7 min read
Hey there!
For the 3rd time in less than a month / two a virus seems to keep be infecting my pc.
I member of this website helped me out twice already but we couldn't find a solution to this problem and im kinda losing my hopes 
We thought the problem was solved but after like 5 days (today) the issue reappeared.
Hope someone else may have a clue about my case:
market ads and random tabs opening by themselves.
Hey again mister Ken (if im not mistaken ahah)
Well I would rather take your help, sometimes PT-PT can be tricky towards PT-BR and vice versa
Lets do this, download and install FRST, you need the 64 bit version BUT DONT RUN A SCAN YET
Please download Farbar Recovery Scan Tool and save it to your DESKTOP
Logs before chrome:
After Chrome:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-09-2016
Ran by [removed] (administrator) on LAPTOP-8E1TS1M5 (13-09-2016 18:58:09)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 10 Home (X64) Language: Português (Portugal)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
() C:\Program Files\AVAST Software\SecureLine\vpnsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIPFE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIPFE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIPFE.EXE
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Wi-Fi\Launcher.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040792 2015-07-06] (Realtek Semiconductor)
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1767944 2016-06-14] (NVIDIA Corporation)
HKLM-x32\…\Run: [MobileBroadband] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [69632 2012-03-20] (Vodafone)
HKLM-x32\…\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM-x32\…\Run: [VodafoneMobileWiFi] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Wi-Fi\Launcher.exe [145920 2014-03-11] (Vodafone)
HKLM-x32\…\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1087184 2016-01-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIPFE.EXE [417776 2014-11-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIPFE.EXE [417776 2014-11-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\Run: [EPLTarget\P0000000000000002] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIPFE.EXE [417776 2014-11-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {41aa1307-5d8b-11e6-9be6-54ab3a2c2168} - "E:\setup_vmb_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {e34076f6-5e42-11e6-9be8-54ab3a2c2168} - "D:\setup_vmb_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {e623694c-5e12-11e6-9be7-54ab3a2c2168} - "D:\SetupWi-Fi.exe"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {f130394a-4c8e-11e6-9bcd-3052cb5e098b} - "D:\setup_vmb_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {f1303a4b-4c8e-11e6-9bcd-3052cb5e098b} - "D:\setup_vmb_lite.exe" /checkApplicationPresence
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-06-27] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-06-27] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-06-27] (Acer Incorporated)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{1e8e9d5e-2b9c-4bf6-a51b-ef48487b130e}: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b}: [NameServer] 87.103.113.145 87.103.113.177
Tcpip\..\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{8834f845-ecd9-43d2-a855-73fe734e0741}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{ae3a38cb-4f1d-46c8-9663-cf415c79f774}: [NameServer] 87.103.113.145 87.103.113.177
ManualProxies:
Internet Explorer:
==================
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer15.msn.com/?pc=ACTE
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer15.msn.com/?pc=ACTE
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-07-20] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-20] (Oracle Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-18] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-18] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-20] (Oracle Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2016-05-23] ()
FF Extension: (Firefox Hotfix) - C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default\Extensions\[removed] [2016-08-31]
FF Extension: (Português (Portugal) Language Pack) - C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default\Extensions\[removed] [2016-09-01]
Chrome:
=======
CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-02]
CHR Extension: (Google Docs) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-02]
CHR Extension: (Google Drive) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-02]
CHR Extension: (YouTube) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-02]
CHR Extension: (Adblock Plus) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-09-02]
CHR Extension: (Google Sheets) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-02]
CHR Extension: (Google Docs Offline) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-02]
CHR Extension: (Video download helper) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\mngdadkapbemiekajhhalpakdpleogfn [2016-09-09]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-02]
CHR Extension: (Gmail) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-02]
CHR Extension: (Chrome Media Router) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-03]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [315472 2015-07-20] (Windows (R) Win 7 DDK provider)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2267352 2016-08-15] (Acer Incorporated)
S3 cplspcon; C:\Windows\system32\IntelCpHDCPSvc.exe [588904 2015-08-18] ()
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573568 2015-05-14] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [350064 2016-05-23] (WildTangent)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [350312 2015-08-18] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
R3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [207648 2015-08-14] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [401248 2015-09-04] (Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [453984 2015-09-04] (Acer Incorporated)
R2 SecureLine; C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe [592392 2016-07-17] ()
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [247040 2015-05-27] (acer)
R2 VmbService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [8704 2012-03-20] (Vodafone) [File not signed]
S3 vmicvss; C:\Windows\System32\ICSvc.dll [506880 2015-07-10] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24856 2016-08-03] (Microsoft Corporation)
S2 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]
S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\1.5.471.0\McCSPServiceHost.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 huawei_wwanecm; C:\Windows\System32\drivers\ew_juwwanecm.sys [227840 2012-03-16] (Huawei Technologies Co., Ltd.)
R3 iaLPSS2_I2C; C:\Windows\System32\drivers\iaLPSS2_I2C.sys [185128 2015-06-16] (Intel Corporation)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21344 2015-09-04] (Acer Incorporated)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-24] (Malwarebytes)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
S3 Qcamain; C:\Windows\System32\drivers\Qcamainx64.sys [2276352 2015-07-10] (Qualcomm Atheros, Inc.)
R3 Qcamain10x64; C:\Windows\system32\DRIVERS\Qcamain10x64.sys [2340240 2015-07-20] (Qualcomm Atheros, Inc.)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14688 2015-09-04] (Acer Incorporated)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [895256 2015-06-05] (Realtek )
R3 RTSUER; C:\Windows\system32\Drivers\RtsUer.sys [402136 2015-05-27] (Realsil Semiconductor Corporation)
R3 SGXEPC; C:\Windows\System32\drivers\sgx_driver.sys [54760 2016-07-22] (Windows (R) Win 7 DDK provider)
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [47784 2015-07-29] (Synaptics Incorporated)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-31] ()
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-09-13 18:57 - 2016-09-13 18:57 - 00016148 _____ C:\Windows\system32\LAPTOP-8E1TS1M5_Rafael Sobreiro_HistoryPrediction.bin
2016-09-13 18:49 - 2016-09-13 18:51 - 00041471 _____ C:\Users\Rafael Sobreiro\Desktop\Addition.txt
2016-09-13 18:48 - 2016-09-13 18:58 - 00019777 _____ C:\Users\Rafael Sobreiro\Desktop\FRST.txt
2016-09-13 18:46 - 2016-09-13 18:58 - 00000000 ____D C:\FRST
2016-09-13 18:46 - 2016-09-13 18:46 - 02398720 _____ (Farbar) C:\Users\Rafael Sobreiro\Desktop\FRST64.exe
2016-09-10 01:06 - 2016-09-10 01:06 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\PDF
2016-09-09 14:19 - 2016-09-09 14:19 - 00005988 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2288487360_spectate.bat
2016-09-08 23:29 - 2016-09-08 23:41 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\LocalLow\BitTorrent
2016-09-08 22:49 - 2016-09-08 22:49 - 00003021 _____ C:\Users\Rafael Sobreiro\Downloads\002 7 Audio (1).torrent
2016-09-08 22:49 - 2016-09-08 22:49 - 00000000 ____D C:\Users\Rafael Sobreiro\Downloads\002 7 Audio
2016-09-08 22:48 - 2016-09-08 22:48 - 00003021 _____ C:\Users\Rafael Sobreiro\Downloads\002 7 Audio.torrent
2016-09-08 22:47 - 2016-09-08 22:47 - 01934600 _____ (BitTorrent Inc.) C:\Users\Rafael Sobreiro\Downloads\BitTorrent (torrent,b.bittorrent.com^2Fb800e0).exe
2016-09-08 18:21 - 2016-09-08 18:21 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2833453605_spectate.bat
2016-09-08 18:16 - 2016-09-13 18:16 - 00000951 _____ C:\Windows\Tasks\EPSON XP-235 Series Update {AE01210B-99CB-43FA-9308-6C9A5E21D494}.job
2016-09-08 18:16 - 2016-09-08 18:16 - 00004148 _____ C:\Windows\System32\Tasks\EPSON XP-235 Series Update {AE01210B-99CB-43FA-9308-6C9A5E21D494}
2016-09-08 15:05 - 2016-09-08 15:08 - 82716613 _____ C:\Users\Rafael Sobreiro\Downloads\CC - Live at Reading & Leeds 2016.zip
2016-09-07 17:31 - 2016-09-07 17:31 - 00487807 _____ C:\Users\Rafael Sobreiro\Documents\E-Serviços%20ao%20Cidadão%20Académico.pdf.pdf
2016-09-07 17:30 - 2016-09-07 17:30 - 00316141 _____ C:\Users\Rafael Sobreiro\Documents\rptNotificacaoDocsEmFalta.pdf (2).pdf
2016-09-07 17:29 - 2016-09-07 17:29 - 00316141 _____ C:\Users\Rafael Sobreiro\Documents\rptNotificacaoDocsEmFalta.pdf.pdf
2016-09-07 17:29 - 2016-09-07 17:29 - 00316141 _____ C:\Users\Rafael Sobreiro\Documents\rptNotificacaoDocsEmFalta.pdf (1).pdf
2016-09-07 14:26 - 2016-09-07 14:26 - 00002265 _____ C:\Users\Rafael Sobreiro\Downloads\NotificacaoDocumentosEmFalta_20160907124604.PDF
2016-09-06 22:36 - 2016-09-06 22:36 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2830996581_spectate.bat
2016-09-05 12:44 - 2016-09-08 20:20 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Epson
2016-09-05 12:36 - 2016-09-13 18:36 - 00000951 _____ C:\Windows\Tasks\EPSON XP-235 Series Update {FB326052-AA28-4F72-A12C-3129D03BA244}.job
2016-09-05 12:36 - 2016-09-05 12:36 - 00004148 _____ C:\Windows\System32\Tasks\EPSON XP-235 Series Update {FB326052-AA28-4F72-A12C-3129D03BA244}
2016-09-05 12:35 - 2016-09-13 18:35 - 00000951 _____ C:\Windows\Tasks\EPSON XP-235 Series Update {4E92EF8E-2792-4348-85C3-7979FE897D63}.job
2016-09-05 12:35 - 2016-09-05 12:35 - 00004148 _____ C:\Windows\System32\Tasks\EPSON XP-235 Series Update {4E92EF8E-2792-4348-85C3-7979FE897D63}
2016-09-05 12:35 - 2016-09-05 12:35 - 00000000 ____D C:\Program Files\Common Files\EPSON
2016-09-05 12:31 - 2016-09-05 12:31 - 00000000 ____D C:\Program Files\EpsonNet
2016-09-05 12:30 - 2016-09-05 12:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2016-09-05 12:30 - 2016-09-05 12:43 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2016-09-05 12:30 - 2016-09-05 12:30 - 00001465 _____ C:\Users\Public\Desktop\Manuais EPSON.lnk
2016-09-05 12:30 - 2016-09-05 12:30 - 00000123 _____ C:\Users\Public\Desktop\Epson Connect Site.url
2016-09-05 12:29 - 2016-09-05 12:43 - 00000000 ____D C:\Program Files (x86)\epson
2016-09-05 12:29 - 2016-09-05 12:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2016-09-05 12:29 - 2016-09-05 12:29 - 00001011 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2016-09-05 12:29 - 2014-06-03 00:00 - 00472064 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll
2016-09-05 12:29 - 2014-03-05 04:06 - 00180224 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMBPFE.DLL
2016-09-05 12:29 - 2012-05-17 00:00 - 00144560 _____ (Seiko Epson Corporation) C:\Windows\system32\escsvc64.exe
2016-09-05 12:29 - 2011-03-15 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BPFE.DLL
2016-09-05 12:25 - 2016-09-05 12:35 - 00000000 ____D C:\ProgramData\Epson
2016-09-05 12:25 - 2016-09-05 12:25 - 08410048 _____ (SEIKO EPSON CORPORATION) C:\Users\Rafael Sobreiro\Downloads\Epson_XP-235_Series_EA_11_Web.EXE
2016-09-05 03:05 - 2016-09-05 03:05 - 00003460 _____ C:\Users\Rafael Sobreiro\AppData\Local\recently-used.xbel
2016-09-05 00:13 - 2016-09-05 00:13 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2828683892_spectate.bat
2016-09-04 03:35 - 2016-09-04 03:36 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2827215766_spectate.bat
2016-09-03 17:53 - 2016-09-03 17:53 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2826330583_spectate.bat
2016-09-03 12:56 - 2016-09-03 12:56 - 00000000 ____D C:\Windows\%LOCALAPPDATA%
2016-09-03 02:49 - 2016-09-03 02:49 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2825667539_spectate.bat
2016-09-03 02:32 - 2016-09-03 02:33 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2825657785_spectate.bat
2016-09-02 19:43 - 2016-09-02 19:43 - 00410521 _____ C:\Users\Rafael Sobreiro\Desktop\E-Serviços ao Cidadão Académico.pdf
2016-09-02 16:25 - 2016-09-13 18:57 - 00000944 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-09-02 16:25 - 2016-09-13 18:30 - 00000948 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-09-02 16:25 - 2016-09-02 16:25 - 01065376 _____ (Google Inc.) C:\Users\Rafael Sobreiro\Downloads\ChromeSetup(2).exe
2016-09-02 16:25 - 2016-09-02 16:25 - 00004006 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-09-02 16:25 - 2016-09-02 16:25 - 00003774 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-09-02 12:17 - 2016-09-02 12:17 - 00146422 _____ C:\Users\Rafael Sobreiro\Downloads\comprovativo_244085892.pdf
2016-09-01 01:21 - 2016-09-01 01:21 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822735307_spectate.bat
2016-08-31 23:57 - 2016-08-31 23:57 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822693542_spectate (1).bat
2016-08-31 23:31 - 2016-08-31 23:31 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822693542_spectate.bat
2016-08-31 22:45 - 2016-08-31 22:46 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822626074_spectate.bat
2016-08-31 22:23 - 2016-08-31 22:23 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822560201_spectate.bat
2016-08-31 18:27 - 2016-08-31 18:28 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822179117_spectate.bat
2016-08-31 18:03 - 2016-08-31 18:03 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822187480_spectate.bat
2016-08-31 17:38 - 2016-08-31 17:38 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822171447_spectate.bat
2016-08-31 17:00 - 2016-08-31 17:00 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822036968_spectate.bat
2016-08-31 16:49 - 2016-09-01 21:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-08-31 16:08 - 2016-08-31 16:09 - 01065376 _____ (Google Inc.) C:\Users\Rafael Sobreiro\Downloads\ChromeSetup (1).exe
2016-08-31 04:49 - 2016-08-31 04:49 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821299437_spectate (1).bat
2016-08-31 04:36 - 2016-08-31 04:36 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821299437_spectate.bat
2016-08-31 04:10 - 2016-08-31 04:11 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821299103_spectate.bat
2016-08-31 04:00 - 2016-08-31 04:00 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821289581_spectate.bat
2016-08-31 01:06 - 2016-06-14 21:01 - 00112216 _____ C:\Windows\system32\NvRtmpStreamer64.dll
2016-08-31 01:05 - 2016-08-31 01:05 - 00000000 ____D C:\Windows\LastGood
2016-08-31 01:05 - 2016-04-14 06:38 - 00102976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-08-30 23:57 - 2016-08-30 23:59 - 31930936 _____ (Adlice Software ) C:\Users\Rafael Sobreiro\Desktop\setup (1).exe
2016-08-29 20:33 - 2016-08-29 20:34 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2819425019_spectate.bat
2016-08-29 16:33 - 2016-08-29 16:33 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2818659478_spectate.bat
2016-08-29 16:01 - 2016-08-29 16:01 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2818655882_spectate.bat
2016-08-29 01:23 - 2016-08-29 01:23 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2818191346_spectate.bat
2016-08-28 21:57 - 2016-08-28 21:58 - 00005994 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2816732061_replay (1).bat
2016-08-28 21:14 - 2016-08-28 21:14 - 00005994 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2816732061_replay.bat
2016-08-28 20:35 - 2016-08-28 20:35 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2817808965_spectate.bat
2016-08-28 08:57 - 2016-08-28 08:58 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2816734419_spectate.bat
2016-08-27 14:51 - 2016-08-27 14:51 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2815579894_spectate.bat
2016-08-27 13:57 - 2016-08-27 13:59 - 129545180 _____ C:\Users\Rafael Sobreiro\Downloads\Crystal Castles Live @ Reading 2016.mp4
2016-08-25 21:53 - 2016-08-25 23:07 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\X
2016-08-25 21:22 - 2016-08-25 21:34 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\Omega Ruby
2016-08-25 20:56 - 2016-08-25 20:57 - 00005992 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2270917110_replay (1).bat
2016-08-25 19:54 - 2016-08-25 19:54 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2813287350_spectate.bat
2016-08-25 19:43 - 2016-08-25 19:43 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2813281988_spectate.bat
2016-08-25 19:30 - 2016-08-25 19:30 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2813245867_spectate.bat
2016-08-25 17:25 - 2016-08-25 17:25 - 00844597 _____ C:\Users\Rafael Sobreiro\Downloads\Forest Guardian Janna v1 (By Damonix).wxy
2016-08-25 15:41 - 2016-08-25 15:41 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812980127_spectate.bat
2016-08-25 15:02 - 2016-08-25 15:02 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812981339_spectate.bat
2016-08-25 14:51 - 2016-08-25 14:51 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812914913_spectate.bat
2016-08-25 13:23 - 2016-08-25 13:23 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812854945_spectate.bat
2016-08-25 12:31 - 2016-08-25 12:31 - 04914507 _____ C:\Users\Rafael Sobreiro\Downloads\Lime and Hot Pink v6.7 (By LoneOkami).wxy
2016-08-25 03:14 - 2016-08-25 03:15 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812218434_spectate.bat
2016-08-24 23:56 - 2016-08-24 23:57 - 00000000 ___HD C:\$WINDOWS.~BT
2016-08-24 19:47 - 2016-08-24 19:47 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2811841384_spectate.bat
2016-08-24 19:45 - 2016-08-24 19:45 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2811816176_spectate.bat
2016-08-24 18:30 - 2016-08-24 18:30 - 01085539 _____ C:\Users\Rafael Sobreiro\Downloads\ChampionSkinList.jpeg
2016-08-20 22:08 - 2016-08-20 22:08 - 00005992 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2270917110_replay.bat
2016-08-20 22:01 - 2016-08-20 22:01 - 00005992 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2271703264_replay.bat
2016-08-19 23:04 - 2016-08-19 23:08 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\Nova pasta
2016-08-18 13:51 - 2016-08-18 13:51 - 00005906 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268313055_replay (1).bat
2016-08-18 13:49 - 2016-08-18 13:49 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate (3).bat
2016-08-18 13:49 - 2016-08-18 13:49 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate (2).bat
2016-08-18 13:48 - 2016-08-18 13:48 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate (1).bat
2016-08-18 13:46 - 2016-08-18 13:47 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate.bat
2016-08-17 20:03 - 2016-08-17 20:04 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269331971_spectate.bat
2016-08-17 18:08 - 2016-08-17 18:08 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269294665_spectate.bat
2016-08-17 17:21 - 2016-08-17 17:22 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269282885_spectate.bat
2016-08-17 15:30 - 2016-08-17 16:56 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269207620_spectate.bat
2016-08-17 14:45 - 2016-08-17 14:46 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269225670_spectate.bat
2016-08-17 13:43 - 2016-08-17 13:43 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269224689_spectate.bat
2016-08-17 13:18 - 2016-08-17 13:52 - 106222323 _____ C:\Users\Rafael Sobreiro\Downloads\cc2016.rar
2016-08-16 22:41 - 2016-08-16 22:41 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268481313_spectate.bat
2016-08-16 22:03 - 2016-08-16 22:03 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268465687_spectate.bat
2016-08-16 21:30 - 2016-08-16 21:30 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268461836_spectate.bat
2016-08-16 20:34 - 2016-08-16 20:34 - 00005924 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268313055_replay.bat
2016-08-16 20:31 - 2016-08-16 20:32 - 00005924 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268247364_replay.bat
2016-08-16 13:39 - 2016-08-16 13:39 - 00003382 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task
2016-08-16 13:08 - 2016-08-16 13:09 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268247364_spectate.bat
2016-08-16 12:23 - 2016-08-16 12:29 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268256266_spectate.bat
2016-08-15 14:38 - 2016-09-05 03:05 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\gtk-2.0
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-09-13 18:57 - 2016-07-18 03:34 - 00000000 __SHD C:\Users\Rafael Sobreiro\IntelGraphicsProfiles
2016-09-13 18:57 - 2016-07-18 03:30 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-09-13 18:54 - 2016-07-17 18:55 - 00000000 ____D C:\Program Files (x86)\Google
2016-09-13 18:35 - 2016-07-17 19:55 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Skype
2016-09-13 13:11 - 2015-07-10 12:04 - 00000000 ___HD C:\Program Files\WindowsApps
2016-09-13 13:11 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\AppReadiness
2016-09-13 13:07 - 2016-07-18 03:35 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\Packages
2016-09-13 13:06 - 2016-07-17 20:04 - 00004204 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{82888F8C-4B09-44AD-BA85-C62F95B6D1F6}
2016-09-12 22:22 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\system32\NDF
2016-09-12 15:55 - 2015-12-22 20:42 - 00795894 _____ C:\Windows\system32\prfh0816.dat
2016-09-12 15:55 - 2015-12-22 20:42 - 00156194 _____ C:\Windows\system32\prfc0816.dat
2016-09-12 15:55 - 2015-08-31 12:01 - 01827502 _____ C:\Windows\system32\PerfStringBackup.INI
2016-09-12 15:55 - 2015-07-10 12:02 - 00000000 ____D C:\Windows\INF
2016-09-12 03:06 - 2016-08-01 22:43 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\CrashDumps
2016-09-10 21:41 - 2016-07-24 22:30 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Audacity
2016-09-09 18:25 - 2016-07-18 03:34 - 00000000 ____D C:\Users\Rafael Sobreiro
2016-09-09 14:44 - 2016-07-19 21:48 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Foxit Software
2016-09-08 14:54 - 2015-08-31 11:50 - 00004252 _____ C:\Windows\System32\Tasks\avast! SL Update
2016-09-05 17:14 - 2016-08-12 15:01 - 00000794 _____ C:\DelFix.txt
2016-09-05 12:43 - 2015-12-22 13:40 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-09-05 04:56 - 2016-08-13 21:38 - 00000000 ____D C:\Users\Rafael Sobreiro\.gimp-2.8
2016-09-04 16:04 - 2016-07-25 05:43 - 00000000 ____D C:\Wooxy
2016-09-03 17:27 - 2015-07-10 13:21 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-09-03 12:57 - 2015-07-10 10:05 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-09-01 21:25 - 2015-08-31 11:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-08-31 15:57 - 2015-08-31 11:50 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-08-31 15:57 - 2015-08-31 11:50 - 00000000 ____D C:\Program Files (x86)\WildGames
2016-08-31 01:06 - 2016-07-18 03:34 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\NVIDIA Corporation
2016-08-31 01:06 - 2016-07-18 03:34 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\NVIDIA
2016-08-31 01:06 - 2015-12-22 13:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-08-31 00:21 - 2016-08-11 02:53 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-31 00:00 - 2016-08-11 02:54 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-08-31 00:00 - 2016-08-11 02:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-29 02:20 - 2016-08-12 04:19 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\azx
2016-08-25 23:44 - 2016-07-19 03:43 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\ElevatedDiagnostics
2016-08-24 23:58 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2016-08-24 23:57 - 2015-08-31 12:45 - 00000000 ____D C:\Windows\Panther
2016-08-24 11:36 - 2016-08-08 16:51 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-18 11:36 - 2016-07-19 04:05 - 00003508 _____ C:\Windows\System32\Tasks\BacKGroundAgent
2016-08-18 11:36 - 2015-08-31 12:43 - 00000000 ___HD C:\OEM
2016-08-18 11:36 - 2015-08-31 11:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2016-08-18 11:34 - 2016-07-18 03:37 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\clear.fi
2016-08-17 15:02 - 2016-07-17 19:55 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-08-17 15:02 - 2016-07-17 19:55 - 00000000 ____D C:\ProgramData\Skype
2016-08-16 13:39 - 2016-07-18 03:38 - 00002401 _____ C:\Users\Rafael Sobreiro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-08-16 13:39 - 2016-07-18 03:38 - 00000000 ___RD C:\Users\Rafael Sobreiro\OneDrive
==================== Files in the root of some directories =======
2016-09-05 03:05 - 2016-09-05 03:05 - 0003460 _____ () C:\Users\Rafael Sobreiro\AppData\Local\recently-used.xbel
2012-03-16 14:55 - 2012-03-16 14:55 - 0286678 ____R () C:\ProgramData\DeviceManager.xml.rc4
2015-12-22 13:42 - 2015-12-22 13:42 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-09-08 23:18
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2016
Ran by [removed] (13-09-2016 18:59:17)
Running from C:\Users\[removed]\Desktop
Windows 10 Home (X64) (2016-07-18 02:29:27)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrador (S-1-5-21-1796416936-1353488523-4272779061-500 - Administrator - Disabled)
Convidado (S-1-5-21-1796416936-1353488523-4272779061-501 - Limited - Disabled)
DefaultAccount (S-1-5-21-1796416936-1353488523-4272779061-503 - Limited - Disabled)
Rafael Sobreiro (S-1-5-21-1796416936-1353488523-4272779061-1001 - Administrator - Enabled) => C:\Users\Rafael Sobreiro
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
abFiles (HKLM-x32\…\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.03.2003 - Acer Incorporated)
abPhoto (HKLM-x32\…\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 3.08.2003.3 - Acer Incorporated)
Acer Care Center (HKLM\…\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3005 - Acer Incorporated)
Acer Explorer Agent (HKLM\…\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3001 - Acer Incorporated)
Acer Portal (HKLM-x32\…\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.11.2000 - Acer Incorporated)
Acer Power Management (HKLM\…\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8109 - Acer Incorporated)
Acer Quick Access (HKLM\…\{E3678E72-78E3-4F91-A9FB-913876FF6DA2}) (Version: 2.00.3008 - Acer Incorporated)
Acer UEIP Framework (HKLM\…\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 2.01.3002 - Acer Incorporated)
Actualizações da NVIDIA 2.11.4.0 (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Adobe Flash Player 22 NPAPI (HKLM-x32\…\Adobe Flash Player NPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)
AOP Framework (HKLM-x32\…\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.22.2000.2 - Acer Incorporated)
Audacity 2.0 (HKLM-x32\…\Audacity_is1) (Version: - Audacity Team)
Avast SecureLine (HKLM\…\{2CD3C92F-EDC5-4B02-9B0A-9C1D37C58EF5}_is1) (Version: 1.0.239.4 - AVAST Software)
DriverSetupUtility (HKLM\…\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3011 - Acer Incorporated)
Epson Event Manager (HKLM-x32\…\{9F205E94-9E42-4486-A92A-DF3F6CB85444}) (Version: 3.10.0061 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\…\EPSON Scanner) (Version: - Seiko Epson Corporation)
Epson Software Updater (HKLM-x32\…\{6DBD132B-7F42-4594-BBE7-0BB677EB2926}) (Version: 4.4.2 - SEIKO EPSON CORPORATION)
EPSON XP-235 Series Printer Uninstall (HKLM\…\EPSON XP-235 Series) (Version: - Seiko Epson Corporation)
EpsonNet Print (HKLM\…\{0CB4EF8E-EE5B-49F6-8376-A702C222D6DA}) (Version: 3.1.3.0 - SEIKO EPSON Corporation)
Foxit PhantomPDF (HKLM-x32\…\{A4023BDF-82D5-412D-9D58-8C2819EBFE2E}) (Version: 7.0.410.326 - Foxit Software Inc.)
Game Explorer Categories - genres (HKLM-x32\…\WildTangentGameProvider-acer-genres) (Version: 13.0.0.6 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\…\WildTangentGameProvider-acer-main) (Version: 13.0.0.6 - WildTangent, Inc.)
GIMP 2.8.18 (HKLM\…\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Intel(R) Management Engine Components (HKLM\…\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1163 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\…\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.15.4248 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\…\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.2.1088 - Intel Corporation)
Intel(R) Serial IO (HKLM\…\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1519.7 - Intel Corporation)
Intel® Security Assist (HKLM-x32\…\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Java 8 Update 101 (HKLM-x32\…\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Jewel Match Snowscapes (HKLM-x32\…\WTA-ad853ef4-00ea-4eae-8b6e-18dee9cd5722) (Version: 3.0.2.118 - WildTangent)
League of Legends (HKLM-x32\…\League of Legends 4.1.2) (Version: 4.1.2 - Riot Games)
League of Legends (x32 Version: 4.1.2 - Riot Games) Hidden
Magic Academy (HKLM-x32\…\WTA-4c57b906-a5ca-4c03-9798-68e13f3261f1) (Version: 2.2.0.97 - WildTangent)
Malwarebytes Anti-Malware versão 2.2.1.1043 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Manuais EPSON (HKLM-x32\…\{84CECC1B-21EF-41B1-9A91-3E724E5D99D3}) (Version: 1.52.0.0 - SEIKO EPSON CORPORATION)
Microsoft Office (HKLM-x32\…\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\…\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\…\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 47.0.1 (x86 en-US) (HKLM-x32\…\Mozilla Firefox 47.0.1 (x86 en-US)) (Version: 47.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\…\MozillaMaintenanceService) (Version: 47.0.1.6018 - Mozilla)
NVIDIA Controlador gráfico 353.54 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.54 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.11.4.0 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.0 - NVIDIA Corporation)
NVIDIA O software do sistema PhysX 9.15.0428 (HKLM\…\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Painel de controlo da NVIDIA 353.54 (Version: 353.54 - NVIDIA Corporation) Hidden
Polar Bowler 1st Frame (HKLM-x32\…\WTA-d421feba-0407-4288-b40c-de6252d31e83) (Version: 3.0.2.59 - WildTangent)
Qualcomm Atheros QCA9377 Wireless LAN & Bluetooth Installer (HKLM-x32\…\{3241744A-BA36-41F0-B4AA-EF3946D00632}) (Version: 11.0.0.067 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\…\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7553 - Realtek Semiconductor Corp.)
Revo Uninstaller Pro 3.1.6 (HKLM\…\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.6 - VS Revo Group, Ltd.)
RogueKiller versão 12 (HKLM\…\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12 - Adlice Software)
Rory's Restaurant (HKLM-x32\…\WTA-6e35cc10-c9f5-48e9-baf9-e03aec7ff14d) (Version: 3.0.2.126 - WildTangent)
Runefall (HKLM-x32\…\WTA-4527bc60-c537-4ef8-8c87-cc9539bb1241) (Version: 3.0.2.126 - WildTangent)
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Skype™ 7.26 (HKLM-x32\…\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
Software de Dispositivos Chipset Intel® (x32 Version: 10.1.1.8 - Intel(R) Corporation) Hidden
Tweaking.com - Registry Backup (HKLM-x32\…\Tweaking.com - Registry Backup) (Version: 3.5.0 - Tweaking.com)
Update Installer for WildTangent Games App (HKLM-x32\…\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent)
Vegas World (HKLM-x32\…\WildTangentGDF-acer-vegasworld) (Version: 13.0.0.6 - WildTangent)
Villagers and Heroes (HKLM-x32\…\WildTangentGDF-acer-villagersandheroes) (Version: 13.0.0.6 - WildTangent)
Vodafone Mobile Broadband (HKLM-x32\…\{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}) (Version: 10.3.203.38322 - Vodafone)
Vodafone Wi-Fi (HKLM-x32\…\{F08DBC61-FBFC-4D26-997F-74B42C51DC56}) (Version: 2.0.9.48121 - Vodafone)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HKLM-x32\…\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-acer) (Version: 4.0.11.16 - WildTangent)
WildTangent Games App (x32 Version: 4.1.1.14 - WildTangent) Hidden
Wooxy version 1.5.0.0 (HKLM-x32\…\{C183CD14-47D8-4F98-AF06-4744CB834C8E}_is1) (Version: 1.5.0.0 - Chewy)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1796416936-1353488523-4272779061-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileCoAuth.exe (Microsoft Corporation)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {07B57DE5-DE93-408F-92A9-AB3454AD96F6} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2015-05-14] (Acer Incorporated)
Task: {085612BF-12A8-4F89-BEBB-2F10B15BF8DF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-02] (Google Inc.)
Task: {0E1A8D1A-97EB-4103-A696-143D6AE21958} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-02] (Google Inc.)
Task: {2DDAEB9B-5BA2-4EAF-8223-956FDA7FBF4C} - System32\Tasks\Power Button => C:\Program Files\Acer\Acer Power Management\ePowerButton_NB.exe [2015-05-14] (Acer Incorporated)
Task: {38BB970B-D059-4F94-A260-4931A479E5FD} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2016-06-27] (Acer)
Task: {3F6E048D-6404-433B-8F5F-CFF4D89BF89E} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Rundll32.exe generaltel.dll,RunTelemetryW
Task: {6A1AECEC-0766-473B-AE79-EAAA31DE758F} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2015-07-10] ()
Task: {6A250F7B-4F8A-4FEA-8CAE-31F28DA85202} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [2015-07-10] ()
Task: {6C8F889A-CE0E-4157-BB8F-CE973725B356} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2015-03-14] (Microsoft Corporation)
Task: {732BBB64-7E11-4644-B7F1-01B915F4C140} - System32\Tasks\EPSON XP-235 Series Update {AE01210B-99CB-43FA-9308-6C9A5E21D494} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {93C99DC9-B400-40D5-A6DF-4310EAF3F1A6} - System32\Tasks\Avast SecureLine => C:\Program Files\AVAST Software\SecureLine\SecureLine.exe [2016-07-17] (AVAST Software)
Task: {94EF5E01-BF92-4181-B102-0334B9B5A30C} - System32\Tasks\EPSON XP-235 Series Update {4E92EF8E-2792-4348-85C3-7979FE897D63} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {AA40C6BE-22D4-4C7A-8F46-D6A642B2F5D7} - System32\Tasks\EPSON XP-235 Series Update {FB326052-AA28-4F72-A12C-3129D03BA244} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPFE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {BC4BCF21-2562-4729-9FE3-2EB507B9BE36} - System32\Tasks\OneDrive Standalone Update Task => C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\OneDriveStandaloneUpdater.exe [2016-08-16] (Microsoft Corporation)
Task: {CB0DC988-9DF5-4498-82EF-E861DE3E9EF9} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2015-09-04] (Acer Incorporated)
Task: {D580BF3C-83CE-4E6B-B1A1-20EB95353BC4} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-13] (TODO: )
Task: {E0C21389-EC01-402F-A776-C3731FA73825} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2016-07-17] (AVAST Software)
Task: {E6916FAB-2ABC-47BC-A7E6-F5AC64698847} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [2016-08-15] (Acer Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\EPSON XP-235 Series Update {4E92EF8E-2792-4348-85C3-7979FE897D63}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPFE.EXE:/EXE:{4E92EF8E-2792-4348-85C3-7979FE897D63} /F:Update WORKGROUP\LAPTOP-8E1TS1M5$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\EPSON XP-235 Series Update {AE01210B-99CB-43FA-9308-6C9A5E21D494}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPFE.EXE:/EXE:{AE01210B-99CB-43FA-9308-6C9A5E21D494} /F:Update WORKGROUP\LAPTOP-8E1TS1M5$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\EPSON XP-235 Series Update {FB326052-AA28-4F72-A12C-3129D03BA244}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSPFE.EXE:/EXE:{FB326052-AA28-4F72-A12C-3129D03BA244} /F:Update WORKGROUP\LAPTOP-8E1TS1M5$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-12-22 21:03 - 2015-12-22 21:03 - 00032768 _____ () C:\Windows\SYSTEM32\licensemanagerapi.dll
2015-12-22 21:03 - 2015-12-22 21:03 - 00404480 _____ () C:\Windows\System32\diagtrack_wininternal.dll
2016-07-17 23:51 - 2016-07-17 23:52 - 00592392 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
2016-08-31 01:05 - 2016-06-14 21:03 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2015-12-22 13:54 - 2015-07-13 18:37 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-08-09 18:47 - 2016-08-03 06:44 - 02495776 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-08-09 18:47 - 2016-08-03 06:44 - 02495776 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-08-16 13:38 - 2016-08-16 13:38 - 01864384 _____ () C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll
2015-09-14 10:37 - 2015-08-18 23:54 - 00395368 _____ () C:\Windows\system32\igfxTray.exe
2016-08-09 18:47 - 2015-09-17 06:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-08-09 18:47 - 2016-08-03 05:34 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-08-09 18:48 - 2015-11-25 05:17 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-08-09 18:47 - 2016-08-03 05:31 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-08-09 18:47 - 2015-09-17 06:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-22 13:41 - 2015-02-08 20:18 - 00124440 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
2016-08-31 01:05 - 2016-06-14 21:03 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-08-31 01:05 - 2016-06-14 21:03 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2015-08-14 03:17 - 2015-08-14 03:17 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-12-22 13:54 - 2016-06-14 21:03 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-08-16 13:38 - 2016-08-16 13:38 - 01383616 _____ () C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\ClientTelemetry.dll
2016-08-16 13:38 - 2016-08-16 13:38 - 00118976 _____ () C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncViews.dll
2012-03-20 13:08 - 2012-03-20 13:08 - 00396800 _____ () C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\Vodafone.View.Taskbar.dll
2016-06-27 16:12 - 2016-06-27 16:12 - 00202456 _____ () C:\Program Files (x86)\Acer\Acer Portal\curllib.dll
2016-06-27 16:12 - 2016-06-27 16:12 - 00119000 _____ () C:\Program Files (x86)\Acer\Acer Portal\OpenLDAP.dll
2016-07-18 00:00 - 2016-07-18 00:00 - 38907672 _____ () C:\Program Files\AVAST Software\SecureLine\libcef.dll
2016-08-15 18:03 - 2016-08-15 18:03 - 00202456 _____ () C:\Program Files (x86)\Acer\abPhoto\curllib.dll
2016-08-15 18:05 - 2016-08-15 18:05 - 00654000 _____ () C:\Program Files (x86)\Acer\abPhoto\sqlite3.dll
2016-08-15 18:05 - 2016-08-15 18:05 - 00641240 _____ () C:\Program Files (x86)\Acer\abPhoto\tag.dll
2016-08-15 18:04 - 2016-08-15 18:04 - 00119000 _____ () C:\Program Files (x86)\Acer\abPhoto\OpenLDAP.dll
2016-08-18 11:36 - 2016-08-18 11:36 - 00015064 _____ () C:\Windows\assembly\GAC_MSIL\MyService\1.0.0.1__2dfa3f50f0bed57d\MyService.dll
2016-08-15 14:36 - 2016-08-15 14:36 - 00013016 _____ () C:\Program Files (x86)\Acer\AOP Framework\ServiceInterface.dll
2016-08-15 14:33 - 2016-08-15 14:33 - 00277856 _____ () C:\Program Files (x86)\Acer\AOP Framework\libcurl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2015-07-10 12:04 - 2016-09-02 16:19 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Rafael Sobreiro\Downloads\traditional__karma_splash_art_by_dbr01-d8w5nrw.png
DNS Servers: [removed]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{47DCA9E8-956B-4F2C-9294-4A0A50D6EC8A}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{D58377B0-F3E6-4D54-A4FD-62D56A9BA27D}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{53D74214-AC4C-49DB-A776-AF915F466E31}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [{4A6244BC-DE14-42E9-A6A6-15B9D3EE81B7}] => (Allow) C:\Riot Games\League of Legends\lol.launcher.admin.exe
FirewallRules: [TCP Query User{519263B1-D027-42E7-9CA0-DC995E5CAECC}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{5601755B-4728-4D28-A376-04E0985D00AB}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{EA1DD956-888A-444B-AC18-5F659F52837E}] => (Allow) %systemroot%\system32\alg.exe
FirewallRules: [{D23A286F-4A7E-47D9-846D-408441A83035}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{28EE6B79-ADA0-46F3-994C-DA5BCC6C2495}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{950567F5-2E18-42EF-BF21-68CE73F40824}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{689784FF-4DC3-433A-B40E-A0F0CB5F23CA}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{9D187EE6-5870-4349-A062-1BA556CFB26A}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{AD0F1D36-4753-4974-8A71-4E11BD121BFF}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{43C74F18-CC01-4C93-B419-DFD5BA5A5D0C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E0D2360E-7C64-43EC-BC3A-E04E2ED6C2B8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5BAA4A30-6C3B-4A10-B793-35A63BE82FDF}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{D0162B1B-3D78-4D75-9DC4-AA2C07AC0D0A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{6FCABF6D-B075-4568-8918-6C9A368452F6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{5293C56A-312C-451F-958A-4C991766A6F6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{E2708970-C709-4FBA-8212-FC3E1094249B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{7CECEE67-E8AC-44D0-8E3D-31429CE04622}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{68FC9D30-2C03-492D-A7AF-1F51148A1453}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{2B95FB17-CCDE-4670-B5DC-9E511FB93689}] => (Allow) C:\Users\Rafael Sobreiro\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{3E0EA6B1-B961-4C0D-96D3-0A02CB1DB8D1}] => (Allow) C:\Users\Rafael Sobreiro\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{48C1AC4B-44B9-4C4D-97CF-2C016147CAEE}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{16B7791D-3C82-409A-BE34-19FBD38DA988}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
==================== Restore Points =========================
18-08-2016 18:00:47 Ponto de Verificação Agendado
31-08-2016 14:51:38 Restore Point Created by FRST
02-09-2016 16:18:37 Restore Point Created by FRST
05-09-2016 12:43:15 Installed Epson Event Manager
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/13/2016 07:00:00 PM) (Source: ESENT) (EventID: 476) (User: )
Description: svchost (1484) SRUJet: Falha na verificação da página da base de dados lida a partir do ficheiro "C:\Windows\system32\SRU\SRUDB.dat" no deslocamento 17965056 (0x0000000001122000) (página da base de dados 4385 (0x1121)) para 4096 (0x00001000) bytes porque não contém dados de página. A operação de leitura irá falhar com o erro -1019 (0xfffffc05). Se esta condição persistir, efetue o restauro da base de dados a partir de uma cópia de segurança anterior. Este problema deve-se provavelmente a uma falha de hardware. Contacte o fabricante do hardware para obter mais ajuda no diagnóstico deste problema.
Error: (09/13/2016 07:00:00 PM) (Source: ESENT) (EventID: 447) (User: )
Description: svchost (1484) SRUJet: Foi detetada uma ligação de página incorreta (erro -338) numa Árvore B (ObjectId: 30, PgnoRoot: 225) da base de dados C:\Windows\system32\SRU\SRUDB.dat (225 => 3871, 3872).
Error: (09/13/2016 06:59:00 PM) (Source: ESENT) (EventID: 476) (User: )
Description: svchost (1484) SRUJet: Falha na verificação da página da base de dados lida a partir do ficheiro "C:\Windows\system32\SRU\SRUDB.dat" no deslocamento 17965056 (0x0000000001122000) (página da base de dados 4385 (0x1121)) para 4096 (0x00001000) bytes porque não contém dados de página. A operação de leitura irá falhar com o erro -1019 (0xfffffc05). Se esta condição persistir, efetue o restauro da base de dados a partir de uma cópia de segurança anterior. Este problema deve-se provavelmente a uma falha de hardware. Contacte o fabricante do hardware para obter mais ajuda no diagnóstico deste problema.
Error: (09/13/2016 06:59:00 PM) (Source: ESENT) (EventID: 447) (User: )
Description: svchost (1484) SRUJet: Foi detetada uma ligação de página incorreta (erro -338) numa Árvore B (ObjectId: 30, PgnoRoot: 225) da base de dados C:\Windows\system32\SRU\SRUDB.dat (225 => 3871, 3872).
Error: (09/13/2016 06:58:01 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: O procedimento Open para o serviço "WmiApRpl" na DLL "C:\Windows\system32\wbem\wmiaprpl.dll" falhou. Os dados de desempenho para este serviço não estarão disponíveis. Os primeiros quatro bytes (DWORD) da secção Data contêm o código de erro.
Error: (09/13/2016 06:58:01 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: O Windows não consegue carregar a DLL de contador extensível rdyboost. Os primeiros quatro bytes (DWORD) da secção Data contêm o código de erro do Windows.
Error: (09/13/2016 06:58:01 PM) (Source: PerfNet) (EventID: 2004) (User: )
Description: Não foi possível abrir o objeto de desempenho do serviço de servidor. Os primeiros quatro bytes (DWORD) na secção de dados contém o código de estado.
Error: (09/13/2016 06:58:01 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: O procedimento Open para o serviço "MSDTC" na DLL "C:\Windows\system32\msdtcuiu.DLL" falhou. Os dados de desempenho para este serviço não estarão disponíveis. Os primeiros quatro bytes (DWORD) da secção Data contêm o código de erro.
Error: (09/13/2016 06:58:01 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: O procedimento Open para o serviço "Lsa" na DLL "C:\Windows\System32\Secur32.dll" falhou. Os dados de desempenho para este serviço não estarão disponíveis. Os primeiros quatro bytes (DWORD) da secção Data contêm o código de erro.
Error: (09/13/2016 06:58:01 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: O procedimento Open para o serviço "ESENT" na DLL "C:\Windows\system32\esentprf.dll" falhou. Os dados de desempenho para este serviço não estarão disponíveis. Os primeiros quatro bytes (DWORD) da secção Data contêm o código de erro.
System errors:
=============
Error: (09/13/2016 06:55:20 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP-8E1TS1M5)
Description: O servidor {9BA05972-F6A8-11CF-A442-00A0C90A8F39} não foi registado no DCOM dentro do tempo limite necessário.
Error: (09/13/2016 06:55:20 PM) (Source: DCOM) (EventID: 10010) (User: LAPTOP-8E1TS1M5)
Description: O servidor {9BA05972-F6A8-11CF-A442-00A0C90A8F39} não foi registado no DCOM dentro do tempo limite necessário.
Error: (09/13/2016 06:55:20 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Foi atingido o tempo limite (30000 milissegundos) ao aguardar pela ligação do serviço Anfitrião de Sincronização_Session15.
Error: (09/13/2016 06:55:20 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Foi atingido o tempo limite (30000 milissegundos) ao aguardar pela ligação do serviço Armazenamento de Dados do Utilizador_Session15.
Error: (09/13/2016 06:55:19 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: O gestor de controlo de serviços tentou efetuar uma ação corretiva (Reiniciar o serviço) após a terminação inesperada do serviço Armazenamento de Dados do Utilizador_Session15, mas esta ação falhou com o seguinte erro:
Já existe uma instância do serviço em execução.
Error: (09/13/2016 06:55:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: O serviço Acesso a Dados do Utilizador_Session15 terminou inesperadamente. Já o fez 1 vez(es). Será efetuada a seguinte ação corretiva em 10000 milissegundos: Reiniciar o serviço.
Error: (09/13/2016 06:55:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: O serviço Armazenamento de Dados do Utilizador_Session15 terminou inesperadamente. Já o fez 1 vez(es). Será efetuada a seguinte ação corretiva em 10000 milissegundos: Reiniciar o serviço.
Error: (09/13/2016 06:55:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: O serviço Dados de Contacto_Session15 terminou inesperadamente. Já o fez 1 vez(es). Será efetuada a seguinte ação corretiva em 10000 milissegundos: Reiniciar o serviço.
Error: (09/13/2016 06:55:09 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: O serviço Anfitrião de Sincronização_Session15 terminou inesperadamente. Já o fez 1 vez(es). Será efetuada a seguinte ação corretiva em 10000 milissegundos: Reiniciar o serviço.
Error: (09/13/2016 03:43:33 AM) (Source: DCOM) (EventID: 10010) (User: LAPTOP-8E1TS1M5)
Description: O servidor {9BA05972-F6A8-11CF-A442-00A0C90A8F39} não foi registado no DCOM dentro do tempo limite necessário.
CodeIntegrity:
===================================
Date: 2016-09-03 17:44:00.102
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-02 16:36:50.653
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-09-01 19:17:56.103
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-31 19:52:22.037
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-30 19:32:55.878
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-22 19:32:40.282
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-19 16:21:18.975
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-14 16:00:52.142
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-13 18:53:24.724
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-08-12 18:00:23.017
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-6500U CPU @ 2.50GHz
Percentage of memory in use: 26%
Total physical RAM: 7946.59 MB
Available physical RAM: 5857.12 MB
Total Virtual: 21208.09 MB
Available Virtual: 18522.8 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:930.91 GB) (Free:854.23 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 2CECD241)
Partition: GPT.
==================== End of Addition.txt ============================
I'm a little confused here, did you or did you not reinstall Chome, because I asked you to download FRST, dont run it yet, Uninstall Chome and run FRST but at this point not to reinstall Chome
I did run the program with chrome installed and then without it installed
right now im on Mozilla
OK, thanks for clearing that up
Start CloseProcesses: CreateRestorePoint: CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-02] CHR Extension: (Google Docs) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-02] CHR Extension: (Google Drive) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-02] CHR Extension: (YouTube) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-02] CHR Extension: (Adblock Plus) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-09-02] CHR Extension: (Google Sheets) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-02] CHR Extension: (Google Docs Offline) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-02] CHR Extension: (Video download helper) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\mngdadkapbemiekajhhalpakdpleogfn [2016-09-09] CHR Extension: (Chrome Web Store Payments) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-02] CHR Extension: (Gmail) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-02] CHR Extension: (Chrome Media Router) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-03] 2016-09-08 23:29 - 2016-09-08 23:41 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\LocalLow\BitTorrent 2016-09-08 22:49 - 2016-09-08 22:49 - 00003021 _____ C:\Users\Rafael Sobreiro\Downloads\002 7 Audio (1).torrent 2016-09-08 22:48 - 2016-09-08 22:48 - 00003021 _____ C:\Users\Rafael Sobreiro\Downloads\002 7 Audio.torrent 2016-09-08 22:47 - 2016-09-08 22:47 - 01934600 _____ (BitTorrent Inc.) C:\Users\Rafael Sobreiro\Downloads\BitTorrent (torrent,b.bittorrent.com^2Fb800e0).exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe CMD: ipconfig /flushdns Hosts: EmptyTemp: Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f End
There it is:
Fix result of Farbar Recovery Scan Tool (x64) Version: 12-09-2016
Ran by [removed] (13-09-2016 21:55:15) Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-02]
CHR Extension: (Google Docs) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-02]
CHR Extension: (Google Drive) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-02]
CHR Extension: (YouTube) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-02]
CHR Extension: (Adblock Plus) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-09-02]
CHR Extension: (Google Sheets) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-02]
CHR Extension: (Google Docs Offline) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-02]
CHR Extension: (Video download helper) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\mngdadkapbemiekajhhalpakdpleogfn [2016-09-09]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-02]
CHR Extension: (Gmail) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-02]
CHR Extension: (Chrome Media Router) - C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-03]
2016-09-08 23:29 - 2016-09-08 23:41 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\LocalLow\BitTorrent
2016-09-08 22:49 - 2016-09-08 22:49 - 00003021 _____ C:\Users\Rafael Sobreiro\Downloads\002 7 Audio (1).torrent
2016-09-08 22:48 - 2016-09-08 22:48 - 00003021 _____ C:\Users\Rafael Sobreiro\Downloads\002 7 Audio.torrent
2016-09-08 22:47 - 2016-09-08 22:47 - 01934600 _____ (BitTorrent Inc.) C:\Users\Rafael Sobreiro\Downloads\BitTorrent (torrent,b.bittorrent.com^2Fb800e0).exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
End
*****************
Processes closed successfully.
Restore point was successfully created.
CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default => Error: No automatic fix found for this entry.
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\mngdadkapbemiekajhhalpakdpleogfn => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia => moved successfully
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm => moved successfully
C:\Users\Rafael Sobreiro\AppData\LocalLow\BitTorrent => moved successfully
C:\Users\Rafael Sobreiro\Downloads\002 7 Audio (1).torrent => moved successfully
C:\Users\Rafael Sobreiro\Downloads\002 7 Audio.torrent => moved successfully
C:\Users\Rafael Sobreiro\Downloads\BitTorrent (torrent,b.bittorrent.com^2Fb800e0).exe => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => not found.
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========
A opera‡Æo foi conclu¡da com ˆxito.
========= End of Reg: =========
========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========
A opera‡Æo foi conclu¡da com ˆxito.
========= End of Reg: =========
=========== EmptyTemp: ==========
BITS transfer queue => 301916 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 28570701 B
Java, Flash, Steam htmlcache => 1096 B
Windows/system/drivers => 2066014 B
Edge => 1874979 B
Chrome => 812750495 B
Firefox => 190526292 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 0 B
NetworkService => 0 B
Rafael Sobreiro => 480823844 B
RecycleBin => 9682829 B
EmptyTemp: => 1.4 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 21:57:05 ====
Post a new FRST log, I dont need to see Additions, just FRST
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-09-2016
Ran by [removed] (administrator) on LAPTOP-8E1TS1M5 (13-09-2016 22:19:14)
Running from C:\Users\[removed]\Desktop
[removed]
Platform: Windows 10 Home (X64) Language: Português (Portugal)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files\AVAST Software\SecureLine\vpnsvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Wi-Fi\Launcher.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6004.42261.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6004.42261.0_x64__8wekyb3d8bbwe\HxMail.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\SecureLine\secureline.exe
(Acer) C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe
(Acer Cloud Technology) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerButton_NB.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\…\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040792 2015-07-06] (Realtek Semiconductor)
HKLM\…\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\…\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1767944 2016-06-14] (NVIDIA Corporation)
HKLM-x32\…\Run: [MobileBroadband] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [69632 2012-03-20] (Vodafone)
HKLM-x32\…\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM-x32\…\Run: [VodafoneMobileWiFi] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Wi-Fi\Launcher.exe [145920 2014-03-11] (Vodafone)
HKLM-x32\…\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1087184 2016-01-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.5892.0626"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\RunOnce: [Uninstall C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rafael Sobreiro\AppData\Local\Microsoft\OneDrive\17.3.6390.0509"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {41aa1307-5d8b-11e6-9be6-54ab3a2c2168} - "E:\setup_vmb_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {e34076f6-5e42-11e6-9be8-54ab3a2c2168} - "D:\setup_vmb_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {e623694c-5e12-11e6-9be7-54ab3a2c2168} - "D:\SetupWi-Fi.exe"
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {f130394a-4c8e-11e6-9bcd-3052cb5e098b} - "D:\setup_vmb_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\…\MountPoints2: {f1303a4b-4c8e-11e6-9bcd-3052cb5e098b} - "D:\setup_vmb_lite.exe" /checkApplicationPresence
ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-06-27] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-06-27] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2016-06-27] (Acer Incorporated)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{1e8e9d5e-2b9c-4bf6-a51b-ef48487b130e}: [DhcpNameServer] [removed]
Tcpip\..\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b}: [NameServer] 87.103.113.145 87.103.113.177
Tcpip\..\Interfaces\{2b7bdd77-99c4-428f-ae3d-281d34bf9c0b}: [DhcpNameServer] [removed] [removed]
Tcpip\..\Interfaces\{8834f845-ecd9-43d2-a855-73fe734e0741}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{ae3a38cb-4f1d-46c8-9663-cf415c79f774}: [NameServer] 87.103.113.145 87.103.113.177
ManualProxies:
Internet Explorer:
==================
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer15.msn.com/?pc=ACTE
HKU\S-1-5-21-1796416936-1353488523-4272779061-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer15.msn.com/?pc=ACTE
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-07-20] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-20] (Oracle Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-18] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-18] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-20] (Oracle Corporation)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2016-05-23] ()
FF Extension: (Firefox Hotfix) - C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default\Extensions\[removed] [2016-08-31]
FF Extension: (Português (Portugal) Language Pack) - C:\Users\Rafael Sobreiro\AppData\Roaming\Mozilla\Firefox\Profiles\iz0nvtgx.default\Extensions\[removed] [2016-09-13]
Chrome:
=======
CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [315472 2015-07-20] (Windows (R) Win 7 DDK provider)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2267352 2016-08-15] (Acer Incorporated)
S3 cplspcon; C:\Windows\system32\IntelCpHDCPSvc.exe [588904 2015-08-18] ()
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573568 2015-05-14] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [350064 2016-05-23] (WildTangent)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [350312 2015-08-18] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel(R) Corporation)
S3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
R2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [207648 2015-08-14] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [401248 2015-09-04] (Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [453984 2015-09-04] (Acer Incorporated)
R2 SecureLine; C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe [592392 2016-07-17] ()
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [247040 2015-05-27] (acer)
R2 VmbService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [8704 2012-03-20] (Vodafone) [File not signed]
S3 vmicvss; C:\Windows\System32\ICSvc.dll [506880 2015-07-10] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24856 2016-08-03] (Microsoft Corporation)
S2 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]
S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\1.5.471.0\McCSPServiceHost.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 huawei_wwanecm; C:\Windows\System32\drivers\ew_juwwanecm.sys [227840 2012-03-16] (Huawei Technologies Co., Ltd.)
R3 iaLPSS2_I2C; C:\Windows\System32\drivers\iaLPSS2_I2C.sys [185128 2015-06-16] (Intel Corporation)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21344 2015-09-04] (Acer Incorporated)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-24] (Malwarebytes)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
S3 Qcamain; C:\Windows\System32\drivers\Qcamainx64.sys [2276352 2015-07-10] (Qualcomm Atheros, Inc.)
R3 Qcamain10x64; C:\Windows\system32\DRIVERS\Qcamain10x64.sys [2340240 2015-07-20] (Qualcomm Atheros, Inc.)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14688 2015-09-04] (Acer Incorporated)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [895256 2015-06-05] (Realtek )
R3 RTSUER; C:\Windows\system32\Drivers\RtsUer.sys [402136 2015-05-27] (Realsil Semiconductor Corporation)
R3 SGXEPC; C:\Windows\System32\drivers\sgx_driver.sys [54760 2016-07-22] (Windows (R) Win 7 DDK provider)
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [47784 2015-07-29] (Synaptics Incorporated)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-31] ()
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-09-13 21:58 - 2016-09-13 21:58 - 00016148 _____ C:\Windows\system32\LAPTOP-8E1TS1M5_Rafael Sobreiro_HistoryPrediction.bin
2016-09-13 21:55 - 2016-09-13 21:57 - 00006722 _____ C:\Users\Rafael Sobreiro\Desktop\Fixlog.txt
2016-09-13 21:20 - 2016-09-13 21:20 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2840991359_spectate.bat
2016-09-13 20:26 - 2016-09-13 22:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-09-13 18:49 - 2016-09-13 19:00 - 00036119 _____ C:\Users\Rafael Sobreiro\Desktop\Addition.txt
2016-09-13 18:48 - 2016-09-13 22:19 - 00017996 _____ C:\Users\Rafael Sobreiro\Desktop\FRST.txt
2016-09-13 18:46 - 2016-09-13 22:19 - 00000000 ____D C:\FRST
2016-09-13 18:46 - 2016-09-13 18:46 - 02398720 _____ (Farbar) C:\Users\Rafael Sobreiro\Desktop\FRST64.exe
2016-09-10 01:06 - 2016-09-10 01:06 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\PDF
2016-09-09 14:19 - 2016-09-09 14:19 - 00005988 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2288487360_spectate.bat
2016-09-08 22:49 - 2016-09-08 22:49 - 00000000 ____D C:\Users\Rafael Sobreiro\Downloads\002 7 Audio
2016-09-08 18:21 - 2016-09-08 18:21 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2833453605_spectate.bat
2016-09-08 18:16 - 2016-09-13 22:16 - 00000951 _____ C:\Windows\Tasks\EPSON XP-235 Series Update {AE01210B-99CB-43FA-9308-6C9A5E21D494}.job
2016-09-08 18:16 - 2016-09-08 18:16 - 00004148 _____ C:\Windows\System32\Tasks\EPSON XP-235 Series Update {AE01210B-99CB-43FA-9308-6C9A5E21D494}
2016-09-08 15:05 - 2016-09-08 15:08 - 82716613 _____ C:\Users\Rafael Sobreiro\Downloads\CC - Live at Reading & Leeds 2016.zip
2016-09-07 17:31 - 2016-09-07 17:31 - 00487807 _____ C:\Users\Rafael Sobreiro\Documents\E-Serviços%20ao%20Cidadão%20Académico.pdf.pdf
2016-09-07 17:30 - 2016-09-07 17:30 - 00316141 _____ C:\Users\Rafael Sobreiro\Documents\rptNotificacaoDocsEmFalta.pdf (2).pdf
2016-09-07 17:29 - 2016-09-07 17:29 - 00316141 _____ C:\Users\Rafael Sobreiro\Documents\rptNotificacaoDocsEmFalta.pdf.pdf
2016-09-07 17:29 - 2016-09-07 17:29 - 00316141 _____ C:\Users\Rafael Sobreiro\Documents\rptNotificacaoDocsEmFalta.pdf (1).pdf
2016-09-07 14:26 - 2016-09-07 14:26 - 00002265 _____ C:\Users\Rafael Sobreiro\Downloads\NotificacaoDocumentosEmFalta_20160907124604.PDF
2016-09-06 22:36 - 2016-09-06 22:36 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2830996581_spectate.bat
2016-09-05 12:44 - 2016-09-08 20:20 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Epson
2016-09-05 12:36 - 2016-09-13 21:36 - 00000951 _____ C:\Windows\Tasks\EPSON XP-235 Series Update {FB326052-AA28-4F72-A12C-3129D03BA244}.job
2016-09-05 12:36 - 2016-09-05 12:36 - 00004148 _____ C:\Windows\System32\Tasks\EPSON XP-235 Series Update {FB326052-AA28-4F72-A12C-3129D03BA244}
2016-09-05 12:35 - 2016-09-13 21:35 - 00000951 _____ C:\Windows\Tasks\EPSON XP-235 Series Update {4E92EF8E-2792-4348-85C3-7979FE897D63}.job
2016-09-05 12:35 - 2016-09-05 12:35 - 00004148 _____ C:\Windows\System32\Tasks\EPSON XP-235 Series Update {4E92EF8E-2792-4348-85C3-7979FE897D63}
2016-09-05 12:35 - 2016-09-05 12:35 - 00000000 ____D C:\Program Files\Common Files\EPSON
2016-09-05 12:31 - 2016-09-05 12:31 - 00000000 ____D C:\Program Files\EpsonNet
2016-09-05 12:30 - 2016-09-05 12:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2016-09-05 12:30 - 2016-09-05 12:43 - 00000000 ____D C:\Program Files (x86)\EPSON Software
2016-09-05 12:30 - 2016-09-05 12:30 - 00001465 _____ C:\Users\Public\Desktop\Manuais EPSON.lnk
2016-09-05 12:30 - 2016-09-05 12:30 - 00000123 _____ C:\Users\Public\Desktop\Epson Connect Site.url
2016-09-05 12:29 - 2016-09-05 12:43 - 00000000 ____D C:\Program Files (x86)\epson
2016-09-05 12:29 - 2016-09-05 12:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2016-09-05 12:29 - 2016-09-05 12:29 - 00001011 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2016-09-05 12:29 - 2014-06-03 00:00 - 00472064 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll
2016-09-05 12:29 - 2014-03-05 04:06 - 00180224 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMBPFE.DLL
2016-09-05 12:29 - 2012-05-17 00:00 - 00144560 _____ (Seiko Epson Corporation) C:\Windows\system32\escsvc64.exe
2016-09-05 12:29 - 2011-03-15 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BPFE.DLL
2016-09-05 12:25 - 2016-09-05 12:35 - 00000000 ____D C:\ProgramData\Epson
2016-09-05 12:25 - 2016-09-05 12:25 - 08410048 _____ (SEIKO EPSON CORPORATION) C:\Users\Rafael Sobreiro\Downloads\Epson_XP-235_Series_EA_11_Web.EXE
2016-09-05 03:05 - 2016-09-05 03:05 - 00003460 _____ C:\Users\Rafael Sobreiro\AppData\Local\recently-used.xbel
2016-09-05 00:13 - 2016-09-05 00:13 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2828683892_spectate.bat
2016-09-04 03:35 - 2016-09-04 03:36 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2827215766_spectate.bat
2016-09-03 17:53 - 2016-09-03 17:53 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2826330583_spectate.bat
2016-09-03 12:56 - 2016-09-03 12:56 - 00000000 ____D C:\Windows\%LOCALAPPDATA%
2016-09-03 02:49 - 2016-09-03 02:49 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2825667539_spectate.bat
2016-09-03 02:32 - 2016-09-03 02:33 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2825657785_spectate.bat
2016-09-02 19:43 - 2016-09-02 19:43 - 00410521 _____ C:\Users\Rafael Sobreiro\Desktop\E-Serviços ao Cidadão Académico.pdf
2016-09-02 16:25 - 2016-09-02 16:25 - 01065376 _____ (Google Inc.) C:\Users\Rafael Sobreiro\Downloads\ChromeSetup(2).exe
2016-09-02 12:17 - 2016-09-02 12:17 - 00146422 _____ C:\Users\Rafael Sobreiro\Downloads\comprovativo_244085892.pdf
2016-09-01 01:21 - 2016-09-01 01:21 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822735307_spectate.bat
2016-08-31 23:57 - 2016-08-31 23:57 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822693542_spectate (1).bat
2016-08-31 23:31 - 2016-08-31 23:31 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822693542_spectate.bat
2016-08-31 22:45 - 2016-08-31 22:46 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822626074_spectate.bat
2016-08-31 22:23 - 2016-08-31 22:23 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822560201_spectate.bat
2016-08-31 18:27 - 2016-08-31 18:28 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822179117_spectate.bat
2016-08-31 18:03 - 2016-08-31 18:03 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822187480_spectate.bat
2016-08-31 17:38 - 2016-08-31 17:38 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822171447_spectate.bat
2016-08-31 17:00 - 2016-08-31 17:00 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2822036968_spectate.bat
2016-08-31 16:08 - 2016-08-31 16:09 - 01065376 _____ (Google Inc.) C:\Users\Rafael Sobreiro\Downloads\ChromeSetup (1).exe
2016-08-31 04:49 - 2016-08-31 04:49 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821299437_spectate (1).bat
2016-08-31 04:36 - 2016-08-31 04:36 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821299437_spectate.bat
2016-08-31 04:10 - 2016-08-31 04:11 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821299103_spectate.bat
2016-08-31 04:00 - 2016-08-31 04:00 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2821289581_spectate.bat
2016-08-31 01:06 - 2016-06-14 21:01 - 00112216 _____ C:\Windows\system32\NvRtmpStreamer64.dll
2016-08-31 01:05 - 2016-08-31 01:05 - 00000000 ____D C:\Windows\LastGood
2016-08-31 01:05 - 2016-04-14 06:38 - 00102976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-08-30 23:57 - 2016-08-30 23:59 - 31930936 _____ (Adlice Software ) C:\Users\Rafael Sobreiro\Desktop\setup (1).exe
2016-08-29 20:33 - 2016-08-29 20:34 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2819425019_spectate.bat
2016-08-29 16:33 - 2016-08-29 16:33 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2818659478_spectate.bat
2016-08-29 16:01 - 2016-08-29 16:01 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2818655882_spectate.bat
2016-08-29 01:23 - 2016-08-29 01:23 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2818191346_spectate.bat
2016-08-28 21:57 - 2016-08-28 21:58 - 00005994 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2816732061_replay (1).bat
2016-08-28 21:14 - 2016-08-28 21:14 - 00005994 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2816732061_replay.bat
2016-08-28 20:35 - 2016-08-28 20:35 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2817808965_spectate.bat
2016-08-28 08:57 - 2016-08-28 08:58 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2816734419_spectate.bat
2016-08-27 14:51 - 2016-08-27 14:51 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2815579894_spectate.bat
2016-08-27 13:57 - 2016-08-27 13:59 - 129545180 _____ C:\Users\Rafael Sobreiro\Downloads\Crystal Castles Live @ Reading 2016.mp4
2016-08-25 21:53 - 2016-08-25 23:07 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\X
2016-08-25 21:22 - 2016-08-25 21:34 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\Omega Ruby
2016-08-25 20:56 - 2016-08-25 20:57 - 00005992 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2270917110_replay (1).bat
2016-08-25 19:54 - 2016-08-25 19:54 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2813287350_spectate.bat
2016-08-25 19:43 - 2016-08-25 19:43 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2813281988_spectate.bat
2016-08-25 19:30 - 2016-08-25 19:30 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2813245867_spectate.bat
2016-08-25 17:25 - 2016-08-25 17:25 - 00844597 _____ C:\Users\Rafael Sobreiro\Downloads\Forest Guardian Janna v1 (By Damonix).wxy
2016-08-25 15:41 - 2016-08-25 15:41 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812980127_spectate.bat
2016-08-25 15:02 - 2016-08-25 15:02 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812981339_spectate.bat
2016-08-25 14:51 - 2016-08-25 14:51 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812914913_spectate.bat
2016-08-25 13:23 - 2016-08-25 13:23 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812854945_spectate.bat
2016-08-25 12:31 - 2016-08-25 12:31 - 04914507 _____ C:\Users\Rafael Sobreiro\Downloads\Lime and Hot Pink v6.7 (By LoneOkami).wxy
2016-08-25 03:14 - 2016-08-25 03:15 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2812218434_spectate.bat
2016-08-24 23:56 - 2016-08-24 23:57 - 00000000 ___HD C:\$WINDOWS.~BT
2016-08-24 19:47 - 2016-08-24 19:47 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2811841384_spectate.bat
2016-08-24 19:45 - 2016-08-24 19:45 - 00005991 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2811816176_spectate.bat
2016-08-24 18:30 - 2016-08-24 18:30 - 01085539 _____ C:\Users\Rafael Sobreiro\Downloads\ChampionSkinList.jpeg
2016-08-20 22:08 - 2016-08-20 22:08 - 00005992 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2270917110_replay.bat
2016-08-20 22:01 - 2016-08-20 22:01 - 00005992 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2271703264_replay.bat
2016-08-19 23:04 - 2016-08-19 23:08 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\Nova pasta
2016-08-18 13:51 - 2016-08-18 13:51 - 00005906 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268313055_replay (1).bat
2016-08-18 13:49 - 2016-08-18 13:49 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate (3).bat
2016-08-18 13:49 - 2016-08-18 13:49 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate (2).bat
2016-08-18 13:48 - 2016-08-18 13:48 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate (1).bat
2016-08-18 13:46 - 2016-08-18 13:47 - 00005902 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269849539_spectate.bat
2016-08-17 20:03 - 2016-08-17 20:04 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269331971_spectate.bat
2016-08-17 18:08 - 2016-08-17 18:08 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269294665_spectate.bat
2016-08-17 17:21 - 2016-08-17 17:22 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269282885_spectate.bat
2016-08-17 15:30 - 2016-08-17 16:56 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269207620_spectate.bat
2016-08-17 14:45 - 2016-08-17 14:46 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269225670_spectate.bat
2016-08-17 13:43 - 2016-08-17 13:43 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2269224689_spectate.bat
2016-08-17 13:18 - 2016-08-17 13:52 - 106222323 _____ C:\Users\Rafael Sobreiro\Downloads\cc2016.rar
2016-08-16 22:41 - 2016-08-16 22:41 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268481313_spectate.bat
2016-08-16 22:03 - 2016-08-16 22:03 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268465687_spectate.bat
2016-08-16 21:30 - 2016-08-16 21:30 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268461836_spectate.bat
2016-08-16 20:34 - 2016-08-16 20:34 - 00005924 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268313055_replay.bat
2016-08-16 20:31 - 2016-08-16 20:32 - 00005924 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268247364_replay.bat
2016-08-16 13:39 - 2016-08-16 13:39 - 00003382 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task
2016-08-16 13:08 - 2016-08-16 13:09 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268247364_spectate.bat
2016-08-16 12:23 - 2016-08-16 12:29 - 00005920 _____ C:\Users\Rafael Sobreiro\Downloads\LOL_OPGG_Observer_2268256266_spectate.bat
2016-08-15 14:38 - 2016-09-05 03:05 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\gtk-2.0
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-09-13 22:11 - 2016-07-17 19:55 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Skype
2016-09-13 22:00 - 2015-08-31 11:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-09-13 21:59 - 2016-07-18 03:34 - 00000000 __SHD C:\Users\Rafael Sobreiro\IntelGraphicsProfiles
2016-09-13 21:58 - 2016-07-18 03:30 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-09-13 21:58 - 2015-07-10 13:21 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-09-13 21:57 - 2015-07-10 10:05 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-09-13 19:39 - 2016-07-17 20:04 - 00004204 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{82888F8C-4B09-44AD-BA85-C62F95B6D1F6}
2016-09-13 19:30 - 2016-07-17 18:55 - 00000000 ____D C:\Program Files (x86)\Google
2016-09-13 13:11 - 2015-07-10 12:04 - 00000000 ___HD C:\Program Files\WindowsApps
2016-09-13 13:11 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\AppReadiness
2016-09-13 13:07 - 2016-07-18 03:35 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\Packages
2016-09-12 22:22 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\system32\NDF
2016-09-12 15:55 - 2015-12-22 20:42 - 00795894 _____ C:\Windows\system32\prfh0816.dat
2016-09-12 15:55 - 2015-12-22 20:42 - 00156194 _____ C:\Windows\system32\prfc0816.dat
2016-09-12 15:55 - 2015-08-31 12:01 - 01827502 _____ C:\Windows\system32\PerfStringBackup.INI
2016-09-12 15:55 - 2015-07-10 12:02 - 00000000 ____D C:\Windows\INF
2016-09-12 03:06 - 2016-08-01 22:43 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\CrashDumps
2016-09-10 21:41 - 2016-07-24 22:30 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Audacity
2016-09-09 18:25 - 2016-07-18 03:34 - 00000000 ____D C:\Users\Rafael Sobreiro
2016-09-09 14:44 - 2016-07-19 21:48 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Roaming\Foxit Software
2016-09-08 14:54 - 2015-08-31 11:50 - 00004252 _____ C:\Windows\System32\Tasks\avast! SL Update
2016-09-05 17:14 - 2016-08-12 15:01 - 00000794 _____ C:\DelFix.txt
2016-09-05 12:43 - 2015-12-22 13:40 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-09-05 04:56 - 2016-08-13 21:38 - 00000000 ____D C:\Users\Rafael Sobreiro\.gimp-2.8
2016-09-04 16:04 - 2016-07-25 05:43 - 00000000 ____D C:\Wooxy
2016-08-31 15:57 - 2015-08-31 11:50 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-08-31 15:57 - 2015-08-31 11:50 - 00000000 ____D C:\Program Files (x86)\WildGames
2016-08-31 01:06 - 2016-07-18 03:34 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\NVIDIA Corporation
2016-08-31 01:06 - 2016-07-18 03:34 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\NVIDIA
2016-08-31 01:06 - 2015-12-22 13:52 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-08-31 00:21 - 2016-08-11 02:53 - 00000000 ____D C:\Program Files\RogueKiller
2016-08-31 00:00 - 2016-08-11 02:54 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-08-31 00:00 - 2016-08-11 02:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2016-08-29 02:20 - 2016-08-12 04:19 - 00000000 ____D C:\Users\Rafael Sobreiro\Desktop\azx
2016-08-25 23:44 - 2016-07-19 03:43 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\ElevatedDiagnostics
2016-08-24 23:58 - 2015-07-10 12:04 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2016-08-24 23:57 - 2015-08-31 12:45 - 00000000 ____D C:\Windows\Panther
2016-08-24 11:36 - 2016-08-08 16:51 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-18 11:36 - 2016-07-19 04:05 - 00003508 _____ C:\Windows\System32\Tasks\BacKGroundAgent
2016-08-18 11:36 - 2015-08-31 12:43 - 00000000 ___HD C:\OEM
2016-08-18 11:36 - 2015-08-31 11:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2016-08-18 11:34 - 2016-07-18 03:37 - 00000000 ____D C:\Users\Rafael Sobreiro\AppData\Local\clear.fi
2016-08-17 15:02 - 2016-07-17 19:55 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-08-17 15:02 - 2016-07-17 19:55 - 00000000 ____D C:\ProgramData\Skype
2016-08-16 13:39 - 2016-07-18 03:38 - 00002401 _____ C:\Users\Rafael Sobreiro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-08-16 13:39 - 2016-07-18 03:38 - 00000000 ___RD C:\Users\Rafael Sobreiro\OneDrive
==================== Files in the root of some directories =======
2016-09-05 03:05 - 2016-09-05 03:05 - 0003460 _____ () C:\Users\Rafael Sobreiro\AppData\Local\recently-used.xbel
2012-03-16 14:55 - 2012-03-16 14:55 - 0286678 ____R () C:\ProgramData\DeviceManager.xml.rc4
2015-12-22 13:42 - 2015-12-22 13:42 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-09-08 23:18
==================== End of FRST.txt ============================
Start CloseProcesses: CreateRestorePoint: CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data EmptyTemp: End
Fix result of Farbar Recovery Scan Tool (x64) Version: 12-09-2016
Ran by [removed] (13-09-2016 22:35:03) Run:2
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data
EmptyTemp:
End
*****************
Processes closed successfully.
Restore point was successfully created.
CHR Profile: C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data\Default => Error: No automatic fix found for this entry.
C:\Users\Rafael Sobreiro\AppData\Local\Google\Chrome\User Data => moved successfully
=========== EmptyTemp: ==========
BITS transfer queue => 48074 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 10708985 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 914 B
Edge => 0 B
Chrome => 0 B
Firefox => 109927667 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 128 B
LocalService => 0 B
NetworkService => 4778 B
Rafael Sobreiro => 1823728 B
RecycleBin => 0 B
EmptyTemp: => 116.8 MB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 22:35:09 ====
One more time, I want to make sure this is gone
Start CloseProcesses: CreateRestorePoint: C:\Users\Rafael Sobreiro\AppData\Local\Google EmptyTemp: End
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI