FORUM D’ENTRAIDE INFORMATIQUE (FEI)Site d’assistance et de sécurité informatique

[jmnp]

Bonjour,

Je me permets de vous écrire car mon pc semble être infecté par SG Miner, qui occupe beaucoup de ressources et fait augmenter la température du pc de manière effroyable. Je fais régulièrement ctrl+alt+suppr pour terminer la tâche. Je soupçonne fortement le téléchargement (idiot de ma part) de Google Books Downloader Lite d'être à l'origine de cette chose.

J'ai fait une analyse ZHP Diag, je poste le rapport ici, j'ai cru comprendre que c'est la procédure demandée.

Merci d'avance!

PS: étant au Portugal, ZHP s'est automatiquement installé en portugais et je ne trouve pas l'option pour modifier la langue, dites-moi si cela vous gêne pour comprendre le rapport.

~ ZHPDiag v2015.7.24.101 Por Nicolas Coolman (2015/07/24)
~ iniciado por MP (Administrator) (2015/07/26 11:22:19)
~ Site: http://www.nicolascoolman.fr
~ Facebook: https://www.facebook.com/nicolascoolman1
~ Status da versão: Version OK
~ Modo: Scanner
~ Relatório: C:\Users\MP\Desktop\ZHPDiag.txt
~ Relatório: C:\Users\MP\AppData\Roaming\ZHP\ZHPDiag.txt
~ UAC: Activate
~ Inicialização do sistema: Normal (Normal boot)
~ Windows 8.1, 64-bit (Build 9600)

---\\ Navegadores Internet (2) - 0s
MFIE: Mozilla Firefox 39.0 (x86 pt-PT) v39.0
MSIE: Internet Explorer v11.0.9600.17351

---\\ Informações sobre os produtos Windows (4) - 1s
~ Windows Server License Manager Script : OK
System - VBScript Engine not found
Windows Automatic Updates : OK (Demand)
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema (1) - 0s
Avira Antivirus v15.0.11.579

---\\ Softwares de proteçao do sistema (Supérfluo) (1) - 0s
SUPERAntiSpyware v6.0.1168

---\\ Softwares d'optimização do sistema (2) - 0s
Avira System Speedup v1.6.10.1246
CCleaner v5.07

---\\ Monitoramento dos softwares (2) - 0s
Adobe Flash Player 18 NPAPI
Adobe Reader XI

---\\ Informações sobre o sistema (6) - 0s
~ Operating System: Intel64 Family 6 Model 60 Stepping 3, GenuineIntel
~ Operating System: 64-bit
~ Boot mode: Normal (Normal boot)
Total RAM: 8268.804 MB (61% free)
~ System Restore: Activé (Enable)
~ System drive C: has 98 GB free of 200 GB

---\\ Modo de conexão ao sistema (3) - 0s
~ Computer Name: PC-MIGUEL
~ User Name: MP
~ Logged in as Administrator

---\\ Enumeração das unidades dos discos (2) - 0s
~ Drive C: has 98 GB free of 200 GB (System)
~ Drive D: has 338 GB free of 514 GB

---\\ Estado do Centro de Segurança do Windows (11) - 0s
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK

---\\ Pesquisa particular de ficheiros genéricos (22) - 1s
[MD5.ACDBE1ED38167C8B01B8F63161BB2CEA] - (.Microsoft Corporation - Explorador do Windows.) () -- C:\Windows\Explorer.exe [2374784]
[MD5.6E0BDFBEEED65B017F2E4C2C910B0520] - (.Microsoft Corporation - Processo anfitrião do Windows (Rundll32).) () -- C:\Windows\System32\rundll32.exe [52736]
[MD5.48CFA7BE561A7BE144C29BB912055016] - (.Microsoft Corporation - Aplicação de Arranque do Windows.) () -- C:\Windows\System32\Wininit.exe [144384]
[MD5.9D98D4F390F0B14A782F3B931E613A1A] - (.Microsoft Corporation - Extensões da Internet para Win32.) () -- C:\Windows\System32\wininet.dll [2309632]
[MD5.306EB21E5B480AE9065EA55AC8C35936] - (.Microsoft Corporation - Aplicação de início de sessão do Windows.) () -- C:\Windows\System32\Winlogon.exe [562176]
[MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) () -- C:\Windows\System32\sppcomapi.dll [447488]
[MD5.374E27295F0A9DCAA8FC96370F9BEEA5] - (.Microsoft Corporation - Controlador de Função Auxiliar para Winsock.) () -- C:\Windows\System32\drivers\AFD.sys [563200]
[MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) () -- C:\Windows\System32\drivers\atapi.sys [26464]
[MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) () -- C:\Windows\System32\drivers\Cdfs.sys [88576]
[MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) () -- C:\Windows\System32\drivers\Cdrom.sys [164352]
[MD5.A03F362C5557E238CBFA914689C77248] - (.Microsoft Corporation - DFS Namespace Client Driver.) () -- C:\Windows\System32\drivers\DfsC.sys [134144]
[MD5.498288DD5CA42C2D36D125893E968C53] - (.Microsoft Corporation - High Definition Audio Bus Driver.) () -- C:\Windows\System32\drivers\HDAudBus.sys [77312]
[MD5.84CFC5EFA97D0C965EDE1D56F116A541] - (.Microsoft Corporation - Controlador de porta i8042.) () -- C:\Windows\System32\drivers\i8042prt.sys [107520]
[MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) () -- C:\Windows\System32\drivers\IpNat.sys [142848]
[MD5.7A1A3F213CDB3363D179D5014272025D] - (.Microsoft Corporation - Windows NT SMB Minirdr.) () -- C:\Windows\System32\drivers\MRxSmb.sys [402432]
[MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) () -- C:\Windows\System32\drivers\netBT.sys [282624]
[MD5.1C80517BE6836A812F6A9B99B8321351] - (.Microsoft Corporation - Controlador de Sistema de Ficheiros NT.) () -- C:\Windows\System32\drivers\ntfs.sys [2013016]
[MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Controlador de porta paralela.) () -- C:\Windows\System32\drivers\Parport.sys [94208]
[MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) () -- C:\Windows\System32\drivers\Rasl2tp.sys [120832]
[MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Microsoft RDP Device redirector.) () -- C:\Windows\System32\drivers\rdpdr.sys [195584]
[MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) () -- C:\Windows\System32\drivers\tdx.sys [107520]
[MD5.4BB9BC49DEE1A319EC58274A7BBED663] - (.Microsoft Corporation - Controlador de cópia sombra do volume.) () -- C:\Windows\System32\drivers\volsnap.sys [310616]

---\\ Processos lançados (13) - 1s
[MD5.DBC598E47E7A382E60E2A4745D41FEF9] - (.ASUS - GFNEXSrv.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896] [PID.1456]
[MD5.970C70F6B2953ED43822D3797855D84C] - (.SUPERAntiSpyware.com - Core Service.) -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344] [PID.1796]
[MD5.F9E224D23B9E0527916DD92FDDDCD524] - (.Realtek Semiconductor Corporation - Realtek Bluetooth AVRCP Service.) -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe [35328] [PID.1860]
[MD5.4FC0CCE2499258A15E5B0905BC222DF1] - (.Realtek All Rights Reserved - Realtek Bluetooth BTDevManager Service Appl.) -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe [94720] [PID.1912]
[MD5.77D62C92D05633D2F1EAA13C3FD7F325] - (.Conexant Systems Inc. - Conexant Audio Message Service.) -- C:\Windows\system32\CxAudMsg64.exe [207064] [PID.1180]
[MD5.DAE6C3099D291EED8922A65C29ABCF52] - (.Intel(R) Corporation - Intel(R) Capability Licensing Service Inter.) -- C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520] [PID.1684]
[MD5.07D58D5F7839ABA76118BC037C2C63BD] - (.Conexant Systems, Inc. - SmartAudio Service Application.) -- C:\Windows\SysWOW64\SASrv.exe [447104] [PID.2344]
[MD5.6C0D429419FC1E1A16AA0CF769C3863D] - (.AsusTek - ASUS Smart Gesture Loader.) -- C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe [355128] [PID.5984]
[MD5.FA1BFFE455074BD7445AB75B449BF9AD] - (.AsusTek - ASUS Smart Gesture Helper.) -- C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe [176952] [PID.6340]
[MD5.0AF7D4CC9262C143B692B3A83C13D850] - (.Conexant Systems, Inc. - Conexant High Definition Audio Filter Agent.) -- C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe [915160] [PID.6700]
[MD5.39AAB7611342F13781C76B50ED83C42F] - (.Realtek Semiconductor Corporation - Realtek Bluetooth BTServer Application.) -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe [217088] [PID.6028]
[MD5.15555B93092A9F977174BBD47AF15005] - (.Conexant Systems, Inc - SmartAudio.) -- C:\Program Files\CONEXANT\SAII\SmartAudio.exe [1022168] [PID.3192]
[MD5.489FA9A917C02A0AD2824A1339C13485] - (.AsusTek - ASUS Smart Gesture Center.) -- C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe [283960] [PID.912]

---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3) (25) - 1s
P2 - EXT: (.Tracker Software Products (Canada) Ltd. - PDF-XChange Viewer Netscape Gecko Plugin.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npPDFXCviewNPPlugin.dll
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\jid1-zS7EEXncJwRsHA@jetpack.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\multilinks@plugin.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
P2 - EXT FILE: (...) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{e8f509f0-b677-11de-8a39-0800200c9a66}.xpi
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\amazon-en-GB.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\ddg.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\google.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\priberam.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\sapo.xml
P2 - EXT: (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\wikipedia-ptpt.xml
P2 - EXT: (.Mozilla - Default.) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
P2 - EXT: (. - ype=2 Flash Video Downloader - YouTube HD Downloader [4K] em:description=Flash Video Downloader helps you to download any video (flv, mp4, HD) from YouTube-like, Facebook, Break, Metacafe and more in one click. You can download mp3, music (iPod), avi and more. Download Flash games. Download Helper.>.) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\artur.dubovoy@gmail.com
P2 - EXT: (.Reinhold Ripper - Print pages to PDF.) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\printPages2Pdf@reinhold.ripper
P2 - EXT: (.iMacros Team, iOpus Software GmbH - iMacros for Firefox.) -- C:\Users\MP\AppData\Roaming\Mozilla\Firefox\Profiles\bbid7fnz.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
P2 - FPN: [HKCU] [@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf] - (.Tracker Software Products (Canada) Ltd..) -- C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll
P2 - FPN: [HKLM] [@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf] - (.Tracker Software Products (Canada) Ltd..) -- C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
P2 - FPN: [HKLM] [@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf] - (.Tracker Software Products (Canada) Ltd..) -- C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.1.5] - (.VideoLAN.) -- C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.2.1] - (.VideoLAN.) -- C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4) (17) - 0s
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean =>.Microsoft Internet Explorer
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 1
R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 1

---\\ Internet Explorer, Gestão do Proxy (R5) (3) - 0s
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas (3) - 0s
F2 - REG:system.ini: UserInit=userinit.exe (.Microsoft Corporation.)
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe (.Microsoft Corporation.)
F2 - REG:system.ini: VMApplet=C:\Windows\SysWOW64\SystemPropertiesPerformance.exe (.Microsoft Corporation.)

---\\ Redireção do ficheiro Hosts (O1) (1) - 0s
~ Le fichier hôte est sain (The hosts file is clean) (21)

---\\ Aplicações iniciadas por registo & pastas (O4) (21) - 1s
O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
O4 - HKLM\..\Run: [ShadowPlay] . (.Microsoft Corporation - Processo anfitrião do Windows (Rundll32).) -- C:\Windows\System32\rundll32.exe
O4 - HKLM\..\Run: [cAudioFilterAgent] . (.Conexant Systems, Inc. - Conexant High Definition Audio Filter Agent.) -- C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
O4 - HKLM\..\Run: [SmartAudio] . (.Conexant Systems, Inc. - SmartAudio CPL (32bit).) -- C:\Program Files\CONEXANT\SAII\SACpl.exe
O4 - HKLM\..\Run: [BtServer] . (.Realtek Semiconductor Corporation - Realtek Bluetooth BTServer Application.) -- C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
O4 - HKLM\..\Run: [gpuminer] . (...) -- C:\Users\MP\AppData\Roaming\cpuminer\sgminer\sgminer.cmd
O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] . (.SUPERAntiSpyware - SUPERAntiSpyware Application.) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [Dropbox Update] . (.Dropbox, Inc. - Dropbox Update.) -- C:\Users\MP\AppData\Local\Dropbox\Update\DropboxUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira system tray application.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Wow6432Node\Run: [Speedup_umh] . (.Avira Operations GmbH & Co. KG - Provides Avira System Speedup with necessar.) -- C:\Program Files (x86)\Avira\AviraSpeedup\Speedup_umh.exe
O4 - HKLM\..\Wow6432Node\Run: [Family Tree Builder Update] . (.MyHeritage - MyHeritage Family Tree Builder check for up.) -- C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe
O4 - HKLM\..\Wow6432Node\Run: [Avira Systray] . (.Avira Operations GmbH & Co. KG - Avira.) -- C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
O4 - HKUS\.DEFAULT\..\Run: [AviraSpeedup] . (.Avira Operations GmbH & Co. KG - Avira System Speedup.) -- C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe
O4 - HKUS\S-1-5-18\..\Run: [AviraSpeedup] . (.Avira Operations GmbH & Co. KG - Avira System Speedup.) -- C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe
O4 - HKUS\S-1-5-21-274652682-2357704988-2865741029-1001\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe
O4 - HKUS\S-1-5-21-274652682-2357704988-2865741029-1001\..\Run: [SUPERAntiSpyware] . (.SUPERAntiSpyware - SUPERAntiSpyware Application.) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-21-274652682-2357704988-2865741029-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-274652682-2357704988-2865741029-1001\..\Run: [Dropbox Update] . (.Dropbox, Inc. - Dropbox Update.) -- C:\Users\MP\AppData\Local\Dropbox\Update\DropboxUpdate.exe

---\\ Alteração Dominio/Clientes DNS (017) (2) - 0s
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

---\\ Lista dos serviços NT não Microsoft e não desativados (023) (24) - 1s
O23 - Service: SAS Core Service (!SASCORE) . (.SUPERAntiSpyware.com - Core Service.) - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Avira Mail Protection (AntiVirMailService) . (.Avira Operations GmbH & Co. KG - Antivirus MailScanner WFP Service.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
O23 - Service: Avira Agendamento (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) . (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Web Protection (AntiVirWebService) . (.Avira Operations GmbH & Co. KG - AntiVir WebGuard WFP Service.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
O23 - Service: ASLDR Service (ASLDRService) . (.ASUSTek Computer Inc. - ASLDR Service.) - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) . (.ASUS - GFNEXSrv.) - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Avira Service Host (Avira.ServiceHost) . (.Avira Operations GmbH & Co. KG - Avira.ServiceHost.) - C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
O23 - Service: AvrcpService (AvrcpService) . (.Realtek Semiconductor Corporation - Realtek Bluetooth AVRCP Service.) - C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe
O23 - Service: BTDevManager (BTDevManager) . (.Realtek All Rights Reserved - Realtek Bluetooth BTDevManager Service Appl.) - C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) . (.Conexant Systems Inc. - Conexant Audio Message Service.) - C:\Windows\system32\CxAudMsg64.exe
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) . (.NVIDIA Corporation - NVIDIA GeForce Experience Service.) - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Serviço Google Update (gupdate) (gupdate) . (.Google Inc. - Instalador do Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) . (.Intel Corporation - igfxCUIService Module.) - C:\Windows\system32\igfxCUIService.exe
O23 - Service: Intel(R) Capability Licensing Service Interface (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation - Intel(R) Capability Licensing Service Inter.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) ME Service (Intel(R) ME Service) . (.Intel Corporation - Intel(R) ME Service.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) . (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: Intel(R) Management and Security Application Local Manageme (LMS) . (.Intel Corporation - Intel(R) Local Management Service.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) . (.NVIDIA Corporation - NVIDIA Network Service.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) . (.NVIDIA Corporation - NVIDIA Streamer Service.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 333.0.) - C:\Windows\system32\nvvsvc.exe
O23 - Service: Conexant SmartAudio service (SAService) . (...) - C:\Windows\System32\SASrv.exe (.not file.)
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe

---\\ Tarefas planificadas automaticamente (039) (23) - 2s
[MD5.9B3355B29942AF67F014EA90CE1EA960] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [268976]
[MD5.67BCFC63F639C1C7F68E4F8ED9305587] [APT] [ASUS Smart Gesture Launcher] (.AsusTek.) -- C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [18232]
[MD5.08B018EF53C79AF2DAC005B494B9AF53] [APT] [ATK Package 36D18D69AFC3] (.ASUSTek Computer Inc..) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [109880]
[MD5.7DB7DB028B293395F271DC8DD2B477F8] [APT] [AviraSpeedup] (.Avira Operations GmbH & Co. KG.) -- C:\Program Files (x86)\Avira\AviraSpeedup\avira_system_speedup.exe [10551008]
[MD5.6313BA5D7F348576758CE789AF7E548A] [APT] [CCleanerSkipUAC] (.Piriform Ltd.) -- C:\Program Files\CCleaner\CCleaner.exe [6405912]
[MD5.7C6D524C78A1722AD987B9E47AC1FEE2] [APT] [DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001Core] (.Dropbox, Inc..) -- C:\Users\MP\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512]
[MD5.7C6D524C78A1722AD987B9E47AC1FEE2] [APT] [DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001UA] (.Dropbox, Inc..) -- C:\Users\MP\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512]
[MD5.E1B44A75947137F4143308D566889837] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107848]
[MD5.E1B44A75947137F4143308D566889837] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107848]
O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\Windows\Tasks\Adobe Flash Player Updater.job [830]
O39 - APT: DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001Core - (.Dropbox, Inc..) -- C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001Core.job [922]
O39 - APT: DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001UA - (.Dropbox, Inc..) -- C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001UA.job [974]
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job [1032]
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job [1036]
O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [3718]
O39 - APT: ASUS Smart Gesture Launcher - (.AsusTek.) -- C:\Windows\System32\Tasks\ASUS Smart Gesture Launcher [3538]
O39 - APT: ATK Package 36D18D69AFC3 - (.ASUSTek Computer Inc..) -- C:\Windows\System32\Tasks\ATK Package 36D18D69AFC3 [3562]
O39 - APT: AviraSpeedup - (.Avira Operations GmbH & Co. KG.) -- C:\Windows\System32\Tasks\AviraSpeedup [3320]
O39 - APT: CCleanerSkipUAC - (.Piriform Ltd.) -- C:\Windows\System32\Tasks\CCleanerSkipUAC [2790]
O39 - APT: DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001Core - (.Dropbox, Inc..) -- C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001Core [3558]
O39 - APT: DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001UA - (.Dropbox, Inc..) -- C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-274652682-2357704988-2865741029-1001UA [3938]
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [3772]
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [4008]

---\\ Software instalados (042) (61) - 4s
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM][64Bits] -- CCleaner
O42 - Logiciel: Conexant HD Audio - (.Conexant.) [HKLM][64Bits] -- CNXT_AUDIO_HDA
O42 - Logiciel: Pacote de controladores do Windows - ASUS (ATP) Mouse (03/18/2014 6.0.0.35 - (.ASUS.) [HKLM][64Bits] -- DAA6E0EEB715139C1CEA332C78AB4609FB3C211B
O42 - Logiciel: FlightGear v3.2.0 - (.The FlightGear Team.) [HKLM][64Bits] -- FlightGear_is1
O42 - Logiciel: GIMP 2.8.14 - (.The GIMP Team.) [HKLM][64Bits] -- GIMP-2_is1
O42 - Logiciel: SG Miner - (.Open Source.) [HKLM][64Bits] -- gpuminer
O42 - Logiciel: OpenVPN 2.3.6-I001 - (...) [HKLM][64Bits] -- OpenVPN
O42 - Logiciel: R for Windows 3.2.0 - (.R Core Team.) [HKLM][64Bits] -- R for Windows 3.2.0_is1
O42 - Logiciel: TAP-Windows 9.9.2 - (...) [HKLM][64Bits] -- TAP-Windows
O42 - Logiciel: IBM SPSS Statistics 21 - (.IBM Corp.) [HKLM][64Bits] -- {1E26B9C2-ED08-4EEA-83C8-A786502B41E5}
O42 - Logiciel: 7-Zip 9.20 (x64 edition) - (.Igor Pavlov.) [HKLM][64Bits] -- {23170F69-40C1-2702-0920-000001000000}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM][64Bits] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Office 15 Click-to-Run Licensing Component - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-008F-0000-1000-0000000FF1CE}
O42 - Logiciel: PDF-Viewer - (.Tracker Software Products Ltd.) [HKLM][64Bits] -- {A278382D-4F1B-4D47-9885-8523F7261E8D}_is1
O42 - Logiciel: NVIDIA Controlador gráfico 333.02 - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver
O42 - Logiciel: NVIDIA GeForce Experience 2.1.3 - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience
O42 - Logiciel: NVIDIA O software do sistema PhysX 9.13.1220 - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX
O42 - Logiciel: Intel® Trusted Connect Service Client - (.Intel Corporation.) [HKLM][64Bits] -- {B5E06417-A4AC-4225-B36E-7E34C91616E7}
O42 - Logiciel: SUPERAntiSpyware - (.SUPERAntiSpyware.com.) [HKLM][64Bits] -- {CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
O42 - Logiciel: Adobe Digital Editions 3.0 - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Digital Editions 3.0
O42 - Logiciel: Adobe Flash Player 18 NPAPI - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player NPAPI
O42 - Logiciel: Advanced Renamer - (.Hulubulu Software.) [HKLM][64Bits] -- Advanced Renamer_is1
O42 - Logiciel: ArcGIS 10.2.2 for Desktop - (.Environmental Systems Research Institute, Inc..) [HKLM][64Bits] -- ArcGIS 10.2.2 for Desktop
O42 - Logiciel: Avira Antivirus v15.0.11.579 - (.Avira Operations GmbH & Co. KG.) [HKLM][64Bits] -- Avira Antivirus
O42 - Logiciel: Avira System Speedup v1.6.10.1246 - (.Avira Operations GmbH & Co. KG.) [HKLM][64Bits] -- Avira System Speedup_is1 =>PUP.Optional.SystemSpeedup
O42 - Logiciel: Epubor PDF DRM Removal - (.Epubor Inc..) [HKLM][64Bits] -- Epubor PDF DRM Removal
O42 - Logiciel: MyHeritage Family Tree Builder - (.MyHeritage.com.) [HKLM][64Bits] -- Family Tree Builder
O42 - Logiciel: Java 2 Runtime Environment Standard Edition v1.3.1_03 - (...) [HKLM][64Bits] -- JRE 1.3.1_03
O42 - Logiciel: Legacy 8.0 - (.Millennia Corporation.) [HKLM][64Bits] -- Legacy 8.0
O42 - Logiciel: Macro Express 3 - (.Insight Software Solutions, Inc..) [HKLM][64Bits] -- Macro Express 3
O42 - Logiciel: Mozilla Firefox 39.0 (x86 pt-PT) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox 39.0 (x86 pt-PT)
O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM][64Bits] -- MozillaMaintenanceService
O42 - Logiciel: OpenAL - (...) [HKLM][64Bits] -- OpenAL
O42 - Logiciel: PDF Splitter - (.Softplicity, Inc..) [HKLM][64Bits] -- PDF Splitter_is1
O42 - Logiciel: ResearchSoft Direct Export Helper - (.Thomson Reuters.) [HKLM][64Bits] -- ResearchSoft Direct Export Helper
O42 - Logiciel: RStudio - (.RStudio.) [HKLM][64Bits] -- RStudio
O42 - Logiciel: Super macro 3.1 - (...) [HKLM][64Bits] -- Super macro
O42 - Logiciel: VLC media player - (.VideoLAN.) [HKLM][64Bits] -- VLC media player
O42 - Logiciel: Skype™ 7.5 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}
O42 - Logiciel: ASUS Smart Gesture - (.ASUS.) [HKLM][64Bits] -- {4D3286A6-F6AB-498A-82A4-E4F040529F3D}
O42 - Logiciel: Google Earth Pro - (.Google.) [HKLM][64Bits] -- {5BAA8884-F661-464B-B5B2-5C6C632BFC21}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
O42 - Logiciel: Intel(R) Management Engine Components - (.Intel Corporation.) [HKLM][64Bits] -- {65153EA5-8B6E-43B6-857B-C6E4FC25798A}
O42 - Logiciel: Skype Click to Call - (.Microsoft Corporation.) [HKLM][64Bits] -- {6D1221A9-17BF-4EC0-81F2-27D30EC30701}
O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM][64Bits] -- {80407BA7-7763-4395-AB98-5233F1B34E65}
O42 - Logiciel: Google Earth - (.Google.) [HKLM][64Bits] -- {817750FA-EC6A-485D-9901-0683AE6FFDF1}
O42 - Logiciel: Avira v1.1.40.29239 - (.Avira Operations GmbH & Co. KG.) [HKLM][64Bits] -- {8467e01f-0496-42ce-b247-88ef205b4880}
O42 - Logiciel: EndNote X7 - (.Thomson Reuters.) [HKLM][64Bits] -- {86B3F2D6-AC2B-0017-8AE1-F2F77F781B0C}
O42 - Logiciel: Realtek Ethernet Controller Driver - (.Realtek.) [HKLM][64Bits] -- {8833FFB6-5B0C-4764-81AA-06DFEED9A476}
O42 - Logiciel: Office 15 Click-to-Run Extensibility Component - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-008C-0000-0000-0000000FF1CE}
O42 - Logiciel: Office 15 Click-to-Run Localization Component - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-008C-0816-0000-0000000FF1CE}
O42 - Logiciel: PDF Split And Merge Basic - (.Andrea Vacondio.) [HKLM][64Bits] -- {9A40D2F8-9458-458B-95E3-B57797C574E1}
O42 - Logiciel: REALTEK Bluetooth Driver - (.REALTEK Semiconductor Corp..) [HKLM][64Bits] -- {9D3D8C60-A5EF-4123-B2B9-172095903AB}
O42 - Logiciel: REALTEK Wireless LAN Driver - (.REALTEK Semiconductor Corp..) [HKLM][64Bits] -- {9DAABC60-A5EF-41FF-B2B9-17329590CD5}
O42 - Logiciel: Avira v1.1.40.29239 - (.Avira Operations GmbH & Co. KG.) [HKLM][64Bits] -- {A4D3E7B8-410D-443A-B6AB-F32CDD4BD28C}
O42 - Logiciel: ATK Package - (.ASUS.) [HKLM][64Bits] -- {AB5C933E-5C7D-4D30-B314-9C83A49B94BE}
O42 - Logiciel: Adobe Reader XI (11.0.10) - Português - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {AC76BA86-7AD7-1046-7B44-AB0000000001}
O42 - Logiciel: SAS System 9.0 - (...) [HKLM][64Bits] -- {AD3C4A64-E7DC-11D4-AC4A-00C04F3876CD}
O42 - Logiciel: Intel(R) Processor Graphics - (.Intel Corporation.) [HKLM][64Bits] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}
O42 - Logiciel: Dropbox - (.Dropbox, Inc..) [HKCU][64Bits] -- Dropbox
O42 - Logiciel: Microsoft OneDrive - (.Microsoft Corporation.) [HKCU][64Bits] -- OneDriveSetup.exe

---\\ HKCU & HKLM Software Keys (96) - 4s
HKLM\SOFTWARE\Wow6432Node\Adobe
HKLM\SOFTWARE\Wow6432Node\AGEIA Technologies
HKLM\SOFTWARE\Wow6432Node\Apple Inc.
HKLM\SOFTWARE\Wow6432Node\AsLdr
HKLM\SOFTWARE\Wow6432Node\ASUS
HKLM\SOFTWARE\Wow6432Node\Avira
HKLM\SOFTWARE\Wow6432Node\AviraSpeedup
HKLM\SOFTWARE\Wow6432Node\Conexant
HKLM\SOFTWARE\Wow6432Node\Disc Soft
HKLM\SOFTWARE\Wow6432Node\Epubor PDF DRM Removal
HKLM\SOFTWARE\Wow6432Node\ESRI
HKLM\SOFTWARE\Wow6432Node\Google
HKLM\SOFTWARE\Wow6432Node\IM Providers
HKLM\SOFTWARE\Wow6432Node\Insight Software Solutions
HKLM\SOFTWARE\Wow6432Node\Intel
HKLM\SOFTWARE\Wow6432Node\ISI ResearchSoft
HKLM\SOFTWARE\Wow6432Node\JavaSoft
HKLM\SOFTWARE\Wow6432Node\Khronos
HKLM\SOFTWARE\Wow6432Node\Macromedia
HKLM\SOFTWARE\Wow6432Node\Macrovision
HKLM\SOFTWARE\Wow6432Node\Millennia Corporation
HKLM\SOFTWARE\Wow6432Node\Mozilla
HKLM\SOFTWARE\Wow6432Node\mozilla.org
HKLM\SOFTWARE\Wow6432Node\MozillaPlugins
HKLM\SOFTWARE\Wow6432Node\MyHeritage.com
HKLM\SOFTWARE\Wow6432Node\Ntpad
HKLM\SOFTWARE\Wow6432Node\NVIDIA Corporation
HKLM\SOFTWARE\Wow6432Node\ODBC
HKLM\SOFTWARE\Wow6432Node\Opera Software
HKLM\SOFTWARE\Wow6432Node\PDF Split And Merge Basic
HKLM\SOFTWARE\Wow6432Node\Python
HKLM\SOFTWARE\Wow6432Node\R-core
HKLM\SOFTWARE\Wow6432Node\Realtek
HKLM\SOFTWARE\Wow6432Node\Realtek Semiconductor Corp.
HKLM\SOFTWARE\Wow6432Node\RStudio
HKLM\SOFTWARE\Wow6432Node\RtWLan
HKLM\SOFTWARE\Wow6432Node\SAS Institute Inc.
HKLM\SOFTWARE\Wow6432Node\Skype
HKLM\SOFTWARE\Wow6432Node\TeamViewer
HKLM\SOFTWARE\Wow6432Node\Vantage Software Technologies
HKLM\SOFTWARE\Wow6432Node\VDO
HKLM\SOFTWARE\Wow6432Node\VideoLAN
HKLM\SOFTWARE\Wow6432Node\VMware, Inc.
HKLM\SOFTWARE\Wow6432Node\Volatile
HKLM\SOFTWARE\Wow6432Node\X-AVCSD
HKLM\SOFTWARE\Wow6432Node\RegisteredApplications
HKCU\SOFTWARE\7-Zip
HKCU\SOFTWARE\Adobe
HKCU\SOFTWARE\AppDataLow
HKCU\SOFTWARE\ASProtect
HKCU\SOFTWARE\ASUS
HKCU\SOFTWARE\Avira
HKCU\SOFTWARE\AviraSpeedup
HKCU\SOFTWARE\Conexant
HKCU\SOFTWARE\Disc Soft
HKCU\SOFTWARE\Dropbox
HKCU\SOFTWARE\DropboxUpdate
HKCU\SOFTWARE\ERDAS
HKCU\SOFTWARE\ESRI
HKCU\SOFTWARE\Google
HKCU\SOFTWARE\IM Providers
HKCU\SOFTWARE\iMacros
HKCU\SOFTWARE\Insight Software Solutions
HKCU\SOFTWARE\Intel
HKCU\SOFTWARE\ISI ResearchSoft
HKCU\SOFTWARE\JavaSoft
HKCU\SOFTWARE\Legacy 8 Ribbon Layout
HKCU\SOFTWARE\Macromedia
HKCU\SOFTWARE\Millennia Corporation
HKCU\SOFTWARE\Mozilla
HKCU\SOFTWARE\MozillaPlugins
HKCU\SOFTWARE\MyHeritage.com
HKCU\SOFTWARE\Netscape
HKCU\SOFTWARE\Nilings
HKCU\SOFTWARE\NVIDIA Corporation
HKCU\SOFTWARE\ODBC
HKCU\SOFTWARE\Opera Software
HKCU\SOFTWARE\PDF Split And Merge Basic
HKCU\SOFTWARE\Piriform
HKCU\SOFTWARE\Realtek
HKCU\SOFTWARE\RegisteredApplications
HKCU\SOFTWARE\SAS Institute Inc.
HKCU\SOFTWARE\Skype
HKCU\SOFTWARE\Softplicity
HKCU\SOFTWARE\SubSystems
HKCU\SOFTWARE\SUPERAntiSpyware.com
HKCU\SOFTWARE\SuperTuxKart
HKCU\SOFTWARE\TeamViewer
HKCU\SOFTWARE\The Complete Genealogy Reporter
HKCU\SOFTWARE\Tracker Software
HKCU\SOFTWARE\Trolltech
HKCU\SOFTWARE\VB and VBA Program Settings
HKCU\SOFTWARE\VDO
HKCU\SOFTWARE\VMware, Inc.
HKCU\SOFTWARE\ZebHelpProcess Helper
HKCU\SOFTWARE\AppDataLow\Software

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43) (227) - 5s
O43 - CFD: 2015/03/11 17:42:17 - [] D -- C:\Program Files (x86)\Adobe
O43 - CFD: 2014/10/18 14:05:56 - [] D -- C:\Program Files (x86)\Advanced Renamer
O43 - CFD: 2014/10/17 14:47:39 - [0] D -- C:\Program Files (x86)\AGEIA Technologies
O43 - CFD: 2014/10/17 17:08:56 - [] D -- C:\Program Files (x86)\ArcGIS
O43 - CFD: 2014/10/17 15:12:39 - [] D -- C:\Program Files (x86)\ASUS
O43 - CFD: 2015/07/03 18:47:29 - [] D -- C:\Program Files (x86)\Avira
O43 - CFD: 2015/07/23 08:57:58 - [] D -- C:\Program Files (x86)\Common Files
O43 - CFD: 2014/10/17 16:25:38 - [] D -- C:\Program Files (x86)\EndNote X7
O43 - CFD: 2015/02/18 13:20:12 - [] D -- C:\Program Files (x86)\Epubor
O43 - CFD: 2015/07/08 20:03:15 - [] D -- C:\Program Files (x86)\Google
O43 - CFD: 2015/07/26 11:15:16 - [] D -- C:\Program Files (x86)\Google Books Downloader
O43 - CFD: 2004/11/30 12:11:08 - [] HD -- C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 2014/10/17 14:38:49 - [] D -- C:\Program Files (x86)\Intel
O43 - CFD: 2014/10/18 10:44:20 - [] D -- C:\Program Files (x86)\Internet Explorer
O43 - CFD: 2015/02/14 19:31:52 - [] D -- C:\Program Files (x86)\Java
O43 - CFD: 2004/10/17 19:19:09 - [] D -- C:\Program Files (x86)\JavaSoft
O43 - CFD: 2014/11/20 17:17:40 - [] D -- C:\Program Files (x86)\Legacy8
O43 - CFD: 2014/12/01 19:40:55 - [] D -- C:\Program Files (x86)\Macro Express3
O43 - CFD: 2014/10/18 09:47:45 - [] D -- C:\Program Files (x86)\Microsoft Office
O43 - CFD: 2015/07/24 19:37:06 - [] D -- C:\Program Files (x86)\Microsoft Silverlight
O43 - CFD: 2014/10/18 09:49:57 - [] D -- C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 2015/07/06 23:05:44 - [] D -- C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 2015/05/18 19:53:45 - [] D -- C:\Program Files (x86)\Mozilla Maintenance Service
O43 - CFD: 2014/10/17 16:56:27 - [] D -- C:\Program Files (x86)\MSBuild
O43 - CFD: 2015/06/27 20:05:51 - [] D -- C:\Program Files (x86)\MyHeritage
O43 - CFD: 2014/10/17 15:08:13 - [] D -- C:\Program Files (x86)\NVIDIA Corporation
O43 - CFD: 2014/10/17 16:08:03 - [] D -- C:\Program Files (x86)\OpenAL
O43 - CFD: 2014/11/11 16:02:18 - [] D -- C:\Program Files (x86)\OpenVPN
O43 - CFD: 2015/07/20 12:00:59 - [] D -- C:\Program Files (x86)\Opera
O43 - CFD: 2015/02/14 19:30:36 - [] D -- C:\Program Files (x86)\PDF Split And Merge Basic
O43 - CFD: 2015/02/14 20:03:08 - [] D -- C:\Program Files (x86)\PDF Splitter
O43 - CFD: 2014/10/17 15:07:39 - [] D -- C:\Program Files (x86)\Realtek
O43 - CFD: 2014/10/17 16:56:27 - [] D -- C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 2004/11/30 12:12:27 - [] D -- C:\Program Files (x86)\SAS
O43 - CFD: 2015/06/03 14:22:31 - [] RD -- C:\Program Files (x86)\Skype
O43 - CFD: 2004/12/01 10:00:54 - [] D -- C:\Program Files (x86)\Super macro
O43 - CFD: 2014/10/17 16:06:47 - [] D -- C:\Program Files (x86)\SuperTuxKart
O43 - CFD: 2014/10/17 16:35:36 - [] D -- C:\Program Files (x86)\VideoLAN
O43 - CFD: 2014/10/18 10:44:35 - [] D -- C:\Program Files (x86)\Windows Defender
O43 - CFD: 2014/03/18 10:28:23 - [] D -- C:\Program Files (x86)\Windows Mail
O43 - CFD: 2014/03/18 11:29:16 - [] D -- C:\Program Files (x86)\Windows Media Player
O43 - CFD: 2014/03/18 11:29:17 - [] D -- C:\Program Files (x86)\Windows Multimedia Platform
O43 - CFD: 2013/08/22 16:36:30 - [] D -- C:\Program Files (x86)\Windows NT
O43 - CFD: 2014/03/18 10:28:23 - [] D -- C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 2014/03/18 11:29:16 - [] D -- C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 2013/08/22 16:36:30 - [] SHD -- C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 2013/08/22 16:36:30 - [] D -- C:\Program Files (x86)\WindowsPowerShell
O43 - CFD: 2014/10/18 11:24:51 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
O43 - CFD: 2013/08/22 16:36:33 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility
O43 - CFD: 2014/03/18 10:41:31 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 2014/03/18 11:29:21 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 2015/02/18 20:52:10 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
O43 - CFD: 2014/10/18 14:05:56 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Renamer
O43 - CFD: 2014/10/17 17:10:58 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS
O43 - CFD: 2014/10/17 15:12:46 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
O43 - CFD: 2015/07/16 14:30:36 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
O43 - CFD: 2015/06/19 09:33:06 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviraSpeedup
O43 - CFD: 2014/10/17 16:03:51 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
O43 - CFD: 2014/10/17 14:53:17 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Conexant
O43 - CFD: 2014/10/17 16:24:57 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EndNote
O43 - CFD: 2015/02/18 13:20:15 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epubor
O43 - CFD: 2014/10/17 17:50:54 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlightGear 3.2.0
O43 - CFD: 2014/10/17 21:08:53 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
O43 - CFD: 2015/02/14 19:32:00 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
O43 - CFD: 2004/10/17 19:19:10 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2 Runtime Environment
O43 - CFD: 2014/11/20 17:17:38 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Legacy 8.0
O43 - CFD: 2013/08/22 16:36:33 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 2014/10/18 09:48:00 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
O43 - CFD: 2015/07/24 19:37:09 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
O43 - CFD: 2014/10/17 14:47:49 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
O43 - CFD: 2015/02/19 11:11:20 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenVPN
O43 - CFD: 2015/02/14 19:30:36 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Split And Merge Basic
O43 - CFD: 2015/02/14 20:03:09 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Splitter
O43 - CFD: 2014/10/17 15:52:58 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer
O43 - CFD: 2015/05/06 10:29:24 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R
O43 - CFD: 2015/05/06 10:35:56 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RStudio
O43 - CFD: 2004/11/30 12:52:41 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAS
O43 - CFD: 2015/05/25 21:04:01 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
O43 - CFD: 2015/01/28 09:22:15 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
O43 - CFD: 2014/12/01 09:59:21 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super macro
O43 - CFD: 2015/01/21 10:13:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
O43 - CFD: 2014/10/17 16:06:47 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SuperTuxKart
O43 - CFD: 2014/03/18 11:29:21 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools
O43 - CFD: 2014/03/18 10:41:30 - [0] RHD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 2015/02/19 11:11:15 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TAP-Windows
O43 - CFD: 2014/10/17 16:35:41 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
O43 - CFD: 2015/03/11 17:45:28 - [] D -- C:\ProgramData\Adobe
O43 - CFD: 2014/10/17 14:14:54 - [0] SHD -- C:\ProgramData\Ambiente de Trabalho
O43 - CFD: 2013/08/22 15:45:52 - [0] SHD -- C:\ProgramData\Application Data
O43 - CFD: 2015/07/03 18:47:29 - [] D -- C:\ProgramData\Avira
O43 - CFD: 2014/10/17 14:50:43 - [] D -- C:\ProgramData\Conexant
O43 - CFD: 2014/11/28 21:49:14 - [] D -- C:\ProgramData\DAEMON Tools Ultra
O43 - CFD: 2013/08/22 15:45:52 - [0] SHD -- C:\ProgramData\Desktop
O43 - CFD: 2014/10/17 14:14:54 - [0] SHD -- C:\ProgramData\Documentos
O43 - CFD: 2013/08/22 15:45:52 - [0] SHD -- C:\ProgramData\Documents
O43 - CFD: 2014/12/01 19:46:24 - [] D -- C:\ProgramData\DRM
O43 - CFD: 2015/06/16 09:19:15 - [] D -- C:\ProgramData\Dropbox
O43 - CFD: 2014/11/30 13:19:42 - [0] D -- C:\ProgramData\eMule
O43 - CFD: 2014/10/17 17:36:13 - [] D -- C:\ProgramData\ESRI
O43 - CFD: 2014/10/17 20:42:40 - [] D -- C:\ProgramData\FLEXnet
O43 - CFD: 2014/10/17 17:51:05 - [] D -- C:\ProgramData\flightgear.org
O43 - CFD: 2014/10/18 10:55:00 - [] D -- C:\ProgramData\fltk.org
O43 - CFD: 2014/11/21 10:41:01 - [] D -- C:\ProgramData\HP
O43 - CFD: 2014/11/30 13:10:20 - [] D -- C:\ProgramData\Insight Software Solutions
O43 - CFD: 2014/10/17 14:33:52 - [] D -- C:\ProgramData\Intel
O43 - CFD: 2014/10/17 14:14:54 - [0] SHD -- C:\ProgramData\Menu Iniciar
O43 - CFD: 2015/07/24 19:37:11 - [] SD -- C:\ProgramData\Microsoft
O43 - CFD: 2014/10/18 09:50:20 - [] D -- C:\ProgramData\Microsoft OneDrive
O43 - CFD: 2014/10/17 14:14:54 - [0] SHD -- C:\ProgramData\Modelos
O43 - CFD: 2014/11/01 10:31:23 - [] D -- C:\ProgramData\Mozilla
O43 - CFD: 2015/06/27 23:53:29 - [] D -- C:\ProgramData\MyHeritage
O43 - CFD: 2014/10/17 14:47:32 - [] D -- C:\ProgramData\NVIDIA
O43 - CFD: 2014/10/17 15:08:27 - [] D -- C:\ProgramData\NVIDIA Corporation
O43 - CFD: 2015/02/14 19:31:53 - [] D -- C:\ProgramData\Oracle
O43 - CFD: 2015/07/03 18:47:33 - [] D -- C:\ProgramData\Package Cache
O43 - CFD: 2014/10/17 15:07:28 - [] D -- C:\ProgramData\Realtek
O43 - CFD: 2015/07/23 08:57:59 - [] D -- C:\ProgramData\regid.1991-06.com.microsoft
O43 - CFD: 2014/10/17 21:09:00 - [] D -- C:\ProgramData\SafeNet Sentinel
O43 - CFD: 2014/11/28 22:44:22 - [] D -- C:\ProgramData\SAS
O43 - CFD: 2015/05/25 21:04:03 - [] D -- C:\ProgramData\Skype
O43 - CFD: 2014/10/17 21:08:54 - [] D -- C:\ProgramData\SPSS
O43 - CFD: 2013/08/22 15:45:52 - [0] SHD -- C:\ProgramData\Start Menu
O43 - CFD: 2014/12/31 12:22:09 - [] D -- C:\ProgramData\SUPERAntiSpyware.com
O43 - CFD: 2013/08/22 15:45:52 - [0] SHD -- C:\ProgramData\Templates
O43 - CFD: 2014/10/17 16:24:59 - [] D -- C:\ProgramData\Thomson.ResearchSoft.Installers
O43 - CFD: 2014/10/17 20:35:25 - [] D -- C:\ProgramData\VMware
O43 - CFD: 2015/03/11 17:42:19 - [] D -- C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 2014/10/17 17:09:56 - [] D -- C:\Program Files (x86)\Common Files\AnswerWorks 4.0
O43 - CFD: 2014/10/17 17:10:55 - [] D -- C:\Program Files (x86)\Common Files\ArcGIS
O43 - CFD: 2014/10/17 17:09:12 - [] D -- C:\Program Files (x86)\Common Files\Data Dynamics
O43 - CFD: 2015/07/23 08:57:58 - [] D -- C:\Program Files (x86)\Common Files\DESIGNER
O43 - CFD: 2014/12/01 19:40:47 - [] D -- C:\Program Files (x86)\Common Files\Insight Software Solutions
O43 - CFD: 2004/10/17 19:18:31 - [] D -- C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 2014/10/17 14:38:43 - [] D -- C:\Program Files (x86)\Common Files\Intel
O43 - CFD: 2014/10/17 17:14:33 - [] D -- C:\Program Files (x86)\Common Files\Macrovision Shared
O43 - CFD: 2014/10/18 10:43:46 - [] D -- C:\Program Files (x86)\Common Files\Microsoft Shared
O43 - CFD: 2014/10/17 14:33:33 - [] D -- C:\Program Files (x86)\Common Files\postureAgent
O43 - CFD: 2014/10/17 16:24:57 - [] D -- C:\Program Files (x86)\Common Files\ResearchSoft
O43 - CFD: 2014/10/17 16:24:59 - [] D -- C:\Program Files (x86)\Common Files\Risxtd
O43 - CFD: 2013/08/22 16:36:33 - [] D -- C:\Program Files (x86)\Common Files\Services
O43 - CFD: 2015/05/25 21:04:00 - [] D -- C:\Program Files (x86)\Common Files\Skype
O43 - CFD: 2014/03/18 10:28:23 - [] D -- C:\Program Files (x86)\Common Files\System
O43 - CFD: 2014/10/17 17:08:57 - [] D -- C:\Program Files (x86)\Common Files\Tom Sawyer Software
O43 - CFD: 2014/10/17 16:24:15 - [] D -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
O43 - CFD: 2015/03/18 17:00:22 - [] D -- C:\Users\MP\AppData\Roaming\.PDFDRMRemoval
O43 - CFD: 2015/03/11 17:44:32 - [] D -- C:\Users\MP\AppData\Roaming\Adobe
O43 - CFD: 2015/04/07 14:54:03 - [] D -- C:\Users\MP\AppData\Roaming\Avira
O43 - CFD: 2015/07/26 11:14:37 - [] D -- C:\Users\MP\AppData\Roaming\BitTorrent
O43 - CFD: 2015/07/20 12:01:02 - [] D -- C:\Users\MP\AppData\Roaming\cpuminer
O43 - CFD: 2004/12/14 21:50:47 - [] D -- C:\Users\MP\AppData\Roaming\DAEMON Tools Ultra
O43 - CFD: 2015/07/25 08:18:58 - [] D -- C:\Users\MP\AppData\Roaming\Dropbox
O43 - CFD: 2015/04/01 10:52:11 - [] D -- C:\Users\MP\AppData\Roaming\EndNote
O43 - CFD: 2014/10/17 20:44:13 - [] D -- C:\Users\MP\AppData\Roaming\ESRI
O43 - CFD: 2015/04/02 22:19:57 - [] D -- C:\Users\MP\AppData\Roaming\flightgear.org
O43 - CFD: 2014/10/18 10:55:00 - [] D -- C:\Users\MP\AppData\Roaming\fltk.org
O43 - CFD: 2014/10/18 14:05:58 - [] D -- C:\Users\MP\AppData\Roaming\Hulubulu
O43 - CFD: 2014/10/17 14:33:07 - [] D -- C:\Users\MP\AppData\Roaming\InstallShield
O43 - CFD: 2014/10/17 15:24:58 - [] D -- C:\Users\MP\AppData\Roaming\Macromedia
O43 - CFD: 2015/05/05 18:45:29 - [] SD -- C:\Users\MP\AppData\Roaming\Microsoft
O43 - CFD: 2014/10/17 15:36:51 - [] D -- C:\Users\MP\AppData\Roaming\Mozilla
O43 - CFD: 2015/06/27 23:53:08 - [] D -- C:\Users\MP\AppData\Roaming\MyHeritage
O43 - CFD: 2015/07/25 08:19:09 - [] D -- C:\Users\MP\AppData\Roaming\NVIDIA
O43 - CFD: 2015/07/20 11:25:49 - [] D -- C:\Users\MP\AppData\Roaming\Opera Software
O43 - CFD: 2015/02/18 13:20:28 - [] D -- C:\Users\MP\AppData\Roaming\PDFDRMRemoval
O43 - CFD: 2015/04/16 22:11:35 - [] D -- C:\Users\MP\AppData\Roaming\RStudio
O43 - CFD: 2015/06/27 13:41:17 - [] D -- C:\Users\MP\AppData\Roaming\Skype
O43 - CFD: 2015/02/14 20:03:20 - [] D -- C:\Users\MP\AppData\Roaming\Softplicity
O43 - CFD: 2014/10/17 21:11:37 - [] D -- C:\Users\MP\AppData\Roaming\SPSSInc
O43 - CFD: 2014/12/31 12:22:20 - [] D -- C:\Users\MP\AppData\Roaming\SUPERAntiSpyware.com
O43 - CFD: 2014/10/18 10:52:10 - [] D -- C:\Users\MP\AppData\Roaming\supertuxkart
O43 - CFD: 2015/03/08 11:16:48 - [] D -- C:\Users\MP\AppData\Roaming\TeamViewer
O43 - CFD: 2015/06/27 20:06:20 - [0] D -- C:\Users\MP\AppData\Roaming\The Complete Genealogy Reporter - FTB
O43 - CFD: 2004/11/30 12:20:22 - [] D -- C:\Users\MP\AppData\Roaming\Thinstall
O43 - CFD: 2015/05/04 18:33:24 - [] D -- C:\Users\MP\AppData\Roaming\Thunderbird
O43 - CFD: 2015/07/25 08:52:05 - [] D -- C:\Users\MP\AppData\Roaming\vlc
O43 - CFD: 2014/10/17 20:34:47 - [] D -- C:\Users\MP\AppData\Roaming\VMware
O43 - CFD: 2015/07/26 11:22:26 - [] D -- C:\Users\MP\AppData\Roaming\ZHP
O43 - CFD: 2015/07/07 12:11:44 - [] D -- C:\Users\MP\AppData\Local\Adobe
O43 - CFD: 2015/02/18 20:52:19 - [] D -- C:\Users\MP\AppData\Local\Adobe_Systems_Incorporate
O43 - CFD: 2014/10/17 14:17:09 - [0] SHD -- C:\Users\MP\AppData\Local\Application Data
O43 - CFD: 2015/03/31 09:30:26 - [] D -- C:\Users\MP\AppData\Local\ArcGISRuntime
O43 - CFD: 2015/06/20 10:00:52 - [] D -- C:\Users\MP\AppData\Local\AviraSpeedup
O43 - CFD: 2014/10/17 14:53:23 - [] D -- C:\Users\MP\AppData\Local\Conexant
O43 - CFD: 2014/10/18 10:56:11 - [] D -- C:\Users\MP\AppData\Local\CrashRpt =>.Legitimate.CrashReports
O43 - CFD: 2015/03/22 12:24:31 - [0] D -- C:\Users\MP\AppData\Local\Diagnostics
O43 - CFD: 2004/12/14 21:56:36 - [] D -- C:\Users\MP\AppData\Local\Disc_Soft_Ltd
O43 - CFD: 2015/06/16 09:19:15 - [] D -- C:\Users\MP\AppData\Local\Dropbox
O43 - CFD: 2015/03/04 10:31:30 - [0] D -- C:\Users\MP\AppData\Local\ElevatedDiagnostics
O43 - CFD: 2014/10/17 15:35:18 - [] SHD -- C:\Users\MP\AppData\Local\EmieSiteList
O43 - CFD: 2014/10/17 15:35:18 - [] SHD -- C:\Users\MP\AppData\Local\EmieUserList
O43 - CFD: 2015/03/31 09:30:50 - [] D -- C:\Users\MP\AppData\Local\ESRI
O43 - CFD: 2015/04/01 13:27:41 - [] D -- C:\Users\MP\AppData\Local\fontconfig
O43 - CFD: 2015/04/01 13:27:41 - [] D -- C:\Users\MP\AppData\Local\gegl-0.2
O43 - CFD: 2015/04/14 18:21:47 - [] D -- C:\Users\MP\AppData\Local\Google
O43 - CFD: 2015/04/01 13:33:56 - [] D -- C:\Users\MP\AppData\Local\gtk-2.0
O43 - CFD: 2014/10/17 14:17:09 - [0] SHD -- C:\Users\MP\AppData\Local\Histórico
O43 - CFD: 2014/10/17 21:11:33 - [] D -- C:\Users\MP\AppData\Local\IBM
O43 - CFD: 2014/10/17 21:11:32 - [] D -- C:\Users\MP\AppData\Local\javasharedresources
O43 - CFD: 2014/10/18 21:05:08 - [] D -- C:\Users\MP\AppData\Local\Macromedia
O43 - CFD: 2015/05/05 18:45:27 - [] D -- C:\Users\MP\AppData\Local\Microsoft
O43 - CFD: 2015/05/06 10:57:57 - [] D -- C:\Users\MP\AppData\Local\Microsoft Help
O43 - CFD: 2014/10/17 15:36:51 - [] D -- C:\Users\MP\AppData\Local\Mozilla
O43 - CFD: 2014/10/17 15:07:31 - [] D -- C:\Users\MP\AppData\Local\NVIDIA
O43 - CFD: 2014/10/17 14:50:31 - [] D -- C:\Users\MP\AppData\Local\NVIDIA Corporation
O43 - CFD: 2015/07/20 11:25:50 - [] D -- C:\Users\MP\AppData\Local\Opera Software
O43 - CFD: 2015/07/23 22:27:06 - [] D -- C:\Users\MP\AppData\Local\Packages
O43 - CFD: 2014/10/18 11:44:34 - [] D -- C:\Users\MP\AppData\Local\Personal_Renamer
O43 - CFD: 2014/10/17 15:51:33 - [] D -- C:\Users\MP\AppData\Local\Programs
O43 - CFD: 2015/05/18 22:00:10 - [] D -- C:\Users\MP\AppData\Local\RStudio-Desktop
O43 - CFD: 2014/11/28 22:44:10 - [] D -- C:\Users\MP\AppData\Local\SAS
O43 - CFD: 2015/05/25 21:04:08 - [] D -- C:\Users\MP\AppData\Local\Skype
O43 - CFD: 2015/01/26 23:11:01 - [] D -- C:\Users\MP\AppData\Local\TeamViewer
O43 - CFD: 2015/07/26 11:22:13 - [] D -- C:\Users\MP\AppData\Local\Temp
O43 - CFD: 2014/10/17 14:17:09 - [0] SHD -- C:\Users\MP\AppData\Local\Temporary Internet Files
O43 - CFD: 2004/11/30 12:20:22 - [] D -- C:\Users\MP\AppData\Local\Thinstall
O43 - CFD: 2015/05/04 18:33:24 - [] D -- C:\Users\MP\AppData\Local\Thunderbird
O43 - CFD: 2014/10/24 19:59:08 - [] D -- C:\Users\MP\AppData\Local\VirtualStore
O43 - CFD: 2014/10/17 19:12:29 - [] D -- C:\Users\MP\AppData\Local\VMware
O43 - CFD: 2014/03/18 11:29:21 - [] RD -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
O43 - CFD: 2013/08/22 16:36:32 - [] RD -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 2014/10/18 10:49:37 - [] RD -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 2015/07/23 22:34:14 - [] D -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
O43 - CFD: 2013/08/22 16:36:32 - [] D -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 2015/06/27 20:06:25 - [] D -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyHeritage.com
O43 - CFD: 2015/07/23 22:34:32 - [] RD -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 2014/12/01 09:59:21 - [0] D -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Super macro
O43 - CFD: 2014/03/18 11:29:21 - [] RD -- C:\Users\MP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

---\\ Lista dos drivers do sistema (SDL) (O58) (53) - 1s
O58 - SDL:2013/08/22 13:43:41 A . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\Windows\System32\drivers\3ware.sys [108896]
O58 - SDL:2013/08/22 13:43:41 A . (.PMC-Sierra - PMC-Sierra Storport Driver For SPC8x6G SAS.) -- C:\Windows\System32\drivers\adp80xx.sys [782176]
O58 - SDL:2013/08/22 13:43:41 A . (.Advanced Micro Devices - AHCI 1.3 Device Driver.) -- C:\Windows\System32\drivers\amdsata.sys [79200]
O58 - SDL:2013/08/22 13:43:41 A . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller D.) -- C:\Windows\System32\drivers\amdsbs.sys [259424]
O58 - SDL:2013/08/22 13:43:40 A . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\System32\drivers\amdxata.sys [25952]
O58 - SDL:2013/08/22 13:43:41 A . (.PMC-Sierra, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\System32\drivers\arcsas.sys [114016]
O58 - SDL:2013/10/08 02:47:18 A . (.ASUS - HID driver for ASUS Wireless Radio Control.) -- C:\Windows\System32\drivers\AsHIDSwitch64.sys [20280]
O58 - SDL:2014/03/31 12:42:40 A . (.ASUS Corporation - Asus TP Filter Driver(X64).) -- C:\Windows\System32\drivers\AsusTP.sys [69904]
O58 - SDL:2015/06/18 11:04:12 A . (.Avira Operations GmbH & Co. KG - Avira Minifilter Driver.) -- C:\Windows\System32\drivers\avgntflt.sys [153256]
O58 - SDL:2015/06/18 11:04:12 A . (.Avira Operations GmbH & Co. KG - Avira Driver for Security Enhancement.) -- C:\Windows\System32\drivers\avipbb.sys [132656]
O58 - SDL:2014/09/25 17:32:07 A . (.Avira Operations GmbH & Co. KG - Avira Manager Driver.) -- C:\Windows\System32\drivers\avkmgr.sys [28600]
O58 - SDL:2015/03/10 22:17:20 A . (.Avira Operations GmbH & Co. KG - Avira WFP Network Driver.) -- C:\Windows\System32\drivers\avnetflt.sys [43576]
O58 - SDL:2013/08/13 00:25:46 A . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\drivers\bcmfn2.sys [17624]
O58 - SDL:2013/08/22 13:43:41 A . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\System32\drivers\bxvbda.sys [531296]
O58 - SDL:2014/06/12 10:10:06 A . (.Conexant Systems Inc. - 64-bit High Definition Audio Function Drive.) -- C:\Windows\System32\drivers\CHDRT64.sys [1457344]
O58 - SDL:2013/08/22 13:43:45 A . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\System32\drivers\evbda.sys [3357024]
O58 - SDL:2013/08/22 13:43:45 A . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Drive.) -- C:\Windows\System32\drivers\HpSAMD.sys [64352]
O58 - SDL:2013/07/30 19:47:35 A . (.Intel Corporation - Intel(R) Serial IO GPIO Controller Driver.) -- C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568]
O58 - SDL:2013/07/25 20:05:39 A . (.Intel Corporation - Intel(R) Serial IO I2C Controller Driver.) -- C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320]
O58 - SDL:2013/11/06 09:18:12 A . (.Intel Corporation - Intel Rapid Storage Technology driver - x64.) -- C:\Windows\System32\drivers\iaStorA.sys [631656]
O58 - SDL:2013/08/10 01:39:30 A . (.Intel Corporation - Intel Rapid Storage Technology driver (inbo.) -- C:\Windows\System32\drivers\iaStorAV.sys [651248]
O58 - SDL:2013/08/22 13:43:45 A . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\System32\drivers\iaStorV.sys [412000]
O58 - SDL:2014/03/18 04:10:32 A . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\Windows\System32\drivers\igdkmd64.sys [3729920]
O58 - SDL:2014/03/17 03:43:32 A . (.Intel(R) Corporation - Intel(R) Display Audio Driver.) -- C:\Windows\System32\drivers\IntcDAud.sys [450520]
O58 - SDL:2014/03/01 21:32:31 A . (.Intel Corporation - Intel® WiDi Solution.) -- C:\Windows\System32\drivers\intelaud.sys [38296]
O58 - SDL:2014/03/01 21:32:31 A . (.Intel Corporation - Intel® WiDi Solution.) -- C:\Windows\System32\drivers\iwdbus.sys [27032]
O58 - SDL:2013/08/22 13:43:44 A . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas.sys [109408]
O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas2.sys [93536]
O58 - SDL:2013/08/22 13:43:44 A . (.LSI Corporation - LSI SAS Gen3 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas3.sys [81760]
O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation - LSI SSS PCIe/Flash Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sss.sys [82784]
O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\Windows\System32\drivers\megasas.sys [56672]
O58 - SDL:2013/08/22 13:43:45 A . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\System32\drivers\megasr.sys [575840]
O58 - SDL:2013/08/22 13:43:49 A . (.Marvell Semiconductor, Inc. - Marvell Flash Controller Driver.) -- C:\Windows\System32\drivers\mvumis.sys [63840]
O58 - SDL:2014/04/09 00:11:18 A . (.NVIDIA Corporation - NVIDIA Windows Kernel Mode Driver, Version.) -- C:\Windows\System32\drivers\nvlddmkm.sys [12697032]
O58 - SDL:2013/08/22 13:43:31 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\Windows\System32\drivers\nvraid.sys [150368]
O58 - SDL:2013/08/22 13:43:32 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\Windows\System32\drivers\nvstor.sys [168288]
O58 - SDL:2014/09/04 20:14:38 A . (.NVIDIA Corporation - NVIDIA Virtual Audio Driver.) -- C:\Windows\System32\drivers\nvvad64v.sys [38048]
O58 - SDL:2014/03/17 10:57:10 A . (.Realtek - Realtek 8101E/8168/8169 NDIS 6.30 64-bit Dr.) -- C:\Windows\System32\drivers\Rt630x64.sys [843480]
O58 - SDL:2013/11/05 00:52:12 A . (.Realtek Semiconductor Corporation - Realtek Bluetooth A2DP Driver.) -- C:\Windows\System32\drivers\RtkA2dp.sys [176344]
O58 - SDL:2013/06/20 23:44:06 A . (.Realtek Semiconductor Corporation - Realtek Bluetooth Avrcp Controller Driver.) -- C:\Windows\System32\drivers\RtkAvrcpCtrlr.sys [69848]
O58 - SDL:2014/04/18 02:52:10 A . (.Realtek Semiconductor Corporation - Realtek Bluetooth Filter Driver.) -- C:\Windows\System32\drivers\RtkBtfilter.sys [573144]
O58 - SDL:2013/10/18 07:12:34 RA . (.Realsil Semiconductor Corporation - RTS PCIE READER Driver.) -- C:\Windows\System32\drivers\RtsPer.sys [444632]
O58 - SDL:2014/04/30 07:59:28 RA . (.Realtek Semiconductor Corporation - Realtek PCIE NDIS Driverr.) -- C:\Windows\System32\drivers\rtwlane.sys [3421040]
O58 - SDL:2013/08/22 16:35:09 A . (.Macrovision Corporation, Macrovision Europe Limited, - Macrovision SECURITY Driver.) -- C:\Windows\System32\drivers\secdrv.sys [23040]
O58 - SDL:2013/08/22 13:43:31 A . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\System32\drivers\sisraid2.sys [44896]
O58 - SDL:2013/08/22 13:43:32 A . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\System32\drivers\sisraid4.sys [81760]
O58 - SDL:2013/08/22 13:43:32 A . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Wind.) -- C:\Windows\System32\drivers\stexstor.sys [31072]
O58 - SDL:2013/08/22 13:40:24 A . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\Windows\System32\drivers\tap0901.sys [40664]
O58 - SDL:2013/12/09 15:26:24 A . (.Intel Corporation - Intel(R) Management Engine Interface.) -- C:\Windows\System32\drivers\TeeDriverx64.sys [100312]
O58 - SDL:2013/08/22 13:43:34 A . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\System32\drivers\viaide.sys [19808]
O58 - SDL:2013/08/22 13:43:34 A . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\Windows\System32\drivers\vsmraid.sys [168800]
O58 - SDL:2013/08/22 13:43:34 A . (.VIA Corporation - VIA StorX RAID Controller Driver.) -- C:\Windows\System32\drivers\VSTXRAID.SYS [305504]
O58 - SDL:2015/01/27 01:23:46 A . (.Western Digital Technologies - WD SCSI Architecture Model (SAM) driver.) -- C:\Windows\System32\drivers\wdcsam64.sys [14464]

---\\ Últimos ficheiros alterados ou criados (Utilizador) (061) (8) - 38s
O61 - LFC: 2015/07/20 11:23:31 A . (..) -- C:\Users\MP\Downloads\Gbooks__1598_il414.exe [899088]
O61 - LFC: 2015/07/20 11:19:01 A . (.Copyright © 2012.) -- C:\Users\MP\Downloads\Google Books Downloader Lite.exe [149504]
O61 - LFC: 2015/07/20 11:24:15 A . (..) -- C:\Users\MP\AppData\Roaming\cpuminer\sgminer-uninst.exe [55909]
O61 - LFC: 2015/07/25 08:19:17 A . (..) -- C:\Users\MP\AppData\Roaming\cpuminer\sgminer\lyra2reGeForce GTX 850Mgw128l4.bin [837873]
O61 - LFC: 2015/07/20 11:01:34 A . (..) -- C:\Users\MP\AppData\Local\NVIDIA\NvBackend\UMDShim\nvcoproc.bin [5121613]
O61 - LFC: 2015/07/24 17:47:54 A . (..) -- C:\Users\MP\AppData\Local\NVIDIA\NvBackend\Packages\00007af6\DAO.19793760.exe [5917592]
O61 - LFC: 2015/07/21 09:18:56 A . (..) -- C:\Users\MP\AppData\Local\NVIDIA\NvBackend\Packages\00007abf\CoProc update.19781562.exe [514576]
O61 - LFC: 2015/07/26 00:09:47 A . (..) -- C:\Users\MP\AppData\Local\AviraSpeedup\Session.bin [4560]

---\\ Associações Shell Spawning (O67) (1) - 0s
O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Iniciador do Snap-in Visualizador de Evento.) -- C:\Windows\System32\eventvwr.exe

---\\ Menu de inicialização Internet (068) (8) - 0s
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ShowIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ShowIconsCommand] (.Microsoft Corporation - Utilitário de Inicialização por utilizador.) -- C:\Windows\System32\ie4uinit.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\ReinstallCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\ReinstallCommand] (.Microsoft Corporation - Utilitário de Inicialização por utilizador.) -- C:\Windows\System32\ie4uinit.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\InstallInfo\HideIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\InstallInfo\HideIconsCommand] (.Microsoft Corporation - Utilitário de Inicialização por utilizador.) -- C:\Windows\System32\ie4uinit.exe

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069) (1) - 5s
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com/

---\\ Listagem dos ficheiros Crack & Keygen (CKF) (O82) (1) - 7s
O82 - LFC: 2007/03/30 15:52:37 A . (...) -- C:\Users\MP\Dropbox\Carlos Valinhas_Mário Nunes_VF\Software\Billion.Chords.v1.0\02_KeyGen.exe [29696] =>.Crack,Keygen

---\\ Listagem dos serviços iniciados pelo Svchost (SSS) (O83) (34) - 1s
O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Serviço Experiência de Aplicação.) -- C:\Windows\System32\aelupsvc.dll [208896]
O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Serviço de Propagação de Certificados de Sm.) -- C:\Windows\System32\certprop.dll [155136]
O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Serviço de Propagação de Certificados de Sm.) -- C:\Windows\System32\certprop.dll [155136]
O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - DLL do Serviço de Servidor.) -- C:\Windows\system32\srvsvc.dll [323072]
O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Cliente de Política de Grupo.) -- C:\Windows\System32\gpsvc.dll [1308160]
O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - Extensão IKE.) -- C:\Windows\System32\ikeext.dll [1063424]
O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Serviço que oferece conectividade IPv6 numa.) -- C:\Windows\System32\iphlpsvc.dll [914432]
O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - DLL secundária de serviço de início de sess.) -- C:\Windows\system32\seclogon.dll [30720]
O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Serviço de Informações sobre Aplicações.) -- C:\Windows\System32\appinfo.dll [109568]
O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - Serviço de Deteção iSCSI.) -- C:\Windows\system32\iscsiexe.dll [150528]
O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Serviço EAPHost da Microsoft.) -- C:\Windows\System32\eapsvc.dll [107008]
O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Serviço Programador de Tarefas.) -- C:\Windows\system32\schedsvc.dll [1212928]
O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\system32\wbem\WMIsvc.dll [220672]
O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Serviço do Programador de Classes de Multim.) -- C:\Windows\system32\mmcss.dll [70656]
O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - DLL do Browser de Computador.) -- C:\Windows\System32\browser.dll [134144]
O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\system32\profsvc.dll [220160]
O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Serviço de Configuração do Ambiente de Trab.) -- C:\Windows\System32\SessEnv.dll [324096]
O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Relatórios e Soluções de Problemas.) -- C:\Windows\System32\wercplsupport.dll [81408]
O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Key Management Service.) -- C:\Windows\system32\kmsvc.dll [97792]
O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - Serviço BDE.) -- C:\Windows\System32\bdesvc.dll [339456]
O83 - Search Svchost Services: lfsvc (lfsvc) . (.Microsoft Corporation - Serviço de Arquitetura de Localização do Wi.) -- C:\Windows\System32\GeofenceMonitorService.dll [491520]
O83 - Search Svchost Services: wlidsvc (wlidsvc) . (.Microsoft Corporation - Serviço Conta Microsoft®.) -- C:\Windows\system32\wlidsvc.dll [1576960]
O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - DLL de Serviços de Tema da Shell do Windows.) -- C:\Windows\system32\themeservice.dll [50688]
O83 - Search Svchost Services: DsmSvc (DsmSvc) . (.Microsoft Corporation - Gestor de Configuração de Dispositivos.) -- C:\Windows\System32\DeviceSetupManager.dll [201728]
O83 - Search Svchost Services: NcaSvc (NcaSvc) . (.Microsoft Corporation - Serviço do Assistente de Conectividade da R.) -- C:\Windows\System32\ncasvc.dll [164352]
O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Gestor de Marcação Automática de Acesso Rem.) -- C:\Windows\System32\rasauto.dll [101376]
O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Gestor de Ligação de Acesso Remoto.) -- C:\Windows\System32\rasmans.dll [534528]
O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Gestor de Interfaces Dinâmicas.) -- C:\Windows\System32\mprdim.dll [223744]
O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - Serviço de Notificação de Eventos do Sistem.) -- C:\Windows\System32\sens.dll [71680]
O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Componentes do Microsoft NAT Helper.) -- C:\Windows\System32\ipnathlp.dll [433664]
O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Servidor de telefonia Microsoft® Windows(TM.) -- C:\Windows\System32\tapisrv.dll [306688]
O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\system32\wuaueng.dll [3448320]
O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Serviço de transferência inteligente em seg.) -- C:\Windows\System32\qmgr.dll [1017856]
O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - DLL de serviços da shell do Windows.) -- C:\Windows\System32\shsvcs.dll [629760]

---\\ Lista das exceções do FireWall (FirewallRules) (O87) (12) - 1s
O87 - FAEL: "{49A745FB-A354-46A5-B8DE-255EC8B1CE7B}" [In-None-P6-FALSE] .(.IBM Corp. - IBM SPSS WinWrap Basic IDE 21.0.) -- C:\Program Files\IBM\SPSS\Statistics\21\WinWrapIDE.exe
O87 - FAEL: "{2FB3CEAE-CDFC-4431-99AA-18A1FDE6A53A}" [In-None-P6-FALSE] .(.IBM Corp. - IBM SPSS Statistics 21.0 Command.) -- C:\Program Files\IBM\SPSS\Statistics\21\stats.com
O87 - FAEL: "{B93EB359-111E-4075-8EF1-DCAC57EF4D04}" [In-None-P17-FALSE] .(.IBM Corp. - IBM SPSS WinWrap Basic IDE 21.0.) -- C:\Program Files\IBM\SPSS\Statistics\21\WinWrapIDE.exe
O87 - FAEL: "{F4E9FF2A-3C88-4911-A129-D610BBC37F09}" [In-None-P17-FALSE] .(.IBM Corp. - IBM SPSS Statistics 21.0 Command.) -- C:\Program Files\IBM\SPSS\Statistics\21\stats.com
O87 - FAEL: "{E5B6A0EB-FB5E-4121-8918-EBAAEAC480FC}" [In-None-P6-FALSE] .(.IBM Corp. - IBM SPSS Statistics 21.0.) -- C:\Program Files\IBM\SPSS\Statistics\21\stats.exe
O87 - FAEL: "{DD9439BB-41EC-4D38-A0F4-88B20DC4678F}" [In-None-P17-FALSE] .(.IBM Corp. - IBM SPSS Statistics 21.0.) -- C:\Program Files\IBM\SPSS\Statistics\21\stats.exe
O87 - FAEL: "TCP Query User{C4113620-2CEC-481B-8B6B-E1DC74191E5B}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" [In-None-P6-TRUE] .(.IBM - Java(TM) Platform SE binary.) -- C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe
O87 - FAEL: "UDP Query User{33CA2DC4-3998-4E7F-8FCD-A57E1856591E}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" [In-None-P17-TRUE] .(.IBM - Java(TM) Platform SE binary.) -- C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe
O87 - FAEL: "TCP Query User{4419FBE9-767E-4F6E-8EE9-380E472FE2C6}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" [In-None-P6-TRUE] .(.IBM - Java(TM) Platform SE binary.) -- C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe
O87 - FAEL: "UDP Query User{FD46DD50-DDCA-487F-A5D2-F902FCFF816A}C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe" [In-None-P17-TRUE] .(.IBM - Java(TM) Platform SE binary.) -- C:\program files\ibm\spss\statistics\21\jre\bin\javaw.exe
O87 - FAEL: "TCP Query User{073AC026-8B98-4C71-98D3-ED312284722B}C:\program files\ibm\spss\statistics\21\stats.exe" [In-None-P6-TRUE] .(.IBM Corp. - IBM SPSS Statistics 21.0.) -- C:\program files\ibm\spss\statistics\21\stats.exe
O87 - FAEL: "UDP Query User{0880E64D-B239-4B71-A48D-885F4E8DFBB0}C:\program files\ibm\spss\statistics\21\stats.exe" [In-None-P17-TRUE] .(.IBM Corp. - IBM SPSS Statistics 21.0.) -- C:\program files\ibm\spss\statistics\21\stats.exe

---\\ Scâner Aditional (088) (2) - 0s
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avira System Speedup_is1 =>PUP.Optional.SystemSpeedup
C:\Users\MP\AppData\Local\CrashRpt =>.Legitimate.CrashReports

---\\ Resumo dos elementos encontrados na sua estação de trabalho (2) - 0s
http://www.nicolascoolman.fr/pup-systemspeedup/ =>PUP.Optional.SystemSpeedup
http://www.nicolascoolman.fr/blog =>.Legitimate.CrashReports

~ End of the scan, 18884 items in 84 seconds (728)(1)()

[g3n-h@ckm@n]

salut

s'il te dérange tant que ca pourquoi ne pas le désinstaller ?
désinstalle aussi superantispyware il sert à rien

[jmnp]

Bonjour,

Merci pour la réponse. En fait c'est bizarre, j'avais déjà essayé de désinstaller SG Miner mais ça donnait à chaque fois un message d'erreur. J'ai fini par y arriver. J'ai aussi désinstallé Superantispyware, suivant ton conseil.

Par contre je crains toujours qu'un troyen ou un truc du genre soit dans mon pc. J'ai reçu une notification de facebook disant que qqun s'était connecté sur mon compte en Thaïlande, peu après avoir modifié mon mot de passe. J'ai entre-temps re-modifié mon mot de passe mais à partir d'un autre pc. Je note aussi qu'à chaque allumage du pc une fenêtre s'affiche me demandant avec quel programme je veux ouvrir un fichier (que je ne vois pas), j'ai choisi le bloc-notes ce matin et j'ai donc pu voir un fichier qui me disait que la clé d'activation de Windows était introuvable (alors que j'ai un Windows tout ce qu'il y a de plus légal et qu'il était activé depuis bien longtemps). Dois-je faire fonctionner un programme anti-malware je ne sais quoi pour m'assurer que tout va bien ?

Merci d'avance

[g3n-h@ckm@n]

hello on va faire un autre diag qui me convient mieux

• désactive ton antivirus le temps du téléchargement et du scan
• Télécharge quickDiag ici : http://www.telecharger.sosvirus.net/download/quickdiag/
• lance-le ( pour vista/7/8/8.1 = clic droit "Executer en tant qu'administrateur" )
  
  
• clique sur "Quick" puis une fois terminé :
• heberge le rapport sur http://upload.sosvirus.net
• donne le lien obtenu dans ta prochaine réponse

note : le rapport sera sur le bureau au nom de QuickDiag_date_heure.txt, et une copie du même nom sera disponible dans ton disque système ( logiquement C: )

[jmnp]

Merci pour la réponse !
Voici le rapport: http://upload.sosvirus.net/download/bl1 ... q8oncttert

[g3n-h@ckm@n]

à premiere vue pas d infections

J'ai reçu une notification de facebook disant que qqun s'était connecté sur mon compte en Thaïlande

tu utilises un proxy ou un VPN ou le navigateur tor ?

[jmnp]

Merci pour la réponse.
Pas de VPN, ni de proxy, ni Tor, non.

[g3n-h@ckm@n]

• Télécharge MalwareBytes Anti-Malware
• Procède à l'installation de celui çi Décocher "Activer l'essai gratuit de Malwarebytes Anti-Malware Premium"
  
  
• Clic sur Examiner maintenant
  
  
• Une fois l'examen terminé vérifie que toutes les détections sont bien cochées, puis clique sur [Supprimer la sélection]
  
  
• Un redémarrage sera peut-être nécessaire, si oui laisse faire et relance ensuite Malwarebytes
• Ouvre l'onglet "Historique" puis "Journaux de l'application"
• Fais un double-clic sur le dernier Scan Log en date (celui du haut)
  
  
• En bas clique sur [Exporter] -> sélectionne "Fichier texte (*.txt)"
  
  
• Dans l'explorateur sélectionne le bureau, nomme-le mbam.txt, clique sur [Enregistrer]
  
  
• Héberge le rapport mbam.txt sur SOSUpload puis donne le lien obtenu.
  -> Tutoriel SosUpload : http://www.sosvirus.net/actu/tutoriel-sosupload/

[jmnp]

Bonsoir et merci,

Voici les rapports. Je dis "les" car au lieu de "scan log" j'ai trouvé:

Journal de protection:
http://upload.sosvirus.net/download/5mu ... l38m4156xq

Journal d'analyse:
http://upload.sosvirus.net/download/bj6 ... 5efnqkh1gl

À tout hasard, j'ai exporté les deux.
Bonne soirée

[g3n-h@ckm@n]

hello

fais juste attention ou tu télécharges les programmes que tu veux évite les sites de grande distribution 01net, softonic, clubic, commentcamarche.net , ils repackent les installeurs avec des adwares, sinon je ne vois rien d'autre , fais ce menage et dis moi ensuite :
http://www.forum-entraide-informatique. ... infection/

[jmnp]

Merci pour ton aide
J'ai suivi les indications, espérons que tout se passera bien désormais.
Bonne soirée

[g3n-h@ckm@n]

ok , au pire tu reviens ....