueKiller.exe
2015-07-05 09:21 - 2015-07-05 09:21 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2015-07-04 11:57 - 2015-07-04 11:57 - 00006898 _____ C:\Users\lelezinha\Desktop\AdwCleaner[R1].txt
2015-07-04 11:53 - 2015-07-04 11:53 - 00001307 _____ C:\Users\lelezinha\Desktop\JRT.txt
2015-07-04 11:48 - 2015-07-04 11:48 - 00000207 _____ C:\Windows\tweaking.com-regbackup-LETICIA-Windows-8.1-Single-Language-(64-bit).dat
2015-07-04 11:48 - 2015-07-04 11:48 - 00000000 ____D C:\RegBackup
2015-07-04 11:44 - 2015-07-04 11:44 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Macromedia
2015-07-04 11:18 - 2015-07-04 11:18 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2015-07-04 11:03 - 2015-07-04 11:03 - 00001660 _____ C:\Users\lelezinha\Desktop\result mawarebites.txt
2015-07-04 10:34 - 2015-07-04 10:34 - 02952814 _____ (Malwarebytes Corporation) C:\Users\lelezinha\Downloads\JRT.exe
2015-07-04 10:31 - 2015-07-05 09:27 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-04 10:31 - 2015-07-04 10:31 - 00001120 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-04 10:31 - 2015-07-04 10:31 - 00000000 ____D C:\Users\Todos os Usuários\Malwarebytes
2015-07-04 10:31 - 2015-07-04 10:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-04 10:31 - 2015-07-04 10:31 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-04 10:31 - 2015-07-04 10:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-04 10:31 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-04 10:31 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-04 10:31 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-04 10:29 - 2015-07-04 10:30 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\lelezinha\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-03 12:12 - 2015-07-03 12:13 - 00021716 _____ C:\Users\lelezinha\Downloads\Addition.txt
2015-07-03 12:11 - 2015-07-07 23:32 - 00019247 _____ C:\Users\lelezinha\Downloads\FRST.txt
2015-07-03 12:10 - 2015-07-07 23:32 - 00000000 ____D C:\FRST
2015-07-03 12:10 - 2015-07-03 12:16 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Mozilla
2015-07-03 12:10 - 2015-07-03 12:10 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Mozilla
2015-07-03 12:09 - 2015-07-07 11:21 - 00001165 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-07-03 12:09 - 2015-07-03 12:09 - 02112512 _____ (Farbar) C:\Users\lelezinha\Downloads\FRST64.exe
2015-07-03 12:09 - 2015-07-03 12:09 - 00242832 _____ C:\Users\lelezinha\Downloads\Firefox Setup Stub 39.0.exe
2015-07-03 12:09 - 2015-07-03 12:09 - 00001177 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\Users\Todos os Usuários\Mozilla
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\ProgramData\Mozilla
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-03 12:09 - 2015-07-03 12:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-03 11:54 - 2015-07-04 11:57 - 00000000 ____D C:\AdwCleaner
2015-07-03 11:53 - 2015-07-03 11:53 - 00049783 _____ C:\Users\lelezinha\Desktop\Result.txt
2015-07-03 11:52 - 2015-07-05 09:49 - 00024746 _____ C:\Users\lelezinha\Downloads\Result.txt
2015-07-03 11:51 - 2015-07-03 11:51 - 02244096 _____ C:\Users\lelezinha\Downloads\AdwCleaner.exe
2015-07-03 11:51 - 2015-07-03 11:51 - 00892928 _____ (Farbar) C:\Users\lelezinha\Downloads\MiniToolBox.exe
2015-07-03 11:14 - 2015-07-03 11:26 - 00000000 ____D C:\Users\lelezinha\Documents\PRojeto
2015-07-03 11:14 - 2015-07-03 11:14 - 00000000 ____D C:\Users\lelezinha\Documents\projetos referencias
2015-07-03 11:14 - 2015-07-02 21:45 - 00000000 ____D C:\Users\lelezinha\Documents\muito util
2015-07-03 11:13 - 2015-07-03 11:14 - 00000000 ____D C:\Users\lelezinha\Documents\IMG
2015-07-03 11:09 - 2015-07-03 11:13 - 00000000 ____D C:\Users\lelezinha\Documents\programas
2015-07-03 11:08 - 2015-07-03 11:36 - 00000000 ____D C:\Users\lelezinha\Documents\diplo
2015-07-03 11:06 - 2015-07-03 11:06 - 00000000 ____D C:\Users\lelezinha\Documents\site
2015-07-03 09:57 - 2015-07-04 10:42 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-03 09:57 - 2015-07-03 09:57 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-07-03 09:57 - 2015-07-03 09:57 - 00002069 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2015-07-03 09:56 - 2015-07-03 09:59 - 00000000 ____D C:\Users\Todos os Usuários\Adobe
2015-07-03 09:56 - 2015-07-03 09:59 - 00000000 ____D C:\ProgramData\Adobe
2015-07-03 09:56 - 2015-07-03 09:56 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-07-03 09:55 - 2015-07-03 09:58 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Adobe
2015-07-03 09:42 - 2015-07-03 09:42 - 00000000 ____D C:\Windows\System32\Tasks\Aviata
2015-07-03 09:41 - 2015-07-03 09:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-07-03 09:13 - 2015-07-07 11:58 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3695450386-1216431171-2023144531-1001
2015-07-03 09:13 - 2015-07-06 21:54 - 00000000 ____D C:\Program Files (x86)\Google
2015-07-03 09:13 - 2015-07-03 09:13 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Google
2015-07-03 09:12 - 2015-07-03 09:13 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Deployment
2015-07-03 09:12 - 2015-07-03 09:12 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Apps\2.0
2015-07-03 09:10 - 2015-07-07 23:33 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C7685AF-666B-4AC6-8D9A-25BC05F3DA51}
2015-07-03 09:10 - 2015-07-03 09:10 - 00000000 __SHD C:\Users\lelezinha\AppData\Local\EmieUserList
2015-07-03 09:10 - 2015-07-03 09:10 - 00000000 __SHD C:\Users\lelezinha\AppData\Local\EmieSiteList
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\Todos os Usuários\Atheros
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\Documents\Bluetooth Folder
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Power2Go8
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\NVIDIA Corporation
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\BMExplorer
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Aviata
2015-07-03 09:09 - 2015-07-03 09:09 - 00000000 ____D C:\ProgramData\Atheros
2015-07-03 09:08 - 2015-07-04 10:42 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Adobe
2015-07-03 09:08 - 2015-07-03 09:08 - 00001424 _____ C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-07-03 09:08 - 2015-07-03 09:08 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-07-03 09:08 - 2015-07-03 09:08 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Atheros
2015-07-03 09:07 - 2015-07-06 20:49 - 00000000 ____D C:\Users\lelezinha
2015-07-03 09:07 - 2015-07-04 12:10 - 00000000 ____D C:\Users\lelezinha\AppData\Local\Packages
2015-07-03 09:07 - 2015-07-03 09:07 - 00000020 ___SH C:\Users\lelezinha\ntuser.ini
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Modelos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Meus Documentos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Menu Iniciar
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Documents\Minhas Músicas
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Documents\Minhas Imagens
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Documents\Meus Vídeos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Dados de Aplicativos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Configurações Locais
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\AppData\Local\Histórico
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\AppData\Local\Dados de Aplicativos
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Ambiente de Rede
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 _SHDL C:\Users\lelezinha\Ambiente de Impressão
2015-07-03 09:07 - 2015-07-03 09:07 - 00000000 ____D C:\Users\lelezinha\AppData\Local\NVIDIA
2015-07-03 09:07 - 2014-09-09 17:15 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-07-03 09:07 - 2014-03-18 07:37 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-07-03 09:07 - 2014-03-18 07:16 - 00000369 _____ C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-07-03 09:07 - 2014-03-18 07:16 - 00000369 _____ C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-07-03 09:07 - 2014-01-08 17:39 - 37660368 _____ (Dropbox, Inc.) C:\Users\lelezinha\Desktop\Install Dropbox.exe
2015-07-03 09:07 - 2013-08-22 12:36 - 00000000 ___RD C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-07-03 09:07 - 2013-08-22 12:36 - 00000000 ____D C:\Users\lelezinha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-07-03 06:38 - 2015-07-03 06:38 - 00000000 _____ C:\Recovery.txt
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\AppData\Local\Histórico
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão\AppData\Local\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Usuário Padrão
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Modelos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Menu Iniciar
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Documentos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Todos os Usuários
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Public\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Public\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Public\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Modelos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Meus Documentos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Menu Iniciar
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Configurações Locais
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\AppData\Local\Histórico
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\AppData\Local\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Ambiente de Rede
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default\Ambiente de Impressão
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\Documents\Minhas Músicas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\Documents\Minhas Imagens
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\Documents\Meus Vídeos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Histórico
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Modelos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programas
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Menu Iniciar
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Documentos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\ProgramData\Dados de Aplicativos
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Program Files\Common Files\Sistema
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Program Files\Arquivos Comuns
2015-07-03 01:39 - 2015-07-03 01:39 - 00000000 _SHDL C:\Arquivos de Programas
2015-06-26 09:49 - 2015-06-26 09:49 - 00293296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-06-16 15:55 - 2015-06-16 15:55 - 00259040 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2015-06-15 23:58 - 2015-06-15 23:58 - 00295400 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgwfpa.sys
2015-06-10 16:38 - 2015-06-10 16:38 - 00226784 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-07-07 23:33 - 2014-09-09 12:57 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-07-07 23:32 - 2014-03-18 07:07 - 01797166 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-07 23:32 - 2014-03-18 06:29 - 00774900 _____ C:\Windows\system32\prfh0416.dat
2015-07-07 23:32 - 2014-03-18 06:29 - 00158494 _____ C:\Windows\system32\prfc0416.dat
2015-07-07 23:28 - 2013-08-22 12:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-07 15:06 - 2014-09-09 12:32 - 01800503 _____ C:\Windows\WindowsUpdate.log
2015-07-07 11:45 - 2014-09-09 12:58 - 00000000 ____D C:\Users\Todos os Usuários\McAfee
2015-07-07 11:45 - 2014-09-09 12:58 - 00000000 ____D C:\ProgramData\McAfee
2015-07-07 11:02 - 2014-09-09 13:00 - 00000000 ____D C:\Program Files (x86)\Dell Backup and Recovery
2015-07-07 11:00 - 2014-09-09 12:58 - 00000000 ____D C:\Program Files\Common Files\mcafee
2015-07-07 11:00 - 2014-09-09 12:58 - 00000000 ____D C:\Program Files (x86)\McAfee
2015-07-07 10:59 - 2014-03-18 02:55 - 00013784 _____ C:\Windows\PFRO.log
2015-07-07 10:59 - 2013-08-22 11:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-07 10:57 - 2013-08-22 12:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2015-07-07 10:57 - 2013-08-22 10:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-05 09:43 - 2013-08-22 10:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-07-05 09:21 - 2013-08-22 11:46 - 00015225 _____ C:\Windows\setupact.log
2015-07-04 12:11 - 2013-08-22 12:36 - 00000000 ____D C:\Windows\AppReadiness
2015-07-04 11:43 - 2013-08-22 12:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-03 09:08 - 2014-09-09 16:34 - 00000000 ____D C:\Windows\Panther
2015-07-03 06:38 - 2013-08-22 12:36 - 00262144 _____ C:\Windows\system32\config\BCD-Template
2015-07-03 01:40 - 2013-08-22 12:36 - 00000000 ____D C:\Windows\rescache
2015-07-03 01:39 - 2013-08-22 12:36 - 00000000 ____D C:\Program Files\Windows NT
2015-07-03 01:39 - 2013-08-22 11:44 - 00345464 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-03 01:39 - 2013-08-22 10:36 - 00000000 __RHD C:\Users\Default
 
==================== Files in the root of some directories =======
 
2014-09-09 12:24 - 2014-09-09 12:24 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-09-09 12:45 - 2014-09-09 12:46 - 0000121 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2014-09-09 12:41 - 2014-09-09 12:42 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2014-09-09 12:42 - 2014-09-09 12:43 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2014-09-09 12:43 - 2014-09-09 12:45 - 0000108 _____ () C:\ProgramData\{B46BEA36-0B71-4A4E-AE41-87241643FA0A}.log
2014-09-09 12:41 - 2014-09-09 12:41 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
 
Some files in TEMP:
====================
C:\Users\lelezinha\AppData\Local\Temp\0068151436280336mcinst.exe
C:\Users\lelezinha\AppData\Local\Temp\AcDeltree.exe
C:\Users\lelezinha\AppData\Local\Temp\McCSPInstall.dll
C:\Users\lelezinha\AppData\Local\Temp\mccspuninstall.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-09-09 12:22
 
==================== End of log ============================

Attached Files



#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:12 PM

Posted 08 July 2015 - 07:43 AM

Looking good.

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#8 blindmetal

blindmetal
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:12 PM

Posted 08 July 2015 - 06:48 PM

:)

thank you very much!!



#9 nasdaq

nasdaq

  • Malware Response Team
  • 38,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:12 PM

Posted 09 July 2015 - 08:29 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users