ComboFix 14-01-23. 01 Vanessa Benko 23/01/2014 14: 13: 05 4 x86

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: bancobrasil.com.br ([www14] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: bancobrasil.com.br ([www2] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: bb.com.br ([www] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: caixa.gov.br ([]https in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: caixa.gov.br ([conectividade] https in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([]* in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([bankline] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([bankline] https in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([clickbanking] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([clickbanking] https in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([guardiao] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([guardiao] https in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([www] * in Sites confiáveis)

O15 - HKU\S-1-5-21-770461102-1528469112-2676766293-1000\..Trusted Domains: itau.com.br ([www] http in Sites confiáveis)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 10.5.1)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 10.5.1)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5B92BF65-9856-4F68-9889-6FB479CB973E}: NameServer = 200.225.197.37,200.225.197.34

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ GbPluginBb: DllName - (C:\Program Files\GbPlugin\gbieh.dll) - C:\Program Files\GbPlugin\gbieh.dll (Banco do Brasil)

O20 - Winlogon\Notify\ GbPluginCef: DllName - (C:\Program Files\GbPlugin\gbiehCef.dll) - C:\Program Files\GbPlugin\gbiehcef.dll (Caixa Economica Federal)

O20 - Winlogon\Notify\ GbPluginUni: DllName - (C:\Program Files\GbPlugin\gbiehUni.dll) - C:\Program Files\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)

O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\Program Files\GbPlugin\gbiehcef.dll (Caixa Economica Federal)

O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\Program Files\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)

O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files\GbPlugin\gbieh.dll (Banco do Brasil)

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corp.)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 19:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

[color=#E56717]========== Files/Folders - Created Within 90 Days ==========[/color]

[2014/01/28 15:15:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Vanessa Benko\Desktop\OTL.exe

[2014/01/27 09:54:59 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Desktop\03 Festa Casamento 25.01.2013

[2014/01/23 14:22:30 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2014/01/23 14:21:29 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2014/01/23 14:10:28 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2014/01/23 14:10:28 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2014/01/23 14:10:28 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2014/01/23 14:09:47 | 000,000,000 | ---D | C] -- C:\Qoobox

[2014/01/23 14:03:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2014/01/23 14:02:29 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2014/01/23 14:02:28 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2014/01/23 14:02:28 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

[2014/01/23 13:59:26 | 000,000,000 | ---D | C] -- C:\Config.Msi

[2014/01/23 13:22:03 | 000,135,168 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2014/01/23 13:22:03 | 000,135,168 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2014/01/23 11:18:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Doctor Web

[2014/01/23 11:18:45 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Doctor Web

[2014/01/22 16:30:05 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Roaming\Malwarebytes

[2014/01/22 16:29:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2014/01/22 16:14:23 | 000,000,000 | ---D | C] -- C:\LinhaDefensiva

[2014/01/22 16:02:42 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Desktop\Nova pasta

[2014/01/22 14:35:22 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\temp

[2014/01/22 14:09:14 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2014/01/22 14:05:40 | 000,178,597 | ---- | C] (Igor Pavlov) -- C:\Users\Vanessa Benko\Desktop\bankerfix.exe

[2014/01/22 09:43:29 | 000,227,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe

[2013/12/30 09:43:49 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Desktop\JW

[2013/12/27 10:00:47 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{1EF0E647-D09B-4255-88A3-112EB52BE327}

[2013/12/26 12:29:48 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{02667677-995A-438B-9FF8-6E07FF6B654C}

[2013/12/26 11:59:00 | 000,064,168 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswstm.sys

[2013/12/23 09:20:30 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{334BF2BA-1863-49F5-8CD0-BED9B2E34D62}

[2013/12/20 10:01:34 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Desktop\Emerson Nogueira

[2013/12/20 09:33:38 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{8FA81CDC-5CA8-4692-BC64-6D1097B45F97}

[2013/12/19 16:54:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\McAfee

[2013/12/19 16:53:59 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee

[2013/12/19 16:52:48 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Documents\Syncios

[2013/12/19 16:52:48 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Roaming\Syncios

[2013/12/19 16:52:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Syncios

[2013/12/19 16:52:33 | 000,000,000 | ---D | C] -- C:\Program Files\Syncios

[2013/12/19 09:13:59 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{34B09575-428E-4647-B95F-7CB5A60FD400}

[2013/12/18 09:12:00 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{DB54A88E-2420-4054-B39C-8B17A13A6931}

[2013/12/17 09:15:05 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{8F1ABEDC-3DFD-4361-ACA7-06E60E56685F}

[2013/12/16 16:07:18 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Documents\iTools

[2013/12/16 16:06:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTools

[2013/12/16 09:18:31 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{3193902F-7732-4824-8718-07361FB82758}

[2013/12/13 10:40:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

[2013/12/13 10:28:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2013/12/12 13:56:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

[2013/12/12 09:26:24 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{B62182C1-5A61-43B4-9568-BB72FC2C9932}

[2013/12/11 09:37:35 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{F0607808-74B3-406C-8BF6-7B0D859B5829}

[2013/12/10 14:25:58 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{62E51257-A783-4E0C-B34B-1060FA1D4DF5}

[2013/12/09 09:05:36 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{145F2D2A-9AC1-4B6A-A5B5-D64E259E9777}

[2013/12/06 09:56:09 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{94AD84AB-45B1-4CC2-B8DB-B13A06C159A1}

[2013/12/06 09:08:19 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Roaming\AVAST Software

[2013/12/05 13:29:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast

[2013/12/05 13:19:45 | 000,104,752 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFW.sys

[2013/12/05 13:19:37 | 000,259,928 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswNdisFlt.sys

[2013/12/05 09:21:58 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{EB3A440F-4A02-47C3-A5B9-BCC3C7ADE1EC}

[2013/12/03 09:16:39 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{BB1D4D44-7172-4475-8F9A-C24A427AA34F}

[2013/12/02 09:14:38 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{1C62A2C1-8B60-4C0E-9DE2-C2F6D946D706}

[2013/11/29 09:15:02 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{EBC75497-B024-4021-A372-7AE89585B824}

[2013/11/28 09:17:04 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{74F5DF49-5E7B-440E-A950-38CBFEDD131A}

[2013/11/27 09:10:16 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{D89B9790-108C-40C1-A581-0A2896F3A19D}

[2013/11/26 09:21:46 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{1BAA1F92-666D-4D88-98FE-AA38B0C385CE}

[2013/11/25 09:11:31 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{8024C878-4A7B-4949-9B4F-4397DD221A67}

[2013/11/22 10:25:47 | 000,000,000 | ---D | C] -- C:\Program Files\DoroPDFWriter

[2013/11/22 09:56:21 | 000,000,000 | ---D | C] -- C:\ProgramData\PDFEditor

[2013/11/22 09:56:19 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Roaming\Wondershare

[2013/11/22 09:28:30 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2013/11/22 09:19:30 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{B4248FA9-1B29-45B6-A9C7-CCBDC3FC71C6}

[2013/11/21 09:10:05 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{C98B0A4A-8666-4A19-BE43-9CAA66A7660C}

[2013/11/20 09:33:27 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{A8F1FAF8-C823-4861-8EB6-64921B96F4C3}

[2013/11/19 09:07:47 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{B9D1F357-2D5D-483B-B088-622BE081200E}

[2013/11/18 11:14:50 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{6B526030-FA26-4438-B61F-C24B731E1AF5}

[2013/11/14 09:20:03 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2013/11/14 09:17:32 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{DD1EC4AE-179E-4390-B7FB-F0053A40A024}

[2013/11/13 09:13:37 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{BED7977D-1C0E-4374-B73A-62A1962D1027}

[2013/11/12 09:09:24 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{8D0DD54A-C56E-4D5A-8045-FF36DF60D4D5}

[2013/11/11 09:24:25 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{6B1A2900-7EE9-499F-ACEA-CA77ECEB49E8}

[2013/11/08 09:02:06 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{3ED781D3-3243-4C43-87BB-C6F22A2F78A4}

[2013/11/07 09:30:57 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{DE043CA3-2EDD-4615-B7CD-35C7653B9D22}

[2013/11/06 10:12:46 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\Evernote

[2013/11/06 10:12:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Evernote

[2013/11/06 10:12:19 | 000,000,000 | ---D | C] -- C:\Program Files\Evernote

[2013/11/06 09:23:46 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{BA9D6B77-EC13-4EE0-86FC-05C2E80D624D}

[2013/11/05 09:36:26 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{7DA84361-E59B-4C1C-B948-1644BD1910B1}

[2013/11/04 09:10:23 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{B2F969A8-82A8-4185-ABC6-51D1AC64194F}

[2013/11/01 11:28:52 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Roaming\Nico Mak Computing

[2013/11/01 11:28:44 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip Registry Optimizer

[2013/11/01 11:28:13 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory

[2013/11/01 11:27:46 | 000,000,000 | ---D | C] -- C:\Program Files\FreeTime

[2013/11/01 11:03:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Wondershare Video Converter Ultimate

[2013/11/01 10:58:39 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\Documents\SnowFox iPad Video Converter

[2013/11/01 09:19:57 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{FD8C5DEC-D815-4E0E-9783-B674B201A076}

[2013/10/31 09:05:38 | 000,000,000 | ---D | C] -- C:\Users\Vanessa Benko\AppData\Local\{63660DD1-1638-43B4-ACFC-E05CBA90AD3C}

[2012/09/14 11:00:15 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Vanessa Benko\AppData\Roaming\pcouffin.sys

[3 C:\Users\Vanessa Benko\Desktop\*.tmp files -> C:\Users\Vanessa Benko\Desktop\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 90 Days ==========[/color]

[2014/01/28 15:17:19 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Vanessa Benko\Desktop\OTL.exe

[2014/01/28 14:47:03 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014/01/28 09:46:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014/01/28 09:14:56 | 000,014,544 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014/01/28 09:14:56 | 000,014,544 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014/01/28 09:07:16 | 000,031,088 | ---- | M] (GbPlugin NDIS Device Driver) -- C:\Windows\System32\drivers\GbpNdisrd.sys

[2014/01/28 09:07:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014/01/28 09:07:02 | 2810,925,056 | -HS- | M] () -- C:\hiberfil.sys

[2014/01/27 16:10:08 | 000,703,370 | ---- | M] () -- C:\Windows\System32\prfh0416.dat

[2014/01/27 16:10:08 | 000,651,938 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2014/01/27 16:10:08 | 000,146,156 | ---- | M] () -- C:\Windows\System32\prfc0416.dat

[2014/01/27 16:10:08 | 000,120,870 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2014/01/23 14:03:51 | 000,001,713 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2014/01/23 13:29:20 | 000,000,043 | ---- | M] () -- C:\Users\Vanessa Benko\sistemaRecebimento.conf

[2014/01/22 16:15:36 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2014/01/22 14:05:49 | 000,178,597 | ---- | M] (Igor Pavlov) -- C:\Users\Vanessa Benko\Desktop\bankerfix.exe

[2014/01/22 09:55:23 | 000,000,082 | ---- | M] () -- C:\Users\Vanessa Benko\AppData\Roaming\WB.CFG

[2014/01/20 14:35:22 | 000,001,953 | ---- | M] () -- C:\Users\Vanessa Benko\Desktop\transf 200 gerson.pdf

[2014/01/16 08:58:38 | 000,735,056 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2014/01/13 15:05:12 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe