[Resolvido] Infestação de malwares: DealNoDeal, SalePlus e outros

Weick · Abril 14, 2015

Pessoal,

Estou com o note infestado de pragas. Quando abro o navegador, várias extensões são instaladas e por mais que eu as delete e as desinstale do note, não consigo me livrar delas, elas sempre voltam. O resultado é que em toda página aparecem propagandas no topo ou no meio da página e às vezes páginas são carregadas automaticamente (estou lendo um artigo, de repente saio do site e estou em uma outra página). Esses anúncios vem com o nome de "Ad by SalePlus" ou "Ad by DealNoDeal" dentre outros.

Obs.: quando rodei o Hijackthis, apareceu uma mensagem dizendo o seguinte:

"For some reasons the system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may not be able to fix this. If that happens, you need to edit the file yourself. To do this, click Start, Run and type: notepad C:\WINDOWS\System32\drivers\etc\hosts and press enter. Find the line(s) HijackThis reports and delete them. Save this file as 'hosts' (with quotes) and reboot."

Segue log:

Logfile of Trend Micro HijackThis v2.0.5

Scan saved at 8:22:42 PM, on 2015-04-14

Platform: Unknown Windows (WinNT 6.02.1008)

MSIE: Internet Explorer v11.0 (11.00.9600.17416)

Boot mode: Normal

Running processes:

C:\PROGRA~2\GbPlugin\GbpSv.exe

C:\ProgramData\{ab512ab1-9c13-6b92-ab51-12ab19c1aac6}\Driver ToolKit 8.3 License Key Crack for Free download.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Vi\Downloads\HijackThis.exe

C:\WINDOWS\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: G-Buster Browser Defense BANESE - {C41A1C0E-EA6C-11D4-B1B8-444553540027} - C:\Program Files (x86)\GbPlugin\gbiehbes.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Policies\Explorer\Run: [btvStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"

O4 - Startup: Driver ToolKit 8.3 License Key Crack for Free download.lnk = C:\ProgramData\{ab512ab1-9c13-6b92-ab51-12ab19c1aac6}\Driver ToolKit 8.3 License Key Crack for Free download.exe

O4 - Startup: Driver Toolkit 8.4 Working License Key and Crack Free Download.lnk = C:\ProgramData\{4e410934-b586-2d1d-4e41-10934b5824d2}\Driver Toolkit 8.4 Working License Key and Crack Free Download.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: www.banese.b.br

O15 - Trusted Zone: wwws.banese.b.br

O15 - Trusted Zone: egov.banese.com.br

O15 - Trusted Zone: www.banese.com.br

O15 - Trusted Zone: wwws.banese.com.br

O15 - Trusted Zone: www.banesecard.com.br

O15 - Trusted Zone: portaldoservidor.se.gov.br

O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL

O20 - Winlogon Notify: GbPluginBes - C:\Program Files (x86)\GbPlugin\gbiehBes.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)

O23 - Service: Easy Launcher - Samsung Electronics CO., LTD. - C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 6405 bytes

Obrigado

DigRam · Abril 15, 2015

/!\ Bom Dia! Weick /!\

"For some reasons the system denied write access to the Hosts file. If any hijacked domains are in this file, HijackThis may not be able to fix this. If that happens, you need to edit the file yourself. To do this, click Start, Run and type: notepad C:\WINDOWS\System32\drivers\etc\hosts and press enter. Find the line(s) HijackThis reports and delete them. Save this file as 'hosts' (with quotes) and reboot."

> Falso positivo do HijackThis,que eventualmente,não tem acesso ao hosts.

> Baixe: < ZHPDiag2.exe > <

> ( ... de Nicolas Coolman )

> Ou aqui! << Link!

> Salve-o no disco local! ( C ou D )

> Desabilite seu antivírus e execute "ZHPDiag2.exe",para instalar a ferramenta.

> Execute o ícone do pergaminho. ( ZHPDiag )

> Clique "COMPLETA" e aguarde a conclusão!

> Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt )

> Ps: Como o log será extenso,envie-o à Pjjoint.malekal.

> Ou acesse: <

>

> Maiores informações: < |Link| > << Hospedagem!

A+

Weick · Abril 18, 2015

Boa tarde,

Obrigado pelo help. Segue log hospedado no pjjoint.malekal.com

http://pjjoint.malekal.com/files.php?id=20150418_z12y8x14g8q12

-Weick

DigRam · Abril 19, 2015

/!\ Bom Dia! Weick /!\

> Execute este script na ferramenta ZHPFix.
> Selecione e copie estas informações que estão em vermelho,para o Bloco de Notas.
> Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c ( Selecionar e Copiar )
> À seguir,minimize o Bloco de Notas.

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
HiddenFix
[MD5.40E9ED890AF3975476A6EE7BFA31BA66] [sPRF][2015-03-10] (.No owner - Setup/Uninstall.) -- C:\Users\Vi\AppData\Roaming\unins000.exe [812193]
[MD5.7488533E2D6A6DE19BD3D01C9BE04023] - (...) -- C:\Users\Vi\AppData\Local\Temp\5F20.exe [485376] [PID.4928]
O2 - BHO: Skype for Business Click to Call BHO [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} Orphan key
C:\ProgramData\boost_interprocess
C:\Users\Vi\AppData\Local\Apps
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCR\CLSID\{ba790571-915e-4617-a10c-cdf3ef46439b}] (youtubeadblocker)
[HKLM\Software\Classes\AppID\secman.DLL]
[HKLM\Software\Wow6432Node\AIM Toolbar]
[HKLM\Software\Baidu Security]
[HKCU\Software\Baidu Security]
[HKCU\Software\Linkey]
sysrestore

> Abra a ferramenta ZHPFix. < >
> Clique IMPORTAÇÃO >> OK.
> Ps: Ao clicar "OK",verifique se o campo está limpo para que receba,somente,as informações do script.
> Clique "GO".
> Poste o relatório!

A+

Weick · Abril 19, 2015

Boa tarde!

Segue log:

Rapport de ZHPFix 2014.10.24.12 par Nicolas Coolman, Update du 24/10/2014

Fichier d'export Registre :

Run by Vi at 2015-04-19 3:23:13 PM

High Elevated Privileges : OK

Windows 8 Home Premium Edition, 64-bit Service Pack 1 (9600)

Recycle Bin emptied (03mn AMs)

Prefetcher emptied

========== Registry keys ==========

REMOVES:* HKCR\CLSID\{ba790571-915e-4617-a10c-cdf3ef46439b}

REMOVES: HKLM\Software\Classes\AppID\secman.DLL

REMOVES: HKLM\Software\Wow6432Node\AIM Toolbar

REMOVES:* HKLM\Software\Baidu Security

REMOVES: HKCU\Software\Baidu Security

REMOVES: HKCU\Software\Linkey

========== Registry values ==========

ABSENT value Standard Profile: FirewallRaz :

ABSENT value Domain Profile: FirewallRaz :

REMOVES: FirewallRaz (Domain) : {9E3D57FC-7C37-4424-9352-4831E97D029D}

REMOVES: FirewallRaz (Domain) : {548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}

REMOVES: FirewallRaz (Domain) : NetPres-In-TCP-NoScope

REMOVES: FirewallRaz (Domain) : NetPres-Out-TCP-NoScope

REMOVES: FirewallRaz (None) : NetPres-WSD-In-UDP

REMOVES: FirewallRaz (None) : NetPres-WSD-Out-UDP

REMOVES: FirewallRaz (Public) : NetPres-In-TCP

REMOVES: FirewallRaz (Public) : NetPres-Out-TCP

REMOVES: FirewallRaz (None) : MCX-Prov-Out-TCP

REMOVES: FirewallRaz (None) : MCX-McrMgr-Out-TCP

REMOVES: FirewallRaz (Domain) : {E7985E1D-C36F-4787-80A8-6350D07E9266}

REMOVES: FirewallRaz (None) : {808F1451-4108-46FD-ADBB-F17324B5F0BD}

========== Elements of the registry data ==========

REPLACES Value NoActiveDesktopChanges : Good (0) - Bad (1)

========== Folders ==========

Deletes temporary Windows (10)

REMOVES Flash Cookies (0)

REMOVES: c:\programdata\boost_interprocess

REMOVES: c:\users\vi\appdata\local\apps

========== Files ==========

Deletes temporary Windows (14) (851,477 octets)

REMOVES Flash Cookies (0) (0 octets)

========== Hidden folders/files restored ==========

Mes images (My Pictures) : 11 restored successfully

Ma musique (My Music) : 7 restored successfully

Ma Video (My Video) : 1 restored successfully

Mes Favoris (My Favorites) : 2 restored successfully

Mes Documents (My Documents) : 1 restored successfully

Mon Bureau (My Desktop) : 1 restored successfully

Menu demarrer (Programs) : 10 restored successfully

Dossier utilisateur (AppData) : 20 restored successfully

Programmes (Program Files) : 17 restored successfully

========== System restore ==========

The system successfully created restore point

========== Summary ==========

6 : Registry keys

14 : Registry values

1 : Elements of the registry data

4 : Folders

2 : Files

70 : Hidden folders/files restored

1 : System restore

End of clean in 20mn AMs

========== Path to file report ==========

C:\Users\Vi\AppData\Roaming\ZHP\ZHPFix[R1].txt - 2015-04-19 3:23:17 PM [2728]

MUITO obrigado,

Weick

DigRam · Abril 19, 2015

/!\ Boa Noite! Weick /!\

> Baixe: <

> ( ... par Xplode )

>

> Ou daqui: < AdwCleaner >

> Ao acessar,clique em "Download Now".

>

> Salve-o no desktop!

<

>

> Clique direito em adwcleaner.exe,e escolha sua execução como administrador.

> Ps: Dê início ao scan,clicando em "Examinar".

> Ao concluir,clique "Limpar" ou "Cleaning" >> Ok >> Ok >> Ok.

> Copie o log ou clique "Relatório".

> Poste: < C:\AdwCleaner\AdwCleaner[s0].txt >

> Baixe: <

> ( ... by Oleg N. Scherbakov )

> Salve-o no desktop!

> Desabilite seu antivírus!

> Para Windows 7,clique direito em JRT.exe e execute-o ...

> Aguarde a conclusão e poste o relatório. ( JRT.txt )

A+

Weick · Abril 20, 2015

Boa noite,

Seguem relatórios:

adwcleaner

# AdwCleaner v4.201 - Logfile created 14/04/2015 at 18:30:55

# Updated 08/04/2015 by Xplode

# Database : 2015-04-08.1 [server]

# Operating system : Windows 8.1 Single Language (x64)

# Username : Vi - VSAM-NB

# Running from : C:\Users\Vi\Downloads\adwcleaner_4.201.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Google Chrome v41.0.2272.118

*************************

AdwCleaner[R0].txt - [738 bytes] - [14/04/2015 18:29:10]

AdwCleaner[s0].txt - [664 bytes] - [14/04/2015 18:30:55]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [722 bytes] ##########

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.5.9 (04.19.2015:1)

OS: Windows 8.1 Single Language x64

Ran by Vi on 2015-04-20 at 19:29:52.88

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2242910852-1522185380-850179407-1001

Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Optimize Start Menu Cache Files-S-1-5-21-2242910852-1522185380-850179407-500

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540027}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540027}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C41A1C0E-EA6C-11D4-B1B8-444553540027}

~~~ Files

Successfully deleted: [File] C:\WINDOWS\prefetch\DRIVER TOOLKIT 8.3 LICENSE KE-2A509D8D.pf

Successfully deleted: [File] C:\WINDOWS\prefetch\DRIVER TOOLKIT 8.4 WORKING LI-F8E4A571.pf

~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\baidu security

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 2015-04-20 at 19:33:23.95

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Obrigado,

DigRam · Abril 21, 2015

/!\ Boa Noite! Weick /!\

> Abra a ferramenta AdwCleaner e clique em "Desinstalar".

> Confirme a solicitação!

> Baixe: <

> ( ... by Smeenk )

<

zoek.exe >

> Salve-o ao desktop!

> Desabilite seu antivírus!

> Feche seu navegador!

> Para Windows 7,execute Zoek.exe como administrador.

emptyfolderscheck;delete

resetieproxy;

chromelook;

firefoxlook;

shortcutfix;

quickscan;

emptytemp;

autoclean;

> Copie e cole estas informações,que estão em vermelho,no campo da ferramenta.

> Clique "Run Script".

Zoek.exe is running now.

Do not start any browser windows, they will be closed automatically.

Please wait! This window will close when finished.

A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

> Surgirão informações,pedindo-lhe que aguarde o surgimento do relatório.

> Ps: Essas informações,podem permanecer estáticas na tela por 30 minutos ou mais.

> Confirme o reboot!

zoek.hta failed by unknown error.

Restart computer, and try again.

> Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.

> Poste o relatório,que estará em C:\zoek-results.txt <<

A+

Weick · Abril 21, 2015

Bom dia!

Zoek rodou sem erros. Segue log

Zoek.exe v5.0.0.0 Updated 08-April-2015

Tool run by Vi on 2015-04-21 at 8:42:53.37.

Microsoft Windows 8.1 Single Language 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Vi\Desktop\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

2015-04-21 8:45:14 AM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully

C:\Users\Vi\AppData\Local\SKIDROW deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\PROGRA~3\aloabmppojelahdamjgjcndbdenoghci deleted

C:\PROGRA~3\epnbmccgpfhkfmlikbbiojjpjehfllkf deleted

C:\PROGRA~3\jkcmbmgehienpclegogefgjkejbbppek deleted

C:\PROGRA~3\{49f71d88-1773-51d1-49f7-71d881777620} deleted

C:\Users\Vi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Driver ToolKit 8.3 License Key Crack for Free download.lnk deleted

C:\Users\Vi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Driver Toolkit 8.4 Working License Key and Crack Free Download.lnk deleted

C:\PROGRA~3\14874686664167840276 deleted

C:\Users\Vi\.android deleted

C:\B000.tmp deleted

C:\ZHPDiag2.exe deleted

C:\Users\Vi\AppData\Roaming\appdataFr3.bin deleted

C:\PROGRA~3\Package Cache deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted

C:\Users\Vi\AppData\Roaming\unins000.exe deleted

C:\PROGRA~3\MakeMarkerFile.exe deleted

"C:\PROGRA~3\{4e410934-b586-2d1d-4e41-10934b5824d2}\5d17585c0f91bd19" not deleted

"C:\PROGRA~3\{4e410934-b586-2d1d-4e41-10934b5824d2}\90eafe0928455acd" not deleted

"C:\PROGRA~3\{ab512ab1-9c13-6b92-ab51-12ab19c1aac6}\23071211da6b8c89" not deleted

"C:\PROGRA~3\{ab512ab1-9c13-6b92-ab51-12ab19c1aac6}\Driver ToolKit 8.3 License Key Crack for Free download.exe" deleted

"C:\PROGRA~3\{ab512ab1-9c13-6b92-ab51-12ab19c1aac6}\eefab444fdbf6b5d" not deleted

"C:\PROGRA~3\{4e410934-b586-2d1d-4e41-10934b5824d2}" not deleted

"C:\PROGRA~3\{ab512ab1-9c13-6b92-ab51-12ab19c1aac6}" not deleted

==== Files Recently Created / Modified ======================

====== C:\WINDOWS ====

2015-04-20 22:30:01 CA2A8AF1DBAD0F31F9B33A2827DFBC16 207 ----a-w- C:\WINDOWS\tweaking.com-regbackup-VSAM-NB-Windows-8.1-Single-Language-(64-bit).dat

====== C:\Users\Vi\AppData\Local\Temp ====

2015-04-21 11:38:50 7488533E2D6A6DE19BD3D01C9BE04023 485376 ----a-w- C:\Users\Vi\AppData\Local\Temp\C548.exe

2015-04-20 22:51:03 7488533E2D6A6DE19BD3D01C9BE04023 485376 ----a-w- C:\Users\Vi\AppData\Local\Temp\20D8.exe

2015-04-20 22:29:27 FDD26A402322F212DCA153FF8B1FFB6E 78816 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\tweaking.com_registry_backup_portable\pcwintech_tasksch.dll

2015-04-20 22:29:27 DC7A3BC0FC185CD68848DC6F7D7B026B 40960 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\tweaking.com_registry_backup_portable\SSubTmr6.dll

2015-04-20 22:29:27 547C43567AB8C08EB30F6C6BACB479A3 79360 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\regex2.dll

2015-04-20 22:29:26 E0DC8C6BBC787B972A9A468648DBFD85 1008128 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\libiconv2.dll

2015-04-20 22:29:26 D202BAA425176287017FFE1FB5D1B77C 103424 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\libintl3.dll

2015-04-20 22:29:26 A107DE2D120C0571B544EEC53D1971AB 1406208 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\tweaking.com_registry_backup_portable\TweakingRegistryBackup.exe

2015-04-20 22:29:26 57CAC848FA14AE38F14F9441F8933282 140288 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\pcre3.dll

2015-04-20 22:29:26 1B128828BF5E4353811B6DA58156B7F4 6656 ----a-w- C:\Users\Vi\AppData\Local\Temp\jrt\tweaking.com_registry_backup_portable\files\dosdev.exe

2015-04-20 22:28:08 7488533E2D6A6DE19BD3D01C9BE04023 485376 ----a-w- C:\Users\Vi\AppData\Local\Temp\2D80.exe

2015-04-20 21:03:32 7488533E2D6A6DE19BD3D01C9BE04023 485376 ----a-w- C:\Users\Vi\AppData\Local\Temp\C5D8.exe

2015-04-20 15:39:30 7488533E2D6A6DE19BD3D01C9BE04023 485376 ----a-w- C:\Users\Vi\AppData\Local\Temp\8F40\temp\2880.exe

2015-04-20 12:48:46 1412FA64CD13E44E85D51FDDC97CFCAB 385024 ----a-w- C:\Users\Vi\AppData\Local\Temp\BE78\temp\Chaturbate Token Hack Tool 2014 Fully Cracked Working Cheats.exe

2015-04-20 12:48:39 1412FA64CD13E44E85D51FDDC97CFCAB 385024 ----a-w- C:\Users\Vi\AppData\Local\Temp\D000.exe

2015-04-19 19:06:18 376E4CFAA0CB5B487B2B5A5426BEA58A 40448 ------w- C:\Users\Vi\AppData\Local\Temp\proxy_vole8753661764148910314.dll

====== Java Cache =====

====== C:\WINDOWS\SysWOW64 =====

2015-04-14 20:32:04 8A4CEBF34370D689E198E6673C1F2C40 74072 ----a-w- C:\WINDOWS\SysWOW64\XAPOFX1_5.dll

2015-04-14 20:32:04 81DFDDFB401D663BA7E6AD1C80364216 527192 ----a-w- C:\WINDOWS\SysWOW64\XAudio2_7.dll

2015-04-14 20:32:00 1C9B45E87528B8BB8CFA884EA0099A85 2106216 ----a-w- C:\WINDOWS\SysWOW64\D3DCompiler_43.dll

2015-04-14 20:31:58 8E0BB968FF41D80E5F2C747C04DB79AE 248672 ----a-w- C:\WINDOWS\SysWOW64\d3dx11_43.dll

2015-04-14 20:31:43 501AC862517C5445742BEE8A2B88414E 453456 ----a-w- C:\WINDOWS\SysWOW64\d3dx10_42.dll

2015-04-14 20:31:31 91B4AAD4412BB223B466F3DFB43E86DA 452440 ----a-w- C:\WINDOWS\SysWOW64\d3dx10_40.dll

2015-04-14 20:31:31 3384134EEB8F223178C2EB8323003EC0 2036576 ----a-w- C:\WINDOWS\SysWOW64\D3DCompiler_40.dll

2015-04-14 20:31:28 EEA5E428CE63804F9B12D21C97B5968F 4379984 ----a-w- C:\WINDOWS\SysWOW64\D3DX9_40.dll

2015-04-14 20:30:39 26AF232140C88B42D92A88F2198EDF6A 3426072 ----a-w- C:\WINDOWS\SysWOW64\d3dx9_32.dll

====== C:\WINDOWS\SysWOW64\drivers =====

====== C:\WINDOWS\Sysnative =====

2015-04-15 10:52:18 2C1EA4F0084B46604F4F437776551F36 33592 ----a-w- C:\WINDOWS\Sysnative\WinDivert.dll

2015-04-15 10:52:14 8D568B1E99BAD4BCC9B58A06E22A5354 37592 ----a-w- C:\WINDOWS\Sysnative\WinDivert64.sys

2015-04-14 20:32:04 E9739AE8B2FA28DCD6F2EF5525DA8827 77656 ----a-w- C:\WINDOWS\Sysnative\XAPOFX1_5.dll

2015-04-14 20:32:04 4F7513FF4DE6303088DB28DCBCEF372C 518488 ----a-w- C:\WINDOWS\Sysnative\XAudio2_7.dll

2015-04-14 20:32:00 ADA0C39D4EACDC81FD84163A95D62079 2526056 ----a-w- C:\WINDOWS\Sysnative\D3DCompiler_43.dll

2015-04-14 20:31:58 9D6429F410597750B2DC2579B2347303 276832 ----a-w- C:\WINDOWS\Sysnative\d3dx11_43.dll

2015-04-14 20:31:43 B739C423276AE62D7AC91773226EC13B 523088 ----a-w- C:\WINDOWS\Sysnative\d3dx10_42.dll

2015-04-14 20:31:31 862586AD4B1355F7DCDE111EE0AAF350 519000 ----a-w- C:\WINDOWS\Sysnative\d3dx10_40.dll

2015-04-14 20:31:31 37309B833480DC69FDE7DB68F9B8BC20 2605920 ----a-w- C:\WINDOWS\Sysnative\D3DCompiler_40.dll

2015-04-14 20:31:28 29A79F0B607FAF5722D7BAF2485F632A 5631312 ----a-w- C:\WINDOWS\Sysnative\D3DX9_40.dll

2015-04-14 20:30:39 A4DDFE5DC4E73D1FED9B1B3A3D885612 4398360 ----a-w- C:\WINDOWS\Sysnative\d3dx9_32.dll

====== C:\WINDOWS\Sysnative\drivers =====

====== C:\WINDOWS\Tasks ======

2015-04-20 22:01:52 2F054AEE40DBE612F91E6326098C97E2 3026 ----a-w- C:\WINDOWS\Sysnative\Tasks\{264FE75D-0388-4912-AEBD-A87D13C15167}

====== C:\WINDOWS\Temp ======

======= C:\Program Files =====

2015-04-15 10:52:14 -------- d-----w- C:\Program Files\Diebold

======= C:\PROGRA~2 =====

2015-04-19 18:48:34 -------- d-----w- C:\PROGRA~2\QuickPar

2015-04-19 18:25:28 -------- d-----w- C:\PROGRA~2\WinRAR

2015-04-18 16:29:20 -------- d-----w- C:\PROGRA~2\ZHPDiag

2015-04-15 10:52:14 -------- d-----w- C:\PROGRA~2\GAS Tecnologia

2015-04-15 10:52:14 -------- d-----w- C:\PROGRA~2\Diebold

======= C: =====

2015-04-18 16:40:00 95E18B5ED8B20C32AE8A5068FFA72709 512 ----a-w- C:\PhysicalDisk0_MBR.bin

2015-04-14 00:18:10 D334E627DB2B9CACCB4FD7591E1D6454 1024 ----a-w- C:\.rnd

====== C:\Users\Vi\AppData\Roaming ======

2015-04-21 11:39:19 -------- d-----r- C:\Users\Vi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices

2015-04-19 19:08:48 -------- d-----w- C:\Users\Vi\AppData\Local\QuickPar

2015-04-19 18:48:37 -------- d-----w- C:\Users\Vi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QuickPar

2015-04-19 18:25:55 -------- d-----w- C:\Users\Vi\AppData\Roaming\WinRAR

2015-04-19 18:25:36 -------- d-----w- C:\Users\Vi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-04-18 21:19:05 -------- d-----w- C:\Users\Vi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDownloader

2015-04-18 20:33:00 -------- d-----w- C:\Users\Vi\AppData\Local\JDownloader 2.0

2015-04-18 16:29:20 -------- d-----w- C:\Users\Vi\AppData\Roaming\ZHP

2015-04-14 00:15:49 -------- d-----w- C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Programs

2015-04-09 23:57:02 -------- d-----w- C:\Users\Vi\AppData\Locallow\Adobe

2015-04-06 00:06:05 -------- d-----w- C:\Users\Vi\AppData\Roaming\dvdcss

2015-03-26 20:48:58 -------- d-----w- C:\Users\Vi\AppData\Roaming\vlc

====== C:\Users\Vi ======

2015-04-20 12:37:24 7CCCC76D58F6BC06446885D389AD9933 2684539 ----a-w- C:\Users\Vi\Downloads\JRT.exe

2015-04-19 18:48:37 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickPar

2015-04-19 18:48:04 6FB201020B62B57586CA762DEC51A982 501363 ----a-w- C:\Users\Vi\Downloads\QuickPar-0.9.1.0.exe

2015-04-19 18:25:37 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

2015-04-19 18:21:52 9B6F7231533F04B75F3B3C86CB9D0117 1941744 ----a-w- C:\Users\Vi\Downloads\winrar-x64-521.exe

2015-04-18 17:26:26 D14E892FE0F82244F2EEEAF75D58A3AB 36403448 ----a-w- C:\Users\Vi\Downloads\JDownloader2Setup.exe

2015-04-18 16:59:55 8CB58620F4651954C5F7539B0A301E92 4463952 ----a-w- C:\Users\Vi\Downloads\dolphin-4.0-win64.exe

2015-04-18 16:29:29 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP

2015-04-14 20:21:49 7C1FC2021CF57FED3C25C9B03CD0C31A 100271992 ----a-w- C:\Users\Vi\Downloads\directx_Jun2010_redist.exe

2015-04-14 20:05:07 31D2409237481996E00505054E68BA3E 21540440 ----a-w- C:\Users\Vi\Downloads\mbam-setup-2.1.4.1018.exe

2015-04-14 00:14:13 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

====== C: exe-files ==