Estoy siendo extorsionado por un Hacker


#1

recibi un correo en mi cuenta de ono en ingles donde me desian mi contraseña de gmail y me pedian una cantidad de bitcoins ingresados a su cuenta. Lastima que borre el correo .

el adaware me detecta fijo PUP.Adaware.Heuristic

el Malawarebites Premiun me detectaTrojan.Agent.Generic y Generic Malaware-Suspicious

aqui les dejo el ultimo informe de Malawarebites Premium

www.malwarebytes.com

-Detalles del registro-
Fecha del análisis: 12/11/18
Hora del análisis: 22:19
Archivo de registro: a7cfc540-e6c0-11e8-83fb-309c23233668.json

-Información del software-
Versión: 3.6.1.2711
Versión de los componentes: 1.0.482
Versión del paquete de actualización: 1.0.7811
Licencia: Premium

-Información del sistema-
SO: Windows 10 (Build 17134.345)
CPU: x64
Sistema de archivos: NTFS
Usuario: DESKTOP-51BG0PM\Marcos

-Resumen del análisis-
Tipo de análisis: Análisis de amenazas
Análisis iniciado por:: Manual
Resultado: Completado
Objetos analizados: 342648
Amenazas detectadas: 1
Amenazas en cuarentena: 0
Tiempo transcurrido: 9 min, 23 seg

-Opciones de análisis-
Memoria: Activado
Inicio: Activado
Sistema de archivos: Activado
Archivo: Activado
Rootkits: Activado
Heurística: Activado
PUP: Detectar
PUM: Detectar

-Detalles del análisis-
Proceso: 0
(No hay elementos maliciosos detectados)

Módulo: 0
(No hay elementos maliciosos detectados)

Clave del registro: 0
(No hay elementos maliciosos detectados)

Valor del registro: 1
Trojan.Agent.AutoIt, HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|9EF66CEA, Sin acciones por parte del usuario, [4802], [593741],1.0.7811

Datos del registro: 0
(No hay elementos maliciosos detectados)

Secuencia de datos: 0
(No hay elementos maliciosos detectados)

Carpeta: 0
(No hay elementos maliciosos detectados)

Archivo: 0
(No hay elementos maliciosos detectados)

Sector físico: 0
(No hay elementos maliciosos detectados)

WMI: 0
(No hay elementos maliciosos detectados)


(end)

#2

Hola @Atacuperche, te doy la bienvenida al foro de InfoSpyware.

En cuanto al email en si, “no te preocupes” tanto… se trata de un Scam, aunque obviamente cambia tu contraseña en todos los sitios donde utilices esas.

Estas fueron obtenidas de los resientes hackeos a sitios como LinkedIn y Adobe, entre otros de donde se obtuvieron los datos que utilizan para enviar de forma automatizada.

Y por supuesto, que elimina todos los PUPs que te pueda detectar Malwarebytes.

Salu2


#3

AdwCleaner no me elimina una PUP


# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build:    09-25-2018
# Database: 2018-11-05.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    11-13-2018
# Duration: 00:00:02
# OS:       Windows 10 Pro
# Cleaned:  1
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\ProgramData\9EF66CEA

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [8777 octets] - [30/07/2018 09:24:18]
AdwCleaner[C00].txt - [7820 octets] - [30/07/2018 09:24:44]
AdwCleaner[S01].txt - [1419 octets] - [30/07/2018 14:30:20]
AdwCleaner[C01].txt - [1585 octets] - [30/07/2018 14:35:55]
AdwCleaner[S02].txt - [1485 octets] - [30/07/2018 16:33:42]
AdwCleaner[C02].txt - [1671 octets] - [30/07/2018 16:35:01]
AdwCleaner[S03].txt - [1607 octets] - [31/07/2018 03:04:41]
AdwCleaner[S04].txt - [1668 octets] - [03/08/2018 18:38:46]
AdwCleaner[C04].txt - [1854 octets] - [03/08/2018 18:39:07]
AdwCleaner[S05].txt - [1790 octets] - [11/08/2018 14:04:49]
AdwCleaner[C05].txt - [1976 octets] - [11/08/2018 14:05:13]
AdwCleaner[S06].txt - [1912 octets] - [13/08/2018 08:36:00]
AdwCleaner[S07].txt - [1973 octets] - [13/08/2018 08:36:33]
AdwCleaner[C07].txt - [2159 octets] - [13/08/2018 08:36:53]
AdwCleaner[S08].txt - [2095 octets] - [20/08/2018 21:55:41]
AdwCleaner[C08].txt - [2281 octets] - [20/08/2018 21:56:14]
AdwCleaner[S09].txt - [3057 octets] - [02/09/2018 15:45:13]
AdwCleaner[C09].txt - [3059 octets] - [02/09/2018 15:45:36]
AdwCleaner[S10].txt - [8084 octets] - [05/09/2018 22:46:46]
AdwCleaner[C10].txt - [7473 octets] - [05/09/2018 22:47:07]
AdwCleaner[S11].txt - [2469 octets] - [05/09/2018 22:51:35]
AdwCleaner[S12].txt - [9365 octets] - [24/09/2018 04:53:32]
AdwCleaner[C12].txt - [8574 octets] - [24/09/2018 04:53:59]
AdwCleaner[S13].txt - [2640 octets] - [24/09/2018 05:03:21]
AdwCleaner[S14].txt - [2701 octets] - [24/09/2018 17:35:33]
AdwCleaner[S15].txt - [2762 octets] - [26/09/2018 04:40:17]
AdwCleaner[S16].txt - [2835 octets] - [27/09/2018 15:06:41]
AdwCleaner[C16].txt - [3021 octets] - [27/09/2018 15:06:57]
AdwCleaner[S17].txt - [2957 octets] - [30/09/2018 22:09:31]
AdwCleaner[C17].txt - [3143 octets] - [30/09/2018 22:09:43]
AdwCleaner[S18].txt - [3278 octets] - [03/10/2018 20:33:08]
AdwCleaner[C18].txt - [3426 octets] - [03/10/2018 20:33:30]
AdwCleaner[S19].txt - [3201 octets] - [04/10/2018 21:27:10]
AdwCleaner[S20].txt - [3262 octets] - [05/10/2018 22:54:13]
AdwCleaner[S21].txt - [3323 octets] - [10/10/2018 17:26:25]
AdwCleaner[S22].txt - [3412 octets] - [14/10/2018 21:38:04]
AdwCleaner[C22].txt - [3578 octets] - [14/10/2018 21:38:20]
AdwCleaner[S23].txt - [3534 octets] - [15/10/2018 03:07:02]
AdwCleaner[C23].txt - [3700 octets] - [15/10/2018 03:07:21]
AdwCleaner[S24].txt - [3656 octets] - [15/10/2018 10:54:07]
AdwCleaner[C24].txt - [3822 octets] - [15/10/2018 10:54:24]
AdwCleaner[S25].txt - [3778 octets] - [15/10/2018 17:04:04]
AdwCleaner[C25].txt - [3944 octets] - [15/10/2018 17:04:17]
AdwCleaner[S26].txt - [3900 octets] - [15/10/2018 21:47:42]
AdwCleaner[C26].txt - [4066 octets] - [15/10/2018 21:48:05]
AdwCleaner[S27].txt - [4022 octets] - [17/10/2018 14:16:21]
AdwCleaner[C27].txt - [4188 octets] - [17/10/2018 14:16:36]
AdwCleaner[S28].txt - [4144 octets] - [27/10/2018 13:53:02]
AdwCleaner[C28].txt - [4310 octets] - [27/10/2018 13:53:28]
AdwCleaner[S29].txt - [4266 octets] - [29/10/2018 13:33:54]
AdwCleaner[C29].txt - [4432 octets] - [29/10/2018 13:35:02]
AdwCleaner[S30].txt - [4587 octets] - [31/10/2018 06:43:48]
AdwCleaner[C30].txt - [4715 octets] - [31/10/2018 06:44:02]
AdwCleaner[S31].txt - [4510 octets] - [01/11/2018 06:39:39]
AdwCleaner[C31].txt - [4676 octets] - [01/11/2018 06:39:54]
AdwCleaner[S32].txt - [4705 octets] - [05/11/2018 12:46:09]
AdwCleaner[C32].txt - [4851 octets] - [05/11/2018 12:46:20]
AdwCleaner[S33].txt - [4754 octets] - [06/11/2018 05:16:06]
AdwCleaner[C33].txt - [4920 octets] - [06/11/2018 05:16:19]
AdwCleaner[S34].txt - [4925 octets] - [06/11/2018 06:38:20]
AdwCleaner[C34].txt - [5071 octets] - [06/11/2018 06:38:54]
AdwCleaner[S35].txt - [4970 octets] - [06/11/2018 09:02:20]
AdwCleaner[C35].txt - [5156 octets] - [06/11/2018 09:03:07]
AdwCleaner[S36].txt - [5092 octets] - [06/11/2018 13:51:21]
AdwCleaner[S37].txt - [5756 octets] - [07/11/2018 01:09:24]
AdwCleaner[C37].txt - [5772 octets] - [07/11/2018 01:09:54]
AdwCleaner[S38].txt - [5303 octets] - [07/11/2018 07:53:15]
AdwCleaner[C38].txt - [5469 octets] - [07/11/2018 07:53:29]
AdwCleaner[S39].txt - [5425 octets] - [07/11/2018 09:06:39]
AdwCleaner[C39].txt - [5591 octets] - [07/11/2018 09:06:51]
AdwCleaner[S40].txt - [5519 octets] - [07/11/2018 12:33:04]
AdwCleaner[S41].txt - [5580 octets] - [07/11/2018 15:07:02]
AdwCleaner[S42].txt - [5641 octets] - [07/11/2018 19:44:36]
AdwCleaner[S43].txt - [5730 octets] - [10/11/2018 02:28:48]
AdwCleaner[C43].txt - [5896 octets] - [10/11/2018 02:29:01]
AdwCleaner[S44].txt - [5852 octets] - [10/11/2018 02:34:11]
AdwCleaner[C44].txt - [6018 octets] - [10/11/2018 02:35:15]
AdwCleaner[S45].txt - [5974 octets] - [10/11/2018 02:41:30]
AdwCleaner[C45].txt - [6140 octets] - [10/11/2018 02:41:53]
AdwCleaner[S46].txt - [6096 octets] - [10/11/2018 02:49:31]
AdwCleaner[C46].txt - [6262 octets] - [10/11/2018 02:49:46]
AdwCleaner[S47].txt - [6218 octets] - [10/11/2018 02:55:10]
AdwCleaner[C47].txt - [6384 octets] - [10/11/2018 02:55:20]
AdwCleaner[S48].txt - [6312 octets] - [10/11/2018 03:05:00]
AdwCleaner[S49].txt - [6373 octets] - [10/11/2018 03:17:52]
AdwCleaner[S50].txt - [6462 octets] - [10/11/2018 21:52:56]
AdwCleaner[C50].txt - [6628 octets] - [10/11/2018 21:53:17]
AdwCleaner[S51].txt - [6584 octets] - [11/11/2018 03:43:41]
AdwCleaner[C51].txt - [6750 octets] - [11/11/2018 03:43:51]
AdwCleaner[S52].txt - [6706 octets] - [11/11/2018 03:51:20]
AdwCleaner[C52].txt - [6872 octets] - [11/11/2018 03:51:31]
AdwCleaner[S53].txt - [6828 octets] - [11/11/2018 14:32:59]
AdwCleaner[C53].txt - [6994 octets] - [11/11/2018 14:33:07]
AdwCleaner[S54].txt - [6922 octets] - [11/11/2018 14:40:14]
AdwCleaner[S55].txt - [6983 octets] - [11/11/2018 15:47:54]
AdwCleaner[S56].txt - [7072 octets] - [12/11/2018 12:42:04]
AdwCleaner[C56].txt - [7238 octets] - [12/11/2018 12:42:12]
AdwCleaner[S57].txt - [7166 octets] - [12/11/2018 12:50:26]
AdwCleaner[S58].txt - [7227 octets] - [12/11/2018 13:34:47]
AdwCleaner[S59].txt - [7316 octets] - [12/11/2018 16:55:59]
AdwCleaner[C59].txt - [7482 octets] - [12/11/2018 16:57:21]
AdwCleaner[S60].txt - [7438 octets] - [12/11/2018 17:04:27]
AdwCleaner[C60].txt - [7604 octets] - [12/11/2018 17:05:40]
AdwCleaner[S61].txt - [7532 octets] - [12/11/2018 17:14:03]
AdwCleaner[S62].txt - [7593 octets] - [12/11/2018 17:34:33]
AdwCleaner[S63].txt - [7682 octets] - [12/11/2018 21:42:46]
AdwCleaner[C63].txt - [7848 octets] - [12/11/2018 21:43:05]
AdwCleaner[S64].txt - [7776 octets] - [12/11/2018 23:21:22]
AdwCleaner[S65].txt - [7865 octets] - [13/11/2018 00:37:01]
AdwCleaner[C65].txt - [8031 octets] - [13/11/2018 00:37:11]
AdwCleaner[S66].txt - [7987 octets] - [13/11/2018 00:42:47]
AdwCleaner[C66].txt - [8153 octets] - [13/11/2018 00:44:33]
AdwCleaner[S67].txt - [8109 octets] - [13/11/2018 00:50:35]
AdwCleaner[C67].txt - [8275 octets] - [13/11/2018 00:50:51]
AdwCleaner[S68].txt - [8203 octets] - [13/11/2018 00:58:51]
AdwCleaner[S69].txt - [8264 octets] - [13/11/2018 01:26:05]
AdwCleaner[S70].txt - [8353 octets] - [13/11/2018 02:10:41]
AdwCleaner[C70].txt - [8519 octets] - [13/11/2018 02:13:37]
AdwCleaner[S71].txt - [8475 octets] - [13/11/2018 02:26:58]
AdwCleaner[C71].txt - [8641 octets] - [13/11/2018 02:27:11]
AdwCleaner[S72].txt - [8597 octets] - [13/11/2018 03:31:32]
AdwCleaner[C72].txt - [8763 octets] - [13/11/2018 03:32:17]
AdwCleaner[S73].txt - [8719 octets] - [13/11/2018 03:40:37]
AdwCleaner[C73].txt - [8885 octets] - [13/11/2018 03:40:48]
AdwCleaner[S74].txt - [8841 octets] - [13/11/2018 03:48:32]
AdwCleaner[C74].txt - [9007 octets] - [13/11/2018 03:48:50]
AdwCleaner[S75].txt - [8963 octets] - [13/11/2018 05:08:07]
AdwCleaner[C75].txt - [9129 octets] - [13/11/2018 05:08:18]
AdwCleaner[S76].txt - [9085 octets] - [13/11/2018 05:55:23]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C76].txt ##########

ni con Fileassassin no puedo eliminarlo


#4
Malwarebytes
www.malwarebytes.com

-Detalles del registro-
Fecha del análisis: 13/11/18
Hora del análisis: 6:03
Archivo de registro: 79d269c3-e701-11e8-9fd0-309c23233668.json

-Información del software-
Versión: 3.6.1.2711
Versión de los componentes: 1.0.482
Versión del paquete de actualización: 1.0.7817
Licencia: Premium

-Información del sistema-
SO: Windows 10 (Build 17134.376)
CPU: x64
Sistema de archivos: NTFS
Usuario: DESKTOP-51BG0PM\Marcos

-Resumen del análisis-
Tipo de análisis: Análisis de amenazas
Análisis iniciado por:: Manual
Resultado: Completado
Objetos analizados: 342607
Amenazas detectadas: 6
Amenazas en cuarentena: 6
Tiempo transcurrido: 10 min, 37 seg

-Opciones de análisis-
Memoria: Activado
Inicio: Activado
Sistema de archivos: Activado
Archivo: Activado
Rootkits: Activado
Heurística: Activado
PUP: Detectar
PUM: Detectar

-Detalles del análisis-
Proceso: 0
(No hay elementos maliciosos detectados)

Módulo: 0
(No hay elementos maliciosos detectados)

Clave del registro: 0
(No hay elementos maliciosos detectados)

Valor del registro: 1
Trojan.Agent.Generic, HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|9ef66cea, Se eliminará al reiniciar, [3705], [597397],1.0.7817

Datos del registro: 0
(No hay elementos maliciosos detectados)

Secuencia de datos: 0
(No hay elementos maliciosos detectados)

Carpeta: 1
Trojan.Agent.Generic, C:\PROGRAMDATA\9ef66cea, Se eliminará al reiniciar, [3705], [597397],1.0.7817

Archivo: 4
Trojan.Agent.Generic, C:\PROGRAMDATA\9ef66cea\test.au3, Se eliminará al reiniciar, [3705], [597397],1.0.7817
Trojan.Agent.Generic, C:\ProgramData\9ef66cea\9ef66cea.exe, Se eliminará al reiniciar, [3705], [597397],1.0.7817
Trojan.Agent.Generic, C:\ProgramData\9ef66cea\PE.bin, Se eliminará al reiniciar, [3705], [597397],1.0.7817
Trojan.Agent.Generic, C:\ProgramData\9ef66cea\shell.txt, Se eliminará al reiniciar, [3705], [597397],1.0.7817

Sector físico: 0
(No hay elementos maliciosos detectados)

WMI: 0
(No hay elementos maliciosos detectados)


(end)

#5

Hola

Descarga Farbar Recovery Scan Tool. en el escritorio, seleccionando la versión adecuada para la arquitectura(32 o 64bits) de tu equipo. :arrow_forward: ¿Cómo saber si mi Windows es de 32 o 64 bits.?

  • Ejecuta FRST.exe.
  • En el mensaje de la ventana del Disclaimer, pulsamos Yes
  • En la ventana principal pulsamos en el botón Scan y esperamos a que concluya el proceso.
  • Se abrirán dos(2) archivos(Logs), Frst.txt y Addition.txt, estos quedaran grabados en el escritorio.

Pon los dos reportes generados.

Debes copiarlos y pegarlos con todo su contenido y usaras varios mensajes si recibes un mensaje de error indicando que es muy largo(mas de 50.000 caracteres aprox.).

Un saludo


#6

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11.11.2018
Ran by Marcos (administrator) on DESKTOP-51BG0PM (13-11-2018 07:43:35)
Running from C:\Users\Marcos\Desktop
Loaded Profiles: Marcos (Available Profiles: Marcos)
Platform: Windows 10 Pro Version 1803 17134.376 (X64) Language: Español (España, internacional)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 2019\Nero BackItUp\NBService.exe
(Nitro PDF Software) C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe
() C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(BitTorrent Inc.) C:\Users\Marcos\AppData\Roaming\BitTorrent\BitTorrent.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Mega Limited) C:\Users\Marcos\AppData\Local\MEGAsync\MEGAsync.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\systeminfo.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 2019\Nero BackItUp\BackItUp.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Nero AG) C:\Program Files (x86)\Nero\Transfer\Transfer.exe
(Zbshareware Lab) C:\Program Files (x86)\USB Disk Security\USBGuard.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\vkise.exe
(BitTorrent Inc.) C:\Users\Marcos\AppData\Roaming\BitTorrent\updates\7.10.4_44633\bittorrentie.exe
(BitTorrent Inc.) C:\Users\Marcos\AppData\Roaming\BitTorrent\updates\7.10.4_44633\bittorrentie.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9229280 2017-05-18] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2670056 2018-09-10] (Adobe Systems, Incorporated)
HKLM\...\Run: [COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1598144 2018-10-29] (COMODO)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242392 2018-11-07] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Nero BackItUp] => C:\Program Files (x86)\Nero\Nero 2019\Nero BackItup\BackItUp.exe [1170712 2018-08-07] (Nero AG)
HKLM-x32\...\Run: [DriveSpan] => C:\Program Files (x86)\Nero\Transfer\Transfer.exe [138520 2018-08-29] (Nero AG)
HKLM-x32\...\Run: [USB Security] => C:\Program Files (x86)\USB Disk Security\USBGuard.exe [695528 2015-01-31] (Zbshareware Lab)
HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [4251336 2018-10-10] (COMODO)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [BitTorrent] => C:\Users\Marcos\AppData\Roaming\BitTorrent\BitTorrent.exe [1993664 2018-10-12] (BitTorrent Inc.)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [TIDAL] => C:\Users\Marcos\AppData\Local\TIDAL\update.exe [1872168 2018-11-05] ()
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [18594760 2018-09-19] (Piriform Ltd)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [9ef66cea] => C:\ProgramData\9ef66cea\9ef66cea.exe [937776 2018-11-13] (AutoIt Team)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [9ef66cea2] => C:\ProgramData\EPZINY\9ef66cea.exe [937776 2018-11-13] (AutoIt Team)
Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\39ef66cea7f6fd56e0cf454a162647bf.lnk [2018-11-13]
ShortcutTarget: 39ef66cea7f6fd56e0cf454a162647bf.lnk -> C:\DESKTOP-51BG0PM\swtknafkxq.exe (AutoIt Team)
Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2018-10-05]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Marcos\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 212.40.224.73 62.42.230.24
Tcpip\..\Interfaces\{7eafddf7-d1e6-4435-9929-fabbd50a8078}: [NameServer] 77.234.40.79
Tcpip\..\Interfaces\{b7683127-4afb-470e-a22b-325af95007f6}: [DhcpNameServer] 212.40.224.73 62.42.230.24

Internet Explorer:
==================
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://es.yahoo.com/?fr=fp-comodo&type=33050001005_11.0.0.6728_i_hp_sp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File

FireFox:
========
FF DefaultProfile: nmun83lg.default
FF ProfilePath: C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default [2018-11-13]
FF user.js: detected! => C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\user.js [2018-10-30]
FF Homepage: Mozilla\Firefox\Profiles\nmun83lg.default -> hxxps://es.yahoo.com/?fr=fp-comodo&type=33050001004_11.0.0.6728_i_hp_sp
FF Extension: (Avast Passwords) - C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\Extensions\[email protected] [2018-11-07]
FF Extension: (Avast SafePrice) - C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\Extensions\[email protected] [2018-11-07]
FF Extension: (Avast Online Security) - C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\Extensions\[email protected] [2018-11-07]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi => not found
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi => not found
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 10\npnitromozilla.dll [2016-03-03] (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-07-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-07-30] (Google Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxps://www.google.es/","hxxps://www.google.com/","hxxp://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://es.yahoo.com/?fr=fpc-comodo&type=33050001006_11.0.0.6728_i_hp_sp","hxxps://es.yahoo.com/?fr=fpc-comodo&type=81_33050001006_69.0.3497.81_u_hp_sp"
CHR Profile: C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default [2018-11-13]
CHR Extension: (Presentaciones) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-07-30]
CHR Extension: (Dr.Web Anti-Virus Link Checker) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aleggpabliehgbeagmfhnodcijcmbonb [2018-07-30]
CHR Extension: (Documentos) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-07-30]
CHR Extension: (Google Drive) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-17]
CHR Extension: (YouTube) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-07-30]
CHR Extension: (Adblock Plus) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-10-31]
CHR Extension: (Spotify - Music for every moment) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnkjkdjlofllcpbemipjbcpfnglbgieh [2018-07-30]
CHR Extension: (FLV Player) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhogabmliblgpadclikpkjfnnipeebjm [2018-07-30]
CHR Extension: (Avast Passwords) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\emhginjpijfggbofeediiojmdlmlkoik [2018-11-13]
CHR Extension: (Avast SafePrice | Comparaciones, ofertas y cupones) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-11-13]
CHR Extension: (Drive ePub, PDF book to Google Books™) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabbklgdcbijclhlffpmllpgnkalmbfd [2018-07-30]
CHR Extension: (Hojas de cálculo) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-07-30]
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-17]
CHR Extension: (MagicScroll eBook Reader) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgnmgfdoiplfmhgghbmlphanpfmjble [2018-07-30]
CHR Extension: (AdBlock) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-10-11]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2018-11-02]
CHR Extension: (Avast Online Security) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-11-07]
CHR Extension: (Flash® Player for YouTube™) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\lajdkhdcndkniopfefocbgbkofflagpm [2018-07-30]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-07-30]
CHR Extension: (Gmail) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-07-30]
CHR Extension: (Chrome Media Router) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-26]
CHR Profile: C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\System Profile [2018-11-13]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2910696 2018-09-10] (Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2704872 2018-09-10] (Adobe Systems, Incorporated)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [8188768 2018-11-07] (AVAST Software)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-07-30] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [325024 2018-11-07] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [338632 2018-11-07] (AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-07-30] (AVAST Software)
S3 AvastWscReporter; C:\Program Files\AVAST Software\Avast\wsc_proxy.exe [57504 2018-11-07] (AVAST Software)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [10747264 2018-10-29] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2876096 2018-10-29] (COMODO)
R2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [1044680 2018-10-10] (COMODO)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [604824 2018-07-17] (McAfee, Inc.)
R2 NeroBackItUpBackgroundService2019; C:\Program Files (x86)\Nero\Nero 2019\Nero BackItUp\NBService.exe [287000 2018-08-07] (Nero AG)
R2 NitroDriverReadSpool10; C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe [327320 2016-03-03] (Nitro PDF Software)
R2 NitroUpdateService; C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe [417944 2016-03-03] ()
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-08-04] (Microsoft Corporation)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11644656 2018-09-10] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4451616 2018-04-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107136 2018-09-21] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 amdgpio3; C:\WINDOWS\System32\drivers\amdgpio3.sys [33144 2017-04-01] (Advanced Micro Devices, Inc)
S3 amdkmcsp; C:\WINDOWS\system32\DRIVERS\amdkmcsp.sys [101232 2017-06-12] (Advanced Micro Devices, Inc. )
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0313866.inf_amd64_440e3fec3e221547\atikmdag.sys [36547464 2017-04-13] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0313866.inf_amd64_440e3fec3e221547\atikmpag.sys [520072 2017-04-13] (Advanced Micro Devices, Inc.)
R0 amdpsp; C:\WINDOWS\System32\DRIVERS\amdpsp.sys [243048 2017-06-12] (Advanced Micro Devices, Inc. )
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [201408 2018-11-07] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [230512 2018-11-07] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [201928 2018-11-07] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [346760 2018-11-07] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [59664 2018-11-07] (AVAST Software)
R0 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [15360 2018-11-07] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [47064 2018-11-07] (AVAST Software)
R1 aswKbd; C:\WINDOWS\System32\drivers\aswKbd.sys [42456 2018-11-07] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [163376 2018-11-07] (AVAST Software)
R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [483384 2018-11-07] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111968 2018-11-07] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [88112 2018-11-07] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1028840 2018-11-07] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [467904 2018-11-07] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [208640 2018-11-07] (AVAST Software)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2018-07-30] (The OpenVPN Project)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381144 2018-11-07] (AVAST Software)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [110088 2017-04-26] (Advanced Micro Devices)
S3 avgTap; C:\WINDOWS\System32\drivers\avgTap.sys [54888 2018-09-05] (The OpenVPN Project)
S0 cmdboot; C:\WINDOWS\System32\DRIVERS\cmdboot.sys [17944 2018-05-23] (COMODO)
R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [44056 2018-05-23] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [832032 2018-05-23] (COMODO)
R1 cmdhlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [50768 2018-05-23] (COMODO)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [152688 2018-10-30] (Malwarebytes)
R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [134400 2018-05-23] (COMODO)
R1 isedrv; C:\WINDOWS\system32\drivers\isedrv.sys [63256 2018-08-29] (COMODO)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [198000 2018-11-13] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [119136 2018-11-13] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [63768 2018-11-13] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [260480 2018-11-13] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [111152 2018-11-13] (Malwarebytes)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [111608 2017-02-14] (McAfee, Inc.)
R0 pwdrvio; C:\WINDOWS\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\WINDOWS\system32\pwdspio.sys [12504 2013-09-30] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [954368 2017-04-12] (Realtek )
S3 smbdirect; C:\WINDOWS\System32\DRIVERS\smbdirect.sys [152064 2018-04-12] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44616 2018-04-12] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [331680 2018-04-12] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [44032 2018-04-12] (Microsoft Corporation)
S0 AEE3DF28; system32\drivers\AEE3DF28.sys [X]
U1 aswbdisk; no ImagePath
U3 avgbdisk; no ImagePath
S3 DrvAgent64; \??\C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS [X]
S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [X]

#7

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-13 07:46 - 2018-11-13 07:46 - 000000000 ____D C:\ProgramData\xwsOSg
2018-11-13 07:43 - 2018-11-13 07:44 - 000024451 _____ C:\Users\Marcos\Desktop\FRST.txt
2018-11-13 07:42 - 2018-11-13 07:42 - 002415616 _____ (Farbar) C:\Users\Marcos\Desktop\FRST64.exe
2018-11-13 07:41 - 2018-11-13 07:41 - 000000000 ___HD C:\OneDriveTemp
2018-11-13 07:40 - 2018-11-13 07:41 - 000000000 ____D C:\Users\Marcos\AppData\LocalLow\BitTorrent
2018-11-13 06:17 - 2018-11-13 06:17 - 000119136 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-11-13 06:17 - 2018-11-13 06:17 - 000111152 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-11-13 06:17 - 2018-11-13 06:17 - 000063768 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-11-13 06:15 - 2018-11-13 06:15 - 000002155 _____ C:\Users\Marcos\Desktop\Malawarebites 2.txt
2018-11-13 06:01 - 2018-11-13 06:01 - 000009251 _____ C:\Users\Marcos\Desktop\AdwCleaner[C76].txt
2018-11-13 05:59 - 2018-11-13 05:59 - 000260480 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-11-13 05:37 - 2018-11-13 05:37 - 000001695 _____ C:\Users\Marcos\Desktop\Malawarebites.txt
2018-11-13 05:26 - 2018-11-13 05:27 - 000002144 _____ C:\Users\Marcos\Desktop\ZHPCleaner 2018.txt
2018-11-13 05:22 - 2018-11-13 05:25 - 000002136 _____ C:\Users\Marcos\Desktop\ZHPCleaner.txt
2018-11-13 05:14 - 2018-11-13 05:14 - 000008963 _____ C:\Users\Marcos\Desktop\AdwCleaner[S75].txt
2018-11-13 05:04 - 2018-11-13 05:07 - 000002112 _____ C:\Users\Marcos\Desktop\Rkill.txt
2018-11-13 04:25 - 2018-10-21 14:04 - 002267448 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 021386368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 001639560 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 001516120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-11-13 04:25 - 2018-10-21 14:00 - 000396304 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-11-13 04:25 - 2018-10-21 13:59 - 000766480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-11-13 04:25 - 2018-10-21 13:46 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-11-13 04:25 - 2018-10-21 13:46 - 004393472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2018-11-13 04:25 - 2018-10-21 13:45 - 012709888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-11-13 04:25 - 2018-10-21 13:43 - 000345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-11-13 04:25 - 2018-10-21 13:43 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageComponentsInstaller.dll
2018-11-13 04:25 - 2018-10-21 13:42 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-11-13 04:25 - 2018-10-21 13:42 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-11-13 04:25 - 2018-10-21 13:42 - 000592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
2018-11-13 04:25 - 2018-10-21 13:41 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-11-13 04:25 - 2018-10-21 13:41 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-11-13 04:25 - 2018-10-21 13:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-11-13 04:25 - 2018-10-21 12:41 - 001540408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2018-11-13 04:25 - 2018-10-21 12:38 - 001322376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-11-13 04:25 - 2018-10-21 12:38 - 000662312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-11-13 04:25 - 2018-10-21 12:38 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-11-13 04:25 - 2018-10-21 12:37 - 020381808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-11-13 04:25 - 2018-10-21 12:37 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-11-13 04:25 - 2018-10-21 12:28 - 012501504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-11-13 04:25 - 2018-10-21 12:26 - 011902464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-11-13 04:25 - 2018-10-21 12:23 - 002892288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-11-13 04:25 - 2018-10-21 12:23 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-11-13 04:25 - 2018-10-21 12:22 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-11-13 04:25 - 2018-10-21 08:54 - 001035240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-11-13 04:25 - 2018-10-21 08:53 - 000272200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-11-13 04:25 - 2018-10-21 08:53 - 000269128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-11-13 04:25 - 2018-10-21 08:48 - 005602456 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-11-13 04:25 - 2018-10-21 08:47 - 001221128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-11-13 04:25 - 2018-10-21 08:47 - 001062712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-11-13 04:25 - 2018-10-21 08:47 - 001029432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-11-13 04:25 - 2018-10-21 08:47 - 000566776 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-11-13 04:25 - 2018-10-21 08:47 - 000135208 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-11-13 04:25 - 2018-10-21 08:47 - 000076304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-11-13 04:25 - 2018-10-21 08:46 - 009089544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-11-13 04:25 - 2018-10-21 08:46 - 007519896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 007432136 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 002824712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-11-13 04:25 - 2018-10-21 08:46 - 000717112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 000611640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-11-13 04:25 - 2018-10-21 08:46 - 000560136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-11-13 04:25 - 2018-10-21 08:46 - 000497864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 000171024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 003283512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 001946208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 001456728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-11-13 04:25 - 2018-10-21 08:45 - 001257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-11-13 04:25 - 2018-10-21 08:45 - 001140472 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-11-13 04:25 - 2018-10-21 08:45 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 000982400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-11-13 04:25 - 2018-10-21 08:45 - 000793096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 000607136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 000185120 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 000175624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 000139792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2018-11-13 04:25 - 2018-10-21 08:30 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-11-13 04:25 - 2018-10-21 08:28 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-11-13 04:25 - 2018-10-21 08:22 - 022714880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-11-13 04:25 - 2018-10-21 08:22 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-11-13 04:25 - 2018-10-21 08:22 - 004710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-11-13 04:25 - 2018-10-21 08:22 - 004384768 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-11-13 04:25 - 2018-10-21 08:21 - 003392512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-11-13 04:25 - 2018-10-21 08:21 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-11-13 04:25 - 2018-10-21 08:21 - 000123424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-11-13 04:25 - 2018-10-21 08:20 - 003397120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-11-13 04:25 - 2018-10-21 08:20 - 000424000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2018-11-13 04:25 - 2018-10-21 08:20 - 000050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 006569536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 006039560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 002487088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 001620776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 001130768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-11-13 04:25 - 2018-10-21 08:19 - 000505616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe
2018-11-13 04:25 - 2018-10-21 08:18 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-11-13 04:25 - 2018-10-21 08:17 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000473600 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcp.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 002584576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 003212800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-11-13 04:25 - 2018-10-21 08:15 - 000743936 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
2018-11-13 04:25 - 2018-10-21 08:14 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-11-13 04:25 - 2018-10-21 08:14 - 001919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 001373696 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 001034752 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2018-11-13 04:25 - 2018-10-21 08:11 - 022017024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-11-13 04:25 - 2018-10-21 08:09 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-11-13 04:25 - 2018-10-21 08:07 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-11-13 04:25 - 2018-10-21 08:04 - 019403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-11-13 04:25 - 2018-10-21 08:02 - 002966528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-11-13 04:25 - 2018-10-21 08:02 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-11-13 04:25 - 2018-10-21 08:01 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-11-13 04:25 - 2018-10-21 08:00 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-11-13 04:25 - 2018-10-21 07:59 - 005777920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-11-13 04:25 - 2018-10-21 07:59 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-11-13 04:25 - 2018-10-21 07:59 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-11-13 04:25 - 2018-10-21 07:58 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-11-13 04:25 - 2018-10-21 07:58 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-11-13 04:25 - 2018-10-21 07:58 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-11-13 04:25 - 2018-10-21 07:57 - 002611200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2018-11-13 04:25 - 2018-10-21 07:57 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-11-13 04:25 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-11-13 04:25 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\system32\locale.nls
2018-11-13 04:24 - 2018-10-21 13:59 - 000236728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-11-13 04:24 - 2018-10-21 13:46 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-11-13 04:24 - 2018-10-21 13:45 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-11-13 04:24 - 2018-10-21 13:44 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2018-11-13 04:24 - 2018-10-21 13:44 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-11-13 04:24 - 2018-10-21 13:43 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2018-11-13 04:24 - 2018-10-21 13:42 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-11-13 04:24 - 2018-10-21 13:42 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-11-13 04:24 - 2018-10-21 13:41 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-11-13 04:24 - 2018-10-21 13:41 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpinit.exe
2018-11-13 04:24 - 2018-10-21 13:40 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpshell.exe
2018-11-13 04:24 - 2018-10-21 12:41 - 000023056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hvsicontainerservice.dll
2018-11-13 04:24 - 2018-10-21 12:38 - 000221216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-11-13 04:24 - 2018-10-21 12:28 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-11-13 04:24 - 2018-10-21 12:24 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-11-13 04:24 - 2018-10-21 12:23 - 000523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
2018-11-13 04:24 - 2018-10-21 12:22 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2018-11-13 04:24 - 2018-10-21 10:29 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-11-13 04:24 - 2018-10-21 09:44 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-11-13 04:24 - 2018-10-21 08:47 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-11-13 04:24 - 2018-10-21 08:46 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-11-13 04:24 - 2018-10-21 08:46 - 000413200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-11-13 04:24 - 2018-10-21 08:45 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-11-13 04:24 - 2018-10-21 08:45 - 000058088 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2018-11-13 04:24 - 2018-10-21 08:20 - 000295224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-11-13 04:24 - 2018-10-21 08:20 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2018-11-13 04:24 - 2018-10-21 08:20 - 000141312 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2018-11-13 04:24 - 2018-10-21 08:19 - 000567048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-11-13 04:24 - 2018-10-21 08:19 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2018-11-13 04:24 - 2018-10-21 08:19 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcpAppSvc.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhf.sys
2018-11-13 04:24 - 2018-10-21 08:19 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000395776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvctpSvc.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\scecli.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2018-11-13 04:24 - 2018-10-21 08:16 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-11-13 04:24 - 2018-10-21 08:15 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-11-13 04:24 - 2018-10-21 08:14 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-11-13 04:24 - 2018-10-21 08:14 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-11-13 04:24 - 2018-10-21 08:14 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2018-11-13 04:24 - 2018-10-21 08:02 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2018-11-13 04:24 - 2018-10-21 08:01 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2018-11-13 04:24 - 2018-10-21 08:00 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-11-13 04:24 - 2018-10-21 08:00 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scecli.dll
2018-11-13 04:24 - 2018-10-21 07:59 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-11-13 04:24 - 2018-10-21 07:58 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-11-13 04:24 - 2018-10-21 07:58 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-11-13 04:24 - 2018-10-21 07:56 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-11-13 04:24 - 2018-10-21 07:56 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-11-13 04:24 - 2018-10-21 06:59 - 000001314 _____ C:\WINDOWS\system32\tcbres.wim
2018-11-13 04:24 - 2018-04-28 05:02 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-11-13 02:44 - 2018-11-13 02:44 - 000001032 _____ C:\Users\Public\Desktop\WinRAR.lnk
2018-11-13 02:43 - 2018-11-13 02:43 - 000000000 ____D C:\Users\Marcos\Downloads\WinRAR.v5.61.FINAL.ES.x86.x64.Incl.REGGED
2018-11-13 02:36 - 2018-11-13 02:36 - 000000000 ____D C:\Users\Marcos\Downloads\CCleaner.v5.47.6716.FREE.PRO.BUSINESS.TECH.Multilingual.With.Portable.Incl.Serial
2018-11-12 22:59 - 2018-11-12 22:59 - 000988112 _____ (Bleeping Computer, LLC) C:\Users\Marcos\Desktop\iExplore64.exe
2018-11-12 20:50 - 2018-11-12 20:51 - 000002097 _____ C:\Users\Marcos\Desktop\Malwarebytes.lnk
2018-11-12 20:38 - 2018-11-12 20:38 - 000000036 _____ C:\Users\Marcos\.nodemid
2018-11-12 17:51 - 2018-11-12 17:51 - 000000000 ____D C:\Users\Marcos\Downloads\Office_Professional_Plus_2016_Spanish-Actualizado-Julio-2018
2018-11-12 17:51 - 2018-11-12 17:51 - 000000000 ____D C:\Users\Marcos\Downloads\Office_Professional_Plus_2016_Spanish-Actualizado-Agosto-2018
2018-11-12 17:41 - 2018-11-12 17:41 - 003286912 _____ C:\Users\Marcos\Desktop\ZHPCleaner (1).exe
2018-11-11 21:21 - 2018-11-13 05:42 - 000198000 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-11-11 20:50 - 2018-11-11 20:50 - 000000000 ____D C:\Users\Marcos\AppData\Local\TeamViewer
2018-11-11 20:43 - 2018-11-13 06:17 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-11-11 20:43 - 2018-11-11 20:43 - 000001116 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 13.lnk
2018-11-11 20:43 - 2018-11-11 20:43 - 000001104 _____ C:\Users\Public\Desktop\TeamViewer 13.lnk
2018-11-11 20:43 - 2018-11-11 20:43 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\TeamViewer
2018-11-11 20:42 - 2018-11-11 20:42 - 020689928 _____ (TeamViewer GmbH) C:\Users\Marcos\Downloads\TeamViewer_Setup.exe
2018-11-11 20:01 - 2018-11-11 20:01 - 000000000 ____D C:\ProgramData\DAEMON Tools Lite
2018-11-11 19:50 - 2018-11-12 18:00 - 000000000 ____D C:\Users\Marcos\Downloads\KMS_Tools_Portable_18.10.2018
2018-11-11 16:05 - 2018-11-11 16:05 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\651117D7.sys
2018-11-09 04:50 - 2018-11-09 04:53 - 000000000 ____D C:\Users\Marcos\Downloads\The Chevin - Borderland {320 kbps}
2018-11-08 21:52 - 2018-11-08 22:57 - 000000000 ____D C:\Users\Marcos\Downloads\Soulfly - Savages 2013 Metal 320kbps CBR MP3 [VX] [P2PDL]
2018-11-08 20:02 - 2018-11-08 20:19 - 000000000 ____D C:\Users\Marcos\Downloads\Richie Kotzen - Discography
2018-11-08 13:32 - 2018-11-08 13:33 - 000000000 ____D C:\Users\Marcos\Downloads\I SEE STARS - DISCOGRAPHY (2008-13) [CHANNEL NEO]
2018-11-08 01:45 - 2018-11-08 01:53 - 000000000 ____D C:\Users\Marcos\Downloads\Boston [Discography]
2018-11-07 23:27 - 2018-11-07 23:27 - 000000000 ____D C:\Users\Marcos\Downloads\El.leon.En.Invierno.Miniserie(www.TorrentSpain.com)
2018-11-07 21:24 - 2018-11-07 21:24 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\6DB3D489.sys
2018-11-07 16:57 - 2018-11-07 16:57 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\HandBrake
2018-11-07 16:56 - 2018-11-07 16:56 - 011728248 _____ C:\Users\Marcos\Downloads\HandBrake-1.1.2-x86_64-Win_GUI.exe
2018-11-07 16:56 - 2018-11-07 16:56 - 000000865 _____ C:\Users\Marcos\Desktop\HandBrake.lnk
2018-11-07 16:56 - 2018-11-07 16:56 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HandBrake
2018-11-07 16:56 - 2018-11-07 16:56 - 000000000 ____D C:\Program Files\HandBrake
2018-11-07 12:30 - 2018-11-07 12:58 - 000000000 ____D C:\Users\Marcos\Downloads\ANATHEMA - DISCOGRAPHY (1990-14) [CHANNEL NEO]
2018-11-07 00:47 - 2018-11-07 00:47 - 000001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Premier.lnk
2018-11-07 00:47 - 2018-11-07 00:47 - 000001967 _____ C:\Users\Public\Desktop\Avast Premier.lnk
2018-11-07 00:47 - 2018-11-07 00:47 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\AVAST Software
2018-11-07 00:46 - 2018-11-13 02:40 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-11-07 00:46 - 2018-11-07 00:45 - 001028840 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000483384 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000467904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000381144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000346760 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000230512 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000208640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000201928 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000201408 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000163376 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000111968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000088112 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000059664 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000047064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000042456 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000015360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys
2018-11-07 00:45 - 2018-11-07 00:45 - 000378584 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-11-07 00:45 - 2018-11-07 00:45 - 000000000 ____D C:\Program Files\AVAST Software
2018-11-06 21:28 - 2018-11-06 21:28 - 180735736 _____ C:\Users\Marcos\Desktop\cureit.exe
2018-11-06 19:55 - 2018-11-06 19:55 - 000948192 _____ (Doctor Web, Ltd.) C:\Users\Marcos\Downloads\drw_remover.exe
2018-11-06 19:54 - 2018-11-06 19:55 - 012244272 _____ (Doctor Web, Ltd.) C:\Users\Marcos\Downloads\dwsysinfo.exe
2018-11-06 19:02 - 2018-11-06 19:18 - 784454256 _____ (Doctor Web, Ltd.) C:\Users\Marcos\Downloads\drweb-livedisk-900-usb.exe
2018-11-06 17:55 - 2018-11-06 17:55 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\52511338.sys
2018-11-06 15:55 - 2018-11-06 15:55 - 000000000 ___HD C:\VTRoot
2018-11-06 14:33 - 2018-11-07 00:11 - 000000000 ____D C:\Program Files\Common Files\AV
2018-11-06 14:31 - 2018-11-07 01:02 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2018-11-06 14:24 - 2018-11-06 14:24 - 001060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc71.dll
2018-11-06 14:24 - 2018-11-06 14:24 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2018-11-06 14:23 - 2018-11-06 23:18 - 000000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2018-11-06 14:10 - 2018-11-13 04:58 - 000757658 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
2018-11-06 14:09 - 2018-11-06 14:09 - 000001240 _____ C:\Users\Public\Desktop\COMODO Firewall.lnk
2018-11-06 14:09 - 2018-11-06 14:09 - 000000000 ____D C:\WINDOWS\System32\Tasks\COMODO
2018-11-06 14:08 - 2018-11-06 14:08 - 000000000 ____D C:\Program Files\COMODO
2018-11-06 14:08 - 2018-05-23 05:06 - 000017944 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdboot.sys
2018-11-06 14:07 - 2018-10-10 07:24 - 000255520 _____ (COMODO) C:\WINDOWS\system32\iseguard64.dll
2018-11-06 14:07 - 2018-10-10 07:24 - 000205528 _____ (COMODO) C:\WINDOWS\SysWOW64\iseguard32.dll
2018-11-06 14:07 - 2018-08-29 23:55 - 000063256 _____ (COMODO) C:\WINDOWS\system32\Drivers\isedrv.sys
2018-11-06 14:06 - 2018-11-06 15:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2018-11-06 14:06 - 2018-11-06 15:08 - 000000000 ____D C:\Program Files (x86)\Comodo
2018-11-06 14:06 - 2018-11-06 14:06 - 000000000 ____D C:\Users\Marcos\AppData\Local\Comodo
2018-11-06 14:04 - 2018-11-06 14:07 - 000000000 ____D C:\ProgramData\Comodo
2018-11-06 14:04 - 2018-11-06 14:05 - 000000000 ____D C:\ProgramData\Comodo Downloader
2018-11-06 14:04 - 2018-11-06 14:04 - 005581928 _____ (COMODO) C:\Users\Marcos\Downloads\cfw_installer.exe
2018-11-06 14:04 - 2018-11-06 14:04 - 000000000 ____D C:\ProgramData\Shared Space
2018-11-06 06:16 - 2018-11-06 06:16 - 000001143 _____ C:\Users\Public\Desktop\USB Disk Security.lnk
2018-11-06 06:16 - 2018-11-06 06:16 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Zbshareware Lab
2018-11-06 06:16 - 2018-11-06 06:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USB Disk Security
2018-11-06 06:16 - 2018-11-06 06:16 - 000000000 ____D C:\Program Files (x86)\USB Disk Security
2018-11-06 06:08 - 2018-11-06 06:11 - 1953349632 _____ C:\Users\Marcos\Downloads\ubuntu-18.04.1-desktop-amd64.iso
2018-11-06 05:50 - 2018-11-06 05:50 - 003285888 _____ C:\Users\Marcos\Downloads\ZHPCleaner.exe
2018-11-06 05:25 - 2018-11-06 05:25 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\3422667A.sys
2018-11-06 05:21 - 2018-11-06 05:21 - 000001152 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk
2018-11-06 05:20 - 2018-11-06 05:20 - 004291320 _____ (BrightFort LLC ) C:\Users\Marcos\Downloads\spywareblastersetup55.exe
2018-11-06 04:49 - 2018-11-06 04:49 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\A2674327.sys
2018-11-06 04:48 - 2018-11-11 16:25 - 000000000 ____D C:\Users\Marcos\Desktop\mbar
2018-11-06 04:48 - 2018-11-11 16:25 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-11-05 12:44 - 2018-11-13 05:42 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2018-11-04 10:24 - 2018-11-04 10:24 - 000000000 ____D C:\Users\Marcos\Desktop\Nueva carpeta
2018-11-04 10:01 - 2018-11-04 10:01 - 000018092 _____ C:\Users\Marcos\Downloads\creedenceclearwaterrevival.torrent
2018-11-02 13:51 - 2018-11-02 13:51 - 000000000 ____D C:\Users\Default\AppData\Local\Google
2018-11-02 13:51 - 2018-11-02 13:51 - 000000000 ____D C:\Users\Default User\AppData\Local\Google
2018-11-01 06:23 - 2018-11-01 06:23 - 000000000 ____D C:\Users\Marcos\Desktop\Musica
2018-10-31 05:44 - 2018-10-31 05:44 - 007456384 _____ (AVAST Software) C:\Users\Marcos\Downloads\avast_free_antivirus_setup_online_a2j.exe
2018-10-30 20:08 - 2018-09-05 22:01 - 000054888 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\avgTap.sys
2018-10-30 18:40 - 2018-10-31 06:37 - 000000000 ____D C:\Users\Marcos\AppData\Local\AvgSetupLog
2018-10-30 18:40 - 2018-10-31 06:37 - 000000000 ____D C:\Program Files (x86)\AVG
2018-10-30 17:34 - 2018-10-31 05:42 - 000000000 ____D C:\Users\Marcos\AppData\Local\AVG
2018-10-30 17:33 - 2018-10-30 17:33 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVG
2018-10-30 17:32 - 2018-10-30 17:32 - 000000000 ____D C:\Program Files\Common Files\AVG
2018-10-30 17:31 - 2018-10-31 06:37 - 000000000 ____D C:\ProgramData\AVG
2018-10-29 12:20 - 2018-10-29 12:20 - 000925832 _____ (COMODO) C:\WINDOWS\system32\guard64.dll
2018-10-29 12:20 - 2018-10-29 12:20 - 000712216 _____ (COMODO) C:\WINDOWS\SysWOW64\guard32.dll
2018-10-29 12:20 - 2018-10-29 12:20 - 000051808 _____ (COMODO) C:\WINDOWS\system32\cmdcsr.dll
2018-10-29 12:17 - 2018-10-29 12:17 - 000469696 _____ (COMODO) C:\WINDOWS\system32\cmdvrt64.dll
2018-10-29 12:16 - 2018-10-29 12:16 - 000371904 _____ (COMODO) C:\WINDOWS\SysWOW64\cmdvrt32.dll
2018-10-28 21:06 - 2018-10-31 06:36 - 000002730 _____ C:\WINDOWS\System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-51BG0PM-Marcos
2018-10-27 14:19 - 2018-09-18 10:33 - 000000000 ____D C:\ProgramData\Adobe
2018-10-27 14:14 - 2018-10-27 14:19 - 000001085 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2019.lnk
2018-10-27 13:47 - 2018-10-27 14:19 - 000000000 ____D C:\Users\Marcos\Documents\Adobe
2018-10-27 13:32 - 2018-11-13 05:43 - 000001048 _____ C:\Users\Public\Desktop\CCleaner.lnk
2018-10-27 13:32 - 2018-11-13 02:38 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-10-27 13:32 - 2018-10-27 13:32 - 000002872 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2018-10-27 13:32 - 2018-10-27 13:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2018-10-22 18:19 - 2018-10-29 21:07 - 000000147 _____ C:\Users\Marcos\Desktop\UCDM.txt
2018-10-16 17:15 - 2018-10-16 17:16 - 000085548 _____ C:\TDSSKiller.3.1.0.17_16.10.2018_18.15.18_log.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-13 07:46 - 2018-07-31 00:28 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\BitTorrent
2018-11-13 07:43 - 2018-10-12 21:02 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\2e91124867341581a3e88a67355fdc67
2018-11-13 07:43 - 2018-09-06 13:19 - 000000000 ____D C:\FRST
2018-11-13 07:42 - 2018-08-06 12:21 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\TIDAL
2018-11-13 07:42 - 2018-07-30 21:24 - 000000000 ____D C:\Users\Marcos\AppData\Local\AVAST Software
2018-11-13 07:41 - 2018-07-30 21:13 - 000000000 ___RD C:\Users\Marcos\OneDrive
2018-11-13 07:40 - 2017-12-25 00:00 - 000000000 ____D C:\ProgramData\9ef66cea
2018-11-13 06:48 - 2018-04-12 00:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-11-13 06:19 - 2018-10-12 21:02 - 000000000 ___HD C:\DESKTOP-51BG0PM
2018-11-13 06:17 - 2018-08-04 18:30 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-11-13 06:17 - 2018-08-04 18:10 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-11-13 05:57 - 2018-07-30 21:10 - 000065536 _____ C:\WINDOWS\psp_storage.bin
2018-11-13 05:57 - 2018-04-11 22:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-11-13 05:53 - 2018-10-10 16:51 - 000000000 ____D C:\Users\Marcos\AppData\LocalLow\Mozilla
2018-11-13 05:44 - 2018-04-12 00:36 - 000000000 ____D C:\WINDOWS\INF
2018-11-13 05:25 - 2018-09-06 03:07 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\ZHP
2018-11-13 04:48 - 2018-04-12 17:19 - 000750432 _____ C:\WINDOWS\system32\perfh00A.dat
2018-11-13 04:48 - 2018-04-12 17:19 - 000147354 _____ C:\WINDOWS\system32\perfc00A.dat
2018-11-13 04:48 - 2016-04-27 07:09 - 001679422 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-11-13 04:44 - 2018-08-04 18:32 - 000000000 ___RD C:\Users\Marcos\3D Objects
2018-11-13 04:44 - 2016-04-27 07:13 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-11-13 04:43 - 2018-08-04 18:10 - 005057616 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-11-13 04:36 - 2018-04-12 00:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-11-13 03:57 - 2018-09-05 20:51 - 000000000 ____D C:\ProgramData\TEMP
2018-11-13 02:52 - 2018-07-30 22:04 - 000000000 ____D C:\Program Files\WinRAR
2018-11-13 02:44 - 2018-07-30 22:04 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-11-13 02:44 - 2018-07-30 22:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-11-13 02:38 - 2018-07-30 21:13 - 000002299 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-11-13 02:34 - 2018-09-05 20:51 - 000000000 ____D C:\Program Files (x86)\SpywareBlaster
2018-11-13 00:37 - 2018-08-04 18:21 - 000000000 ____D C:\Users\Marcos
2018-11-12 22:04 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-11-12 21:52 - 2018-08-22 12:31 - 000000000 ____D C:\Users\Marcos\AppData\Local\ElevatedDiagnostics
2018-11-12 21:33 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-11-12 21:28 - 2018-04-22 18:59 - 000000000 ____D C:\DrWeb Quarantine
2018-11-12 21:04 - 2018-08-15 16:46 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2018-11-12 17:38 - 2018-09-24 05:04 - 003286912 _____ C:\Users\Marcos\ZHPCleaner.exe
2018-11-12 14:46 - 2018-07-31 03:07 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\AIMP
2018-11-12 13:20 - 2018-09-05 20:51 - 000041090 __RSH C:\ProgramData\ntuser.pol
2018-11-11 21:06 - 2018-08-10 20:51 - 000003478 _____ C:\WINDOWS\System32\Tasks\AutoPico Daily Restart
2018-11-10 03:18 - 2018-04-12 00:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-11-08 15:38 - 2018-07-31 03:32 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\MPC-HC
2018-11-07 00:45 - 2018-04-12 00:38 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-11-07 00:44 - 2018-07-30 21:15 - 000000000 ____D C:\ProgramData\AVAST Software
2018-11-06 22:52 - 2018-08-21 14:33 - 000000000 ____D C:\ProgramData\Freemake
2018-11-06 22:52 - 2018-08-21 14:32 - 000000000 ____D C:\Program Files (x86)\Freemake
2018-11-06 20:16 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-11-06 20:02 - 2018-07-30 23:31 - 000000000 ____D C:\Users\Marcos\Doctor Web
2018-11-06 17:41 - 2018-09-13 16:46 - 000000000 ____D C:\Users\Marcos\AppData\Local\CrashDumps
2018-11-06 17:33 - 2018-09-07 01:57 - 000000000 ____D C:\Program Files\CCleaner
2018-11-06 14:54 - 2018-04-11 22:04 - 000008192 _____ C:\WINDOWS\system32\config\ELAM
2018-11-06 14:12 - 2018-10-10 16:50 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-11-06 14:12 - 2018-10-10 16:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-11-06 14:03 - 2018-10-10 16:50 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-11-06 05:21 - 2018-09-05 20:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2018-11-06 04:49 - 2018-07-31 01:51 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-11-05 14:53 - 2018-08-04 18:30 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2511560098-4189382557-1041078835-1001
2018-11-05 14:53 - 2018-08-04 18:21 - 000002404 _____ C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-11-05 10:44 - 2018-08-06 12:21 - 000000000 ____D C:\Users\Marcos\AppData\Local\TIDAL
2018-11-02 18:22 - 2018-07-30 21:08 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Adobe
2018-11-02 13:52 - 2018-10-04 15:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Backup and Sync from Google
2018-10-31 06:36 - 2018-10-05 20:41 - 000002590 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2018-10-31 06:36 - 2018-08-04 18:30 - 000003034 _____ C:\WINDOWS\System32\Tasks\klcp_update
2018-10-31 06:35 - 2018-08-22 21:01 - 000002372 _____ C:\WINDOWS\System32\Tasks\PandaUSBVaccine
2018-10-30 19:53 - 2018-10-05 21:05 - 000000000 ____D C:\Users\Marcos\Documents\MEGAsync Downloads
2018-10-30 19:24 - 2018-07-30 23:46 - 000000000 ____D C:\Users\Marcos\AppData\Local\Microsoft Help
2018-10-30 18:43 - 2018-08-06 03:03 - 000002146 _____ C:\WINDOWS\System32\Tasks\StartCN
2018-10-30 03:58 - 2018-10-04 08:38 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-10-27 14:22 - 2018-09-05 19:45 - 000000000 ____D C:\Program Files\Adobe
2018-10-27 14:19 - 2018-09-05 19:41 - 000000000 ____D C:\Program Files\Common Files\Adobe
2018-10-27 14:07 - 2018-09-05 19:44 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-10-27 13:58 - 2018-07-30 21:11 - 000000000 ____D C:\ProgramData\Package Cache
2018-10-27 13:07 - 2018-07-31 02:12 - 000000000 ____D C:\Users\Marcos\AppData\Local\Spotify
2018-10-27 13:02 - 2018-07-31 02:11 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Spotify
2018-10-26 15:33 - 2018-07-30 21:27 - 000002496 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk
2018-10-26 02:21 - 2018-08-04 18:30 - 000000000 ____D C:\WINDOWS\System32\Tasks\Avast Software
2018-10-16 03:28 - 2018-08-04 18:49 - 000000000 ____D C:\ProgramData\Packages
2018-10-15 23:23 - 2018-07-30 23:45 - 000000000 ____D C:\Users\Marcos\Documents\My ISO Files
2018-10-15 15:55 - 2018-08-04 18:30 - 000003544 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2018-10-15 15:55 - 2018-08-04 18:30 - 000003320 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2018-09-24 05:04 - 2018-11-12 17:38 - 003286912 _____ () C:\Users\Marcos\ZHPCleaner.exe
2018-09-05 18:37 - 2018-09-05 18:37 - 000041071 _____ () C:\Users\Marcos\AppData\Roaming\Switch.dmp
2018-10-30 02:59 - 2018-10-30 02:59 - 000000000 _____ () C:\Users\Marcos\AppData\Local\oobelibMkey.log

Some files in TEMP:
====================
2018-11-13 01:10 - 2018-04-12 00:35 - 000607840 _____ (Microsoft Corporation) C:\Users\Marcos\AppData\Local\Temp\kernel32.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-08-04 18:10

==================== End of FRST.txt ============================

#8

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11.11.2018
Ran by Marcos (13-11-2018 07:47:26)
Running from C:\Users\Marcos\Desktop
Windows 10 Pro Version 1803 17134.376 (X64) (2018-08-04 17:31:26)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrador (S-1-5-21-2511560098-4189382557-1041078835-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2511560098-4189382557-1041078835-503 - Limited - Disabled)
Invitado (S-1-5-21-2511560098-4189382557-1041078835-501 - Limited - Disabled)
Marcos (S-1-5-21-2511560098-4189382557-1041078835-1001 - Administrator - Enabled) => C:\Users\Marcos
WDAGUtilityAccount (S-1-5-21-2511560098-4189382557-1041078835-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avast Antivirus (Enabled - Up to date) {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
FW: COMODO Firewall (Enabled) {3083CA8D-8618-5BD3-8A5F-9667D5C8267D}
FW: Avast Antivirus (Enabled) {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Photoshop CC 2019 (HKLM-x32\...\PHSP_20_0) (Version: 20.0.0 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM-x32\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
AIMP (HKLM-x32\...\AIMP) (Version: v4.51.2080, 07.07.2018 - AIMP DevTeam)
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 9.0.000.8 - Advanced Micro Devices, Inc.)
Avast Premier (HKLM-x32\...\Avast Antivirus) (Version: 18.7.2354 - AVAST Software)
Avast Secure Browser (HKLM-x32\...\Avast Secure Browser) (Version: 69.1.867.101 - AVAST Software)
Avast Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.4.154.333 - AVAST Software) Hidden
Backup and Sync from Google (HKLM\...\{608EBDC6-D18A-4CF6-AD54-EE6B71D29065}) (Version: 3.43.1584.4446 - Google, Inc.)
Catalyst Control Center Next Localization BR (HKLM\...\{02A6D874-24F1-3CCE-3EAD-4EDB6C0B6F93}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (HKLM\...\{A16E186C-58C4-3BDC-5CCE-714EFEF5F27F}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (HKLM\...\{E7AA1A02-575C-14C6-FBEF-4BE6D46A5B74}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{85B12562-A396-EB5A-A0D1-A128D2ADF025}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{E42911E5-48F8-8557-ED20-D72AD1907D25}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{EB6C44F1-0F78-FE10-BC63-90BA50AB0CE9}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{30CDC68E-0101-5A97-7485-8D068E732E0A}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{B26D75B8-FAB7-6F8B-767F-BAF975383D91}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{B4C30EF4-B2C5-1395-B534-7B63BCB6E8E4}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{24FEBF45-B638-AAF8-A4DB-77CC5E54D066}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{36EDC500-E4C0-371C-9865-08450415C1E9}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{62098A5F-E03B-31A3-5F9C-51A7F7D25744}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{1757AD9B-0E3C-05F9-FE43-4343BED7DA85}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{3880FCFF-C677-59F9-C22F-3097DEEBD16D}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{4C2FB7FD-89FD-BA5C-585A-3811F326AD34}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{14F3D05A-0819-DAE0-65B2-8BED55EB3D39}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{66B06F29-EE4F-9130-D96A-754826093FEA}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{D74218A3-C503-57EF-AC9F-2220082E7ADE}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{809BA3AC-0E53-9A2D-2AE1-03421DC24D28}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{821D0A0E-F246-BE40-0D68-93883C14C410}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{DA433FCF-90A1-19A5-65A7-FDF82DE4826D}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{40B9A091-1A05-2FB7-143D-82DBE4DDFF1C}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{88BD74C4-23AB-4554-915C-6E1F0C81F6CD}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{949F125B-A6CC-5A5E-EEE7-4AC50305C1FA}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{20D46801-147B-30AD-7C5A-AC4560A79096}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{A48E2AB0-0866-7783-9657-E1709EB18D02}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{C82471C7-B24E-C284-911C-718A6FB88C8E}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{22C39711-2747-D264-319A-1550BEEAAEC6}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{D2DAD1C7-4AB1-DC9F-E7D5-70DD1C25FE1D}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{E61CEF9A-BAC3-EAEE-F735-E257D2354DF2}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{1DBACFDB-5E43-7882-36BD-53526D34BD22}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{8600CBD7-CB6A-E803-D769-A344A26317AB}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{DA0326BB-657D-AAFC-752C-363E8FA33755}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{2A2AFBB0-D897-C801-467A-5792ABCD1C9D}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{A91FC4BF-C1EC-ADCA-79D1-F4F0671F1D60}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{B873A1FB-5EA0-EE5F-A861-1E38880AD08E}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{8E7C0120-493E-B3A3-4F00-8178306DEE1E}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{EC9DF9FF-9D75-4CDD-1D58-A2E887B0A42E}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{ED75A775-03A7-F214-868D-497748707968}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{07BFBD5C-2F63-6828-1B61-B41A44113F3B}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{3217E533-67DC-4EB5-B774-F436EC429857}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{7ABACA7E-6E59-0EF9-8FA3-6B32E5F58127}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{3E196AAF-F81C-B384-E2AB-28EE2398FE5F}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{7589A037-C364-280D-6CA2-F685FB8302A6}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{E6038D3E-5D87-8DF7-6D05-BE7532C3E73E}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{5D1EF4AA-E1C8-5F46-5A0F-FD62408A2AF1}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{DAEFFE0C-CD05-1355-6AFC-7B3D4106A820}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{DFAD9DAC-4768-C8BB-4E0E-5239605A9BEA}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{997A5D0C-CDBB-58C4-5893-D2ADB3CC16D1}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{E392A425-53A7-DF90-96A0-E287A75DD3B2}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{FFBFBD1F-B160-A119-7C43-8584FA2E5665}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{32CBE904-BCB7-04E0-35EC-3CB23267CB19}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{4D1D5407-9B69-6422-629C-8518A26004A4}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{D6F47BB4-700A-F612-0671-5F69EA311BB7}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{01FD9A26-3F61-9236-B360-BE5D043D82C0}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{A8379BAB-59A9-C0A3-8BCC-4852EA403692}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{C8D3F2F3-DAC5-5B3F-9E98-E44694F828AB}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{24DF617A-CD23-6E6A-126B-23630D2781CE}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{64D4CCC3-63DF-252D-D29D-03491670225D}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{E3B025B9-6BC8-E61E-C98F-8DBBA6B530E1}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{7854E4CF-8215-4425-75F2-5E7659C38984}) (Version: 2017.0413.1040.19176 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{83DDDFD8-AD42-72F9-E4F1-5456FDB304C9}) (Version: 2017.0424.2119.36535 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{8DF90937-B869-9F76-5D45-5A8BDA0A33B6}) (Version: 2017.0922.1659.28737 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\{5CC5E51F-12F5-4F21-A266-8A66C710AE13}) (Version: 5.46.6652 - Piriform Ltd)
CCleaner (HKLM\...\CCleaner) (Version: 5.47 - Piriform)
COMODO Firewall (HKLM\...\{785D9670-B355-487D-8B6A-6B28490AF489}) (Version: 11.0.0.6728 - COMODO Security Solutions Inc.) Hidden
Eines de correcció del Microsoft Office 2016: català (HKLM\...\{90160000-001F-0403-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
eMule (HKLM-x32\...\eMule) (Version:  - )
Ferramentas de verificación de Microsoft Office 2016 - Galego (HKLM\...\{90160000-001F-0456-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
FileASSASSIN (HKLM-x32\...\FileASSASSIN) (Version: 1.06 - Malwarebytes)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 70.0.3538.102 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
HandBrake 1.1.2 (HKLM-x32\...\HandBrake) (Version: 1.1.2 - )
Herramientas de corrección de Microsoft Office 2016: español (HKLM\...\{90160000-001F-0C0A-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Internet Security Essentials (HKLM-x32\...\ComodoIse) (Version: 1.5.463447.175 - Comodo)
K-Lite Mega Codec Pack 14.3.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 14.3.0 - KLCP)
Malwarebytes versión 3.6.1.2711 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.6.1.2711 - Malwarebytes)
MEGAsync (HKLM-x32\...\MEGAsync) (Version:  - Mega Limited)
Microsoft Office Professional Plus 2016 (HKLM\...\Office16.PROPLUS) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\OneDriveSetup.exe) (Version: 18.172.0826.0010 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.12.25810 (HKLM-x32\...\{e2ee15e2-a480-4bc5-bfb7-e9803d1d9823}) (Version: 14.12.25810.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.14.26429 (HKLM-x32\...\{2019b6a0-8533-4a04-ac0e-b2c10bdb9841}) (Version: 14.14.26429.4 - Microsoft Corporation)
Mozilla Firefox 63.0.1 (x64 es-ES) (HKLM\...\Mozilla Firefox 63.0.1 (x64 es-ES)) (Version: 63.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 62.0.3 - Mozilla)
Nero 2019 (HKLM-x32\...\{2C72095A-A579-4815-A726-197201F94377}) (Version: 20.0.04600 - Nero AG)
Nero Core (HKLM-x32\...\{EF1C9DB5-D928-4F38-89DE-B1BB8911462E}) (Version: 1.0.01700 - Nero AG)
Nero Info (HKLM-x32\...\{F030BFE8-8476-4C08-A553-233DE80A2BE1}) (Version: 20.0.1011 - Nero AG)
Nitro Pro 10 (HKLM\...\{88267846-6F04-424D-BB76-BDDEC9A92B66}) (Version: 10.5.8.44 - Nitro)
OEM Application Profile (HKLM-x32\...\{7F5DCD33-1039-C3B2-9538-B645B65BBA63}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)
PDF Settings CS6 (HKLM-x32\...\{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}) (Version: 11.0 - Adobe Systems Incorporated) Hidden
Prerequisite installer (HKLM-x32\...\{37E15A76-F310-4C62-9D32-EE96C83BBD2C}) (Version: 20.2.0001 - Nero AG) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.16.323.2017 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8158 - Realtek Semiconductor Corp.)
Revisores de Texto do Microsoft Office 2016 – Português (Brasil) (HKLM\...\{90160000-001F-0416-1000-0000000FF1CE}) (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Spotify (HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Spotify) (Version: 1.0.91.183.g259b84fa - Spotify AB)
SpywareBlaster 5.5 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)
Switch, convertidor de audio (HKLM-x32\...\Switch) (Version: 5.01 - NCH Software)
TeamViewer 13 (HKLM-x32\...\TeamViewer) (Version: 13.2.26558 - TeamViewer)
TIDAL (HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\TIDAL) (Version: 2.2.2 - TIDAL Music AS)
UltraISO Premium V9.7 (HKLM-x32\...\UltraISO_is1) (Version:  - )
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{479E8CC7-CD68-4EB4-BB04-34A5C2C74102}) (Version: 2.46.0.0 - Microsoft Corporation)
UpdateAssistant (HKLM\...\{52C1DD03-104E-4AC6-9DC6-21D585721ED1}) (Version: 1.19.0.0 - Microsoft Corporation) Hidden
USB Disk Security (HKLM-x32\...\USB Disk Security_is1) (Version:  - Zbshareware Lab)
Vulkan Run Time Libraries 1.0.39.1 (HKLM\...\VulkanRT1.0.39.1) (Version: 1.0.39.1 - LunarG, Inc.)
WiFi+Transfer (HKLM-x32\...\{9F18877A-19EE-4FEA-979B-CAC0A76A14DC}) (Version: 1.0.3059 - Nero AG)
WinRAR 5.61 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.61.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-10-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-10-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-10-04] (Google)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-11-07] (AVAST Software)
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-11-07] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ContextMenuHandlers1: [AIMP] -> {1F77B17B-F531-44DB-ACA4-76ABB5010A28} => C:\Program Files (x86)\AIMP\System\aimp_menu64.dll [2018-07-31] (AIMP DevTeam)
ContextMenuHandlers1: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-11-07] (AVAST Software)
ContextMenuHandlers1: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2018-10-29] (COMODO)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-10-04] (Google)
ContextMenuHandlers1: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ContextMenuHandlers1: [NP8ShellExtension] -> {9C4B85B8-956C-49BF-9BA5-101384E562B2} => C:\Program Files\Nitro\Pro 10\NPShellExtension.dll [2016-03-03] (Nitro PDF)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-09-30] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-09-30] (Alexander Roshal)
ContextMenuHandlers1-x32: [WondershareVideoConverterFileOpreation] -> {FEB746CA-95C2-485F-B386-C30D4E56D22E} => C:\WINDOWS\SysWOW64\WSCM64.dll [2018-03-26] ()
ContextMenuHandlers2: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2018-10-29] (COMODO)
ContextMenuHandlers2: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ContextMenuHandlers2: [UltraISO] -> {AD392E40-428C-459F-961E-9B147782D099} => C:\Program Files (x86)\UltraISO\isoshl64.dll [2015-10-08] (EZB Systems, Inc.)
ContextMenuHandlers3: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-11-07] (AVAST Software)
ContextMenuHandlers3-x32: [FAExt] -> {05672D66-9736-42F5-8BEB-FA1DD3CA51C4} => C:\Program Files (x86)\FileASSASSIN\FileASSASSINExt.dll [2007-03-31] (Malwarebytes)
ContextMenuHandlers3-x32: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers3-x32: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ContextMenuHandlers4: [AIMP] -> {1F77B17B-F531-44DB-ACA4-76ABB5010A28} => C:\Program Files (x86)\AIMP\System\aimp_menu64.dll [2018-07-31] (AIMP DevTeam)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-10-04] (Google)
ContextMenuHandlers4: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll [2017-10-18] ()
ContextMenuHandlers4: [UltraISO] -> {AD392E40-428C-459F-961E-9B147782D099} => C:\Program Files (x86)\UltraISO\isoshl64.dll [2015-10-08] (EZB Systems, Inc.)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files\AMD\CNext\CNext\atiacm64.dll [2017-04-13] (Advanced Micro Devices, Inc.)
ContextMenuHandlers6: [avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2018-11-07] (AVAST Software)
ContextMenuHandlers6: [Comodo Antivirus] -> {4255A182-CAD9-4214-A19B-7BA7FB633BBD} => C:\Program Files\COMODO\COMODO Internet Security\cavshell.dll [2018-10-29] (COMODO)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-09-19] (Malwarebytes)
ContextMenuHandlers6: [UltraISO] -> {AD392E40-428C-459F-961E-9B147782D099} => C:\Program Files (x86)\UltraISO\isoshl64.dll [2015-10-08] (EZB Systems, Inc.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-09-30] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-09-30] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01AB9A4F-353F-4296-A6E7-3FE8862E3E93} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\WINDOWS\system32\EOSNotify.exe
Task: {04BB8590-BB29-41DD-8E9E-A26E0B4FEF7E} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe [2018-10-31] (AVG Technologies CZ, s.r.o.)
Task: {05064DED-816A-4B34-BB90-4803F9F85103} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2018-10-29] (COMODO)
Task: {0BC9F969-BBBF-407E-B55A-C3047CDAD6F6} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [2018-07-30] (AVAST Software)
Task: {351D2035-7B02-4F6B-8623-F321E93AF777} - System32\Tasks\Nero\Nero Info => C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe [2018-07-18] (Nero AG)
Task: {5D4797F7-A6C1-44C0-9197-6EAB0090C550} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2015-07-31] (Microsoft Corporation)
Task: {637F2DC4-5C4A-4DDE-8BB3-88E8D4CFBC0B} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {700DC365-BFB0-4024-A380-BA8C6D35463D} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\WINDOWS\explorer.exe /NOUACCHECK
Task: {70CF35FA-8897-4CC1-AC89-1E30628D77E3} - System32\Tasks\MEGA\MEGAsync Update Task S-1-5-21-2511560098-4189382557-1041078835-1001 => C:\Users\Marcos\AppData\Local\MEGAsync\MEGAupdater.exe [2018-01-15] (Mega Limited)
Task: {7281135E-BF4C-4A22-BB49-571B7A60B384} - System32\Tasks\COMODO\COMODO Telemetry {18AD3DFA-30C0-4B5F-84F7-F1870B1A4921} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [2018-10-29] (COMODO)
Task: {7DD21F7D-F691-4E14-BC91-A2FC1FECC36F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {7DD27359-483D-49FE-9152-4BC3AB877C97} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [2018-09-19] (Piriform Ltd)
Task: {81A599F7-6E81-4000-BEDB-992B0B78D148} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [2018-07-30] (AVAST Software)
Task: {904ECC43-ACBE-41FF-A281-11CADF30E1B7} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2018-10-29] (COMODO)
Task: {962A6614-5998-4A4C-80CD-3E941B145693} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2018-09-19] (Piriform Ltd)
Task: {9CDA8A59-D03F-49F3-A7CC-AF454F49F547} - System32\Tasks\klcp_update => CodecTweakTool.exe
Task: {9D91F608-713D-4E5B-8792-FD43B964C625} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
Task: {AC7A22FB-F19C-4E8D-8D17-6C306239F88D} - System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-51BG0PM-Marcos => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2018-09-10] (Adobe Systems, Incorporated)
Task: {B0177A22-5C47-499B-B447-13B4B251286C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-07-30] (Google Inc.)
Task: {B22D2361-593A-4161-A515-663E02BE830D} - System32\Tasks\Avast Emergency Update => C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe [2018-11-07] (AVAST Software)
Task: {B7287581-DA02-4B85-9FD0-0D7582058B13} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2018-10-29] (COMODO)
Task: {C26F2C77-D232-455B-89B5-93D94879AE68} - System32\Tasks\COMODO\COMODO CMC {06A09C0F-DD9C-4191-A670-71115CD78627} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2018-10-29] (COMODO)
Task: {C4DB3EB1-5985-475D-8E35-CCC20EC2D098} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {CB4999AD-AA73-4EE8-9C38-1E98ED920492} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [2017-04-13] (Advanced Micro Devices, Inc.)
Task: {DEC86953-6B33-4C55-B7C7-B96002908C97} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-07-30] (Google Inc.)
Task: {F4039F0B-5E40-4C5C-87C2-1438E8CCBEB0} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\AVAST Software\Overseer\overseer.exe [2018-10-28] (AVAST Software)
Task: {F4D2F755-82DB-4BF4-ABE9-5407BF0D6AB1} - System32\Tasks\COMODO\COMODO Maintenance {947247B5-026A-4437-9371-770782BE839D} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2018-10-29] (COMODO)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


ShortcutWithArgument: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicaciones de Chrome\FLV Player.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=dhogabmliblgpadclikpkjfnnipeebjm

==================== Loaded Modules (Whitelisted) ==============

2018-10-29 12:16 - 2018-10-29 12:16 - 000107200 _____ () C:\Program Files\COMODO\COMODO Internet Security\cavwpps.dll
2018-10-04 08:38 - 2018-10-30 03:58 - 002821952 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2018-10-04 08:38 - 2018-10-30 03:58 - 002695360 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2016-03-03 15:31 - 2016-03-03 15:31 - 000417944 _____ () c:\program files\nitro\pro 10\nitro_updateservice.exe
2016-03-03 15:30 - 2016-03-03 15:30 - 002546840 _____ () c:\program files\nitro\pro 10\Nitro_KissMetrics.dll
2018-04-12 00:34 - 2018-04-12 00:34 - 000491744 _____ () C:\Windows\System32\InputHost.dll
2018-10-29 12:17 - 2018-10-29 12:17 - 000246464 _____ () C:\Program Files\COMODO\COMODO Internet Security\cmdcomps.dll
2017-10-18 22:51 - 2017-10-18 22:51 - 000598528 _____ () C:\Users\Marcos\AppData\Local\MEGAsync\ShellExtX64.dll
2018-04-12 00:34 - 2018-04-12 00:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-12 00:34 - 2018-04-12 00:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-09-30 21:28 - 2018-03-26 14:52 - 000727952 _____ () C:\WINDOWS\SysWOW64\WSCM64.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-08-04 19:01 - 2018-08-04 19:01 - 003912608 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll
2018-08-04 19:01 - 2018-08-04 19:01 - 002506680 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll
2018-08-30 14:55 - 2018-11-13 02:36 - 000039192 ____R () C:\Program Files\CCleaner\branding.dll
2018-09-19 09:13 - 2018-09-19 09:13 - 000095168 _____ () C:\Program Files\CCleaner\lang\lang-1034.dll
2018-10-29 12:17 - 2018-10-29 12:17 - 000159424 _____ () C:\Program Files\COMODO\COMODO Internet Security\cmdwrhlp.dll
2018-11-07 00:45 - 2018-11-07 00:45 - 000598232 _____ () c:\program files\avast software\avast\streamback.dll
2018-11-07 00:47 - 2018-11-07 00:47 - 067126928 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2017-09-10 21:51 - 2017-09-10 21:51 - 000798208 _____ () C:\Users\Marcos\AppData\Local\MEGAsync\libsodium.dll
2018-11-06 06:16 - 2013-06-25 11:03 - 000036864 _____ () C:\Program Files (x86)\USB Disk Security\locales\spanish.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 [252]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mbamchameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

#9

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\localhost -> localhost
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\1001movie.com -> 1001movie.com

There are 6091 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 08:24 - 2018-11-12 21:28 - 000001084 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\Web\Wallpaper\MSI\PRO.jpg
DNS Servers: 212.40.224.73 - 62.42.230.24
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.

HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\StartupApproved\Run: => "AdobeBridge"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [UDP Query User{7D4C8FD7-9CE0-41DF-B15B-79794E5CC355}C:\program files (x86)\emule\emule.exe] => (Allow) C:\program files (x86)\emule\emule.exe
FirewallRules: [TCP Query User{79EA03EC-AB70-43A8-A5AC-7FDBBD5FF5BC}C:\program files (x86)\emule\emule.exe] => (Allow) C:\program files (x86)\emule\emule.exe
FirewallRules: [UDP Query User{EB1D8A20-32BF-4146-AD8A-35BD0DFE562A}C:\users\marcos\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\marcos\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{31382FEB-5476-4EB6-83D4-31592B092FEB}C:\users\marcos\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\marcos\appdata\roaming\spotify\spotify.exe
FirewallRules: [{03565175-0D1D-4513-BC40-AB514C0A37B4}] => (Allow) C:\Program Files\Microsoft Office\Office16\UcMapi.exe
FirewallRules: [{39812120-D45D-4FAF-825A-C98BBD287E2B}] => (Allow) C:\Program Files\Microsoft Office\Office16\UcMapi.exe
FirewallRules: [{F500A9D9-E4B8-4D9A-8FE3-5E3A1901086A}] => (Allow) C:\Program Files\Microsoft Office\Office16\lync.exe
FirewallRules: [{0B2D3B73-7409-43CF-A123-4A468048B639}] => (Allow) C:\Program Files\Microsoft Office\Office16\lync.exe
FirewallRules: [{60E6D465-398E-4850-BE86-7EF7620A2377}] => (Block) C:\windows\system32\svchost.exe
FirewallRules: [{2765E0F4-2918-4A46-B9C9-43CDD8FCBA2B}] => (Block) C:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe
FirewallRules: [{19A6B1F1-32CA-4E52-B736-09D817018672}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{8391BDD1-11F8-4152-B99E-1C8CDCB07C8D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{D2BEF8C6-26B6-4131-9BF6-A14130CA8C86}] => (Allow) C:\Program Files (x86)\Nero\Nero 2019\Nero Burning ROM\StartNBR.exe
FirewallRules: [{C660B931-CAC7-4C78-BAB7-BB2D675E00EB}] => (Allow) C:\Program Files (x86)\Nero\Nero 2019\Nero BackItup\NBService.exe
FirewallRules: [{B67342AB-9604-4F63-BB6D-B81BA35EE812}] => (Allow) C:\Program Files (x86)\Nero\Nero 2019\Nero BackItup\BackItUp.exe
FirewallRules: [{919CAF4A-B5BE-405F-BC9E-F3A7CD4C00A3}] => (Allow) C:\Program Files (x86)\Nero\Nero 2019\Nero MediaHome\NMDllHost.exe
FirewallRules: [{06F92971-DCDA-4D76-9D5E-0C15F52E89AE}] => (Allow) C:\Program Files (x86)\Nero\Nero 2019\Nero MediaHome\MediaHome.exe
FirewallRules: [{308FEE9C-4344-4E77-BCD2-2100E218D3F4}] => (Allow) C:\Program Files (x86)\Nero\Nero 2019\Nero Burning ROM\nero.exe
FirewallRules: [{A12C7D02-0FCB-49F7-B083-FF91B28E4302}] => (Allow) C:\Program Files (x86)\Nero\Transfer\Transfer.exe
FirewallRules: [{84E85D53-9CDE-42FC-A644-CC7F6A02BA83}] => (Allow) C:\Users\Marcos\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{75E4E5CC-D70C-453F-9DD6-08827771E54D}] => (Allow) C:\Users\Marcos\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{18E7C84A-9A5A-49A2-8063-C9C9F6A53357}] => (Allow) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
FirewallRules: [{CBB1C845-7AAA-4B18-A4F0-74C264F5CA86}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
FirewallRules: [{2E6FF2ED-E737-42D8-BC40-B8B5B2A52ED6}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
FirewallRules: [TCP Query User{57B3DD92-9083-4072-A73E-8A94617B644F}C:\program files (x86)\emule\emule.exe] => (Allow) C:\program files (x86)\emule\emule.exe
FirewallRules: [UDP Query User{AA0AC2FD-140B-4561-AB58-290956786BFA}C:\program files (x86)\emule\emule.exe] => (Allow) C:\program files (x86)\emule\emule.exe
FirewallRules: [{AF7C0FE5-25B7-4089-93F2-F4D617D1F01A}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
FirewallRules: [{BEF1DD96-BAEB-49F0-BE6E-199040245BBB}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
FirewallRules: [{588ABC20-54AA-4E7A-A93A-F5AB98476D8E}] => (Block) C:\Windows\explorer.exe
FirewallRules: [{6839BAA0-9713-4825-A63C-8B3AD68554AF}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{7020ED6F-C236-4C32-B79C-8809052E21A9}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{F8BD252D-69EF-4FBA-83F5-8B0B4817CBEF}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{3C2B18A6-7D50-4201-BBCC-6F4198D081AC}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{358EEE14-C96B-43EE-9741-72E69F65C702}] => (Allow) LPort=1688
FirewallRules: [{A3BE7377-E2D9-474E-BF8A-DF7A29F7CAE3}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{AB361F2C-2B7F-4B82-AC58-47C47244AAC8}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe
FirewallRules: [{4E17775B-4EB1-43BE-8383-30EA5BB47045}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

10-11-2018 09:02:34 Punto de control programado

==================== Faulty Device Manager Devices =============

Name: avast! SecureLine TAP Adapter v3
Description: avast! SecureLine TAP Adapter v3
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Windows Provider V9
Service: aswTap
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Dispositivo USB desconocido (Error de solicitud de descriptor de dispositivo)
Description: Dispositivo USB desconocido (Error de solicitud de descriptor de dispositivo)
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: (Controladora de host USB estándar)
Service: 
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation. 


==================== Event log errors: =========================

Application errors:
==================
Error: (11/12/2018 05:21:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: Service_KMS.exe, versión: 17.1.0.0, marca de tiempo: 0x56942c76
Nombre del módulo con errores: KERNELBASE.dll, versión: 10.0.17134.319, marca de tiempo: 0x1e206b26
Código de excepción: 0xe0434352
Desplazamiento de errores: 0x000000000003a388
Identificador del proceso con errores: 0xd58
Hora de inicio de la aplicación con errores: 0x01d47aa230077636
Ruta de acceso de la aplicación con errores: C:\Program Files\KMSpico\Service_KMS.exe
Ruta de acceso del módulo con errores: C:\WINDOWS\System32\KERNELBASE.dll
Identificador del informe: e6f66f16-775b-4c79-a638-cfc4bc053b9e
Nombre completo del paquete con errores: 
Identificador de aplicación relativa del paquete con errores:

Error: (11/12/2018 05:21:34 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Aplicación: Service_KMS.exe
Versión de Framework: v4.0.30319
Descripción: el proceso terminó debido a una excepción no controlada.
Información de la excepción: System.IO.FileNotFoundException
   en System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32, IntPtr)
   en System.Management.ManagementObject.InvokeMethod(System.String, System.Management.ManagementBaseObject, System.Management.InvokeMethodOptions)
   en Service_KMS.Activador.WMI.SoftwareLicensingProduct.Activate()
   en ᝑ.ᜀ(Service_KMS.Activador.Variables ByRef, System.Collections.Generic.List`1<Service_KMS.Activador.WMI.SoftwareLicensingProduct> ByRef)
   en Service_KMS.Activador.Activador.ᜃ(Service_KMS.Activador.Variables ByRef)
   en System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   en System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   en System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   en System.Threading.ThreadHelper.ThreadStart()

Error: (11/12/2018 05:07:23 PM) (Source: ESENT) (EventID: 489) (User: )
Description: CCleaner64 (9816,G,0) Al intentar abrir el archivo "C:\Users\Marcos\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat" para acceso de sólo lectura se produjo el error de sistema 32 (0x00000020): "El proceso no tiene acceso al archivo porque está siendo utilizado por otro proceso. ". La operación para abrir el archivo se cerrará con el error -1032 (0xfffffbf8).

Error: (11/12/2018 05:02:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: Service_KMS.exe, versión: 17.1.0.0, marca de tiempo: 0x56942c76
Nombre del módulo con errores: KERNELBASE.dll, versión: 10.0.17134.319, marca de tiempo: 0x1e206b26
Código de excepción: 0xe0434352
Desplazamiento de errores: 0x000000000003a388
Identificador del proceso con errores: 0xe38
Hora de inicio de la aplicación con errores: 0x01d47aa0c5dbc144
Ruta de acceso de la aplicación con errores: C:\Program Files\KMSpico\Service_KMS.exe
Ruta de acceso del módulo con errores: C:\WINDOWS\System32\KERNELBASE.dll
Identificador del informe: 8e96e5e5-6069-4999-bf41-3a406b9c749f
Nombre completo del paquete con errores: 
Identificador de aplicación relativa del paquete con errores:

Error: (11/12/2018 05:02:17 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Aplicación: Service_KMS.exe
Versión de Framework: v4.0.30319
Descripción: el proceso terminó debido a una excepción no controlada.
Información de la excepción: System.IO.FileNotFoundException
   en System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32, IntPtr)
   en System.Management.ManagementObject.InvokeMethod(System.String, System.Management.ManagementBaseObject, System.Management.InvokeMethodOptions)
   en Service_KMS.Activador.WMI.SoftwareLicensingProduct.Activate()
   en ᝑ.ᜀ(Service_KMS.Activador.Variables ByRef, System.Collections.Generic.List`1<Service_KMS.Activador.WMI.SoftwareLicensingProduct> ByRef)
   en Service_KMS.Activador.Activador.ᜂ(Service_KMS.Activador.Variables ByRef)
   en System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   en System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   en System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   en System.Threading.ThreadHelper.ThreadStart()

Error: (11/12/2018 02:26:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: Service_KMS.exe, versión: 17.1.0.0, marca de tiempo: 0x56942c76
Nombre del módulo con errores: KERNELBASE.dll, versión: 10.0.17134.319, marca de tiempo: 0x1e206b26
Código de excepción: 0xe0434352
Desplazamiento de errores: 0x000000000003a388
Identificador del proceso con errores: 0xcd4
Hora de inicio de la aplicación con errores: 0x01d47a861efc466b
Ruta de acceso de la aplicación con errores: C:\Program Files\KMSpico\Service_KMS.exe
Ruta de acceso del módulo con errores: C:\WINDOWS\System32\KERNELBASE.dll
Identificador del informe: f7d9e03b-5607-4147-adc6-057afb446f97
Nombre completo del paquete con errores: 
Identificador de aplicación relativa del paquete con errores:

Error: (11/12/2018 02:26:09 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Aplicación: Service_KMS.exe
Versión de Framework: v4.0.30319
Descripción: el proceso terminó debido a una excepción no controlada.
Información de la excepción: System.IO.FileNotFoundException
   en System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32, IntPtr)
   en System.Management.ManagementObject.InvokeMethod(System.String, System.Management.ManagementBaseObject, System.Management.InvokeMethodOptions)
   en Service_KMS.Activador.WMI.SoftwareLicensingProduct.Activate()
   en ᝑ.ᜀ(Service_KMS.Activador.Variables ByRef, System.Collections.Generic.List`1<Service_KMS.Activador.WMI.SoftwareLicensingProduct> ByRef)
   en Service_KMS.Activador.Activador.ᜂ(Service_KMS.Activador.Variables ByRef)
   en System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   en System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   en System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   en System.Threading.ThreadHelper.ThreadStart()

Error: (11/12/2018 12:58:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nombre de la aplicación con errores: Service_KMS.exe, versión: 17.1.0.0, marca de tiempo: 0x56942c76
Nombre del módulo con errores: KERNELBASE.dll, versión: 10.0.17134.319, marca de tiempo: 0x1e206b26
Código de excepción: 0xe0434352
Desplazamiento de errores: 0x000000000003a388
Identificador del proceso con errores: 0xf54
Hora de inicio de la aplicación con errores: 0x01d47a7d54d37728
Ruta de acceso de la aplicación con errores: C:\Program Files\KMSpico\Service_KMS.exe
Ruta de acceso del módulo con errores: C:\WINDOWS\System32\KERNELBASE.dll
Identificador del informe: 37fa332c-dc72-4054-88bd-0a7523a030f5
Nombre completo del paquete con errores: 
Identificador de aplicación relativa del paquete con errores:


System errors:
=============
Error: (11/13/2018 07:41:20 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-51BG0PM)
Description: La configuración de permisos específico de la aplicación no concede el permiso Activación Local para la aplicación de servidor COM con CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 y APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 al usuario DESKTOP-51BG0PM\Marcos con SID (S-1-5-21-2511560098-4189382557-1041078835-1001) en la dirección LocalHost (con LRPC) que se ejecuta en el contenedor de aplicaciones con SID No disponible (No disponible). Este permiso de seguridad se puede modificar mediante la herramienta administrativa Servicios de componentes.

Error: (11/13/2018 06:34:29 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-51BG0PM)
Description: La configuración de permisos específico de la aplicación no concede el permiso Activación Local para la aplicación de servidor COM con CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 y APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 al usuario DESKTOP-51BG0PM\Marcos con SID (S-1-5-21-2511560098-4189382557-1041078835-1001) en la dirección LocalHost (con LRPC) que se ejecuta en el contenedor de aplicaciones con SID No disponible (No disponible). Este permiso de seguridad se puede modificar mediante la herramienta administrativa Servicios de componentes.

Error: (11/13/2018 06:30:50 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-51BG0PM)
Description: La configuración de permisos específico de la aplicación no concede el permiso Activación Local para la aplicación de servidor COM con CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 y APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 al usuario DESKTOP-51BG0PM\Marcos con SID (S-1-5-21-2511560098-4189382557-1041078835-1001) en la dirección LocalHost (con LRPC) que se ejecuta en el contenedor de aplicaciones con SID No disponible (No disponible). Este permiso de seguridad se puede modificar mediante la herramienta administrativa Servicios de componentes.

Error: (11/13/2018 06:22:34 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-51BG0PM)
Description: La configuración de permisos específico de la aplicación no concede el permiso Activación Local para la aplicación de servidor COM con CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 y APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 al usuario DESKTOP-51BG0PM\Marcos con SID (S-1-5-21-2511560098-4189382557-1041078835-1001) en la dirección LocalHost (con LRPC) que se ejecuta en el contenedor de aplicaciones con SID Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). Este permiso de seguridad se puede modificar mediante la herramienta administrativa Servicios de componentes.

Error: (11/13/2018 06:21:50 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-51BG0PM)
Description: La configuración de permisos específico de la aplicación no concede el permiso Activación Local para la aplicación de servidor COM con CLSID 
{D63B10C5-BB46-4990-A94F-E40B9D520160}
 y APPID 
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
 al usuario DESKTOP-51BG0PM\Marcos con SID (S-1-5-21-2511560098-4189382557-1041078835-1001) en la dirección LocalHost (con LRPC) que se ejecuta en el contenedor de aplicaciones con SID No disponible (No disponible). Este permiso de seguridad se puede modificar mediante la herramienta administrativa Servicios de componentes.

Error: (11/13/2018 06:15:22 AM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-51BG0PM)
Description: La configuración de permisos específico de la aplicación no concede el permiso Activación Local para la aplicación de servidor COM con CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 y APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 al usuario DESKTOP-51BG0PM\Marcos con SID (S-1-5-21-2511560098-4189382557-1041078835-1001) en la dirección LocalHost (con LRPC) que se ejecuta en el contenedor de aplicaciones con SID Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). Este permiso de seguridad se puede modificar mediante la herramienta administrativa Servicios de componentes.

Error: (11/13/2018 05:55:36 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: El servicio Nero Update se terminó de manera inesperada. Esto ha sucedido 1 veces.

Error: (11/13/2018 05:55:36 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: El servicio NitroUpdateService se terminó de manera inesperada. Esto ha sucedido 1 veces.


CodeIntegrity:
===================================

Date: 2018-11-13 07:05:09.415
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-11-13 06:56:18.370
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-11-13 06:48:26.125
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-11-13 06:48:08.789
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-11-13 06:41:40.812
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-11-13 06:31:00.982
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-11-13 06:21:08.291
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

Date: 2018-11-13 06:20:34.508
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info =========================== 

Processor: AMD A10-9700E RADEON R7, 10 COMPUTE CORES 4C+6G
Percentage of memory in use: 36%
Total physical RAM: 7632.84 MB
Available physical RAM: 4850.56 MB
Total Virtual: 8848.84 MB
Available Virtual: 6168.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1861.57 GB) (Free:564.73 GB) NTFS

\\?\Volume{ae76549c-0000-0000-0000-100000000000}\ (Reservado para el sistema) (Fixed) (Total:0.49 GB) (Free:0.45 GB) NTFS
\\?\Volume{ae76549c-0000-0000-0000-0084d1010000}\ () (Fixed) (Total:0.47 GB) (Free:0.08 GB) NTFS
\\?\Volume{ae76549c-0000-0000-0000-40a2d1010000}\ () (Fixed) (Total:0.48 GB) (Free:0.09 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 1863 GB) (Disk ID: AE76549C)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1861.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=483 MB) - (Type=27)
Partition 4: (Not Active) - (Size=491 MB) - (Type=27)

==================== End of Addition.txt ============================

#12

Me Quedo con el de Daniela el otro lo pueden cerrar porfavor


#13

Hola

He juntado los reportes con el primer tema que abriste, no tienes que abrir un tema nuevo por cada reporte :wink:

En cuanto revise los informes de FRST, vuelvo con una respuesta.

Un saludo


#14

gracias por tu tiempo


#15

:arrow_forward: MUY Importante :arrow_backward: Realiza una copia de seguridad del registro :

  • Para hacerlo descarga :arrow_forward: DelFix.exe( en tu escritorio).

  • Doble clic para ejecutarlo.(Si usas Windows Vista/7/8 o 10 presiona clic derecho y selecciona -Ejecutar como Administrador-).

  • Atención, ahora marca/selecciona únicamente la casilla "Create registry backup", las demás NO.

  • Pulsar en Run.

Se abrirá el informe (DelFix.txt), guárdalo por si fuera necesario y cierra la herramienta.

:warning: Con los demás programas cerrados ve a :arrow_forward: Inicio :arrow_forward: Ejecutar :arrow_forward: y escribe Notepad.exe.

  • Ahora debes copiar y pegar los códigos/líneas que están en el interior del recuadro de más abajo, dentro del Notepad.
START
CREATERESTOREPOINT:
CLOSEPROCESSES:
HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [utweb] => C:\Users\nacho\AppData\Roaming\uTorrent Web\utweb.exe [5456560 2018-09-06] (BitTorrent Inc.)
HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [Gaijin.Net Agent] => C:\Users\nacho\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [2125384 2018-10-28] (Gaijin Entertainment)
HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [4c76b0b8] => C:\ProgramData\4c76b0b8\4c76b0b8.exe C:\ProgramData\4c76b0b8\test.au3
HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [4c76b0b82] => C:\ProgramData\abimRU\4c76b0b8.exe [937776 2018-11-12] (AutoIt Team)
Startup: C:\Users\nacho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\14c76b0b8bc6af7c224906cf9a0a4621.lnk [2018-11-10]
ShortcutTarget: 14c76b0b8bc6af7c224906cf9a0a4621.lnk -> C:\ProgramData\DoLPPE\4c76b0b8.exe (AutoIt Team)
CHR Extension: (Chrome Media Router) - C:\Users\nacho\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-11-04]
2018-11-12 18:48 - 2018-11-12 18:48 - 000000000 ____D C:\ProgramData\GsZCeBv
2018-11-09 04:12 - 2018-11-09 04:12 - 000000000 ____D C:\ProgramData\DoLPPE
2018-11-09 04:06 - 2018-11-09 04:10 - 000000000 ____D C:\ProgramData\uEVPOBCc
2018-11-04 14:16 - 2018-11-09 04:04 - 000000000 ____D C:\Users\nacho\AppData\Roaming\5c61b2d25c78f1c5b4ee2001c9645a01
2018-11-10 23:17 - 2017-12-25 00:00 - 000000000 ____D C:\ProgramData\4c76b0b8
Task: {3B3F88D4-C1AB-47B4-8812-BA149912BCB1} - System32\Tasks\Goodgame Empire1 => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --app=hxxps://empire.goodgamestudios.com/?w=376971 --app-window-size=1360,768
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\Windows\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()
Task: {8B00EE96-133D-49CC-9F4C-491C5F5952D2} - System32\Tasks\Goodgame Empire2 => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --app=hxxps://empire.goodgamestudios.com/?w=376971 --app-window-size=1360,768
Task: {99A8D270-58D9-4711-89E5-E64BD94543EF} - System32\Tasks\Goodgame Empire0 => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --app=hxxps://empire.goodgamestudios.com/?w=376971 --app-window-size=1360,768
AlternateDataStreams: C:\Users\nacho:Heroes & Generals [38]

HOSTS:
REMOVEPROXY:
EMPTYTEMP:
CMD: netsh winsock reset
CMD: ipconfig /renew
CMD: ipconfig /flushdns
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
END

Guárdalo bajo el nombre de FIXLIST.TXT en el escritorio :arrow_backward: Esto es muy importante.

:o: Nota :o: Es importante que la herramienta FRST.exe (Farbar Recovery Scanner Tool) y FIXLIST.TXT se encuentren en la misma ubicación (escritorio) o si no, no trabajara.

  • Ejecuta FRST.exe.(Si usas Windows Vista/7/8 o 10, presiona clic derecho y seleccionas -Ejecutar como Administrador-).
  • Presionar el botón FIX y aguardar a que termine.
  • La Herramienta guardara el reporte de reparación en el escritorio (FIXLOG.TXT).

Pega el contenido de este fichero en tu próxima respuesta.

Reiniciar el equipo y comprobar su funcionamiento en relación al problema planteado y comentarlo.

Un saludo


#16

Fix result of Farbar Recovery Scan Tool (x64) Version: 11.11.2018
Ran by Marcos (14-11-2018 06:42:04) Run:1
Running from C:\Users\Marcos\Desktop
Loaded Profiles: Marcos (Available Profiles: Marcos)
Boot Mode: Normal
==============================================

fixlist content:
*****************
START

CREATERESTOREPOINT:

CLOSEPROCESSES:

HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [utweb] => C:\Users\nacho\AppData\Roaming\uTorrent Web\utweb.exe [5456560 2018-09-06] (BitTorrent Inc.)

HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [Gaijin.Net Agent] => C:\Users\nacho\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [2125384 2018-10-28] (Gaijin Entertainment)

HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [4c76b0b8] => C:\ProgramData\4c76b0b8\4c76b0b8.exe C:\ProgramData\4c76b0b8\test.au3

HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\...\Run: [4c76b0b82] => C:\ProgramData\abimRU\4c76b0b8.exe [937776 2018-11-12] (AutoIt Team)

Startup: C:\Users\nacho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\14c76b0b8bc6af7c224906cf9a0a4621.lnk [2018-11-10]

ShortcutTarget: 14c76b0b8bc6af7c224906cf9a0a4621.lnk -> C:\ProgramData\DoLPPE\4c76b0b8.exe (AutoIt Team)

CHR Extension: (Chrome Media Router) - C:\Users\nacho\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-11-04]

2018-11-12 18:48 - 2018-11-12 18:48 - 000000000 ____D C:\ProgramData\GsZCeBv

2018-11-09 04:12 - 2018-11-09 04:12 - 000000000 ____D C:\ProgramData\DoLPPE

2018-11-09 04:06 - 2018-11-09 04:10 - 000000000 ____D C:\ProgramData\uEVPOBCc

2018-11-04 14:16 - 2018-11-09 04:04 - 000000000 ____D C:\Users\nacho\AppData\Roaming\5c61b2d25c78f1c5b4ee2001c9645a01

2018-11-10 23:17 - 2017-12-25 00:00 - 000000000 ____D C:\ProgramData\4c76b0b8

Task: {3B3F88D4-C1AB-47B4-8812-BA149912BCB1} - System32\Tasks\Goodgame Empire1 => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --app=hxxps://empire.goodgamestudios.com/?w=376971 --app-window-size=1360,768

Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\Windows\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-12] ()

Task: {8B00EE96-133D-49CC-9F4C-491C5F5952D2} - System32\Tasks\Goodgame Empire2 => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --app=hxxps://empire.goodgamestudios.com/?w=376971 --app-window-size=1360,768

Task: {99A8D270-58D9-4711-89E5-E64BD94543EF} - System32\Tasks\Goodgame Empire0 => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --app=hxxps://empire.goodgamestudios.com/?w=376971 --app-window-size=1360,768

AlternateDataStreams: C:\Users\nacho:Heroes & Generals [38]



HOSTS:

REMOVEPROXY:

EMPTYTEMP:

CMD: netsh winsock reset

CMD: ipconfig /renew

CMD: ipconfig /flushdns

CMD: bitsadmin /reset /allusers

CMD: netsh advfirewall reset

CMD: netsh advfirewall set allprofiles state ON

CMD: netsh int ipv4 reset

CMD: netsh int ipv6 reset

END
*****************

Restore point was successfully created.
Processes closed successfully.
"HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\Software\Microsoft\Windows\CurrentVersion\Run\\utweb" => not found
"HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Gaijin.Net Agent" => not found
"HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\Software\Microsoft\Windows\CurrentVersion\Run\\4c76b0b8" => not found
"HKU\S-1-5-21-3034072527-1753083731-4258197151-1001\Software\Microsoft\Windows\CurrentVersion\Run\\4c76b0b82" => not found
"C:\Users\nacho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\14c76b0b8bc6af7c224906cf9a0a4621.lnk" => not found
"C:\ProgramData\DoLPPE\4c76b0b8.exe" => not found
CHR Extension: (Chrome Media Router) - C:\Users\nacho\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-11-04] => Error: No automatic fix found for this entry.
"C:\ProgramData\GsZCeBv" => not found
"C:\ProgramData\DoLPPE" => not found
"C:\ProgramData\uEVPOBCc" => not found
"C:\Users\nacho\AppData\Roaming\5c61b2d25c78f1c5b4ee2001c9645a01" => not found
"C:\ProgramData\4c76b0b8" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B3F88D4-C1AB-47B4-8812-BA149912BCB1}" => not found
"C:\WINDOWS\System32\Tasks\Goodgame Empire1" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Goodgame Empire1" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{65B85F6F-35B3-4459-A179-28255D5B7B25}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{65B85F6F-35B3-4459-A179-28255D5B7B25}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\HelloFace\FODCleanupTask" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8B00EE96-133D-49CC-9F4C-491C5F5952D2}" => not found
"C:\WINDOWS\System32\Tasks\Goodgame Empire2" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Goodgame Empire2" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99A8D270-58D9-4711-89E5-E64BD94543EF}" => not found
"C:\WINDOWS\System32\Tasks\Goodgame Empire0" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Goodgame Empire0" => not found
"C:\Users\nacho" => ":Heroes & Generals" ADS not found.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully


========= End of RemoveProxy: =========


========= netsh winsock reset =========


El cat logo Winsock se restableci¢ correctamente.
Debe reiniciar el equipo para completar el restablecimiento.


========= End of CMD: =========


========= ipconfig /renew =========


Configuraci¢n IP de Windows


Adaptador de Ethernet Ethernet:

   Sufijo DNS espec¡fico para la conexi¢n. . : 
   V¡nculo: direcci¢n IPv6 local. . . : fe80::3932:1904:56e5:6bfe%15
   Direcci¢n IPv4. . . . . . . . . . . . . . : 192.168.1.10
   M scara de subred . . . . . . . . . . . . : 255.255.255.0
   Puerta de enlace predeterminada . . . . . : 192.168.1.1

========= End of CMD: =========


========= ipconfig /flushdns =========


Configuraci¢n IP de Windows

Se vaci¢ correctamente la cach‚ de resoluci¢n de DNS.

========= End of CMD: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

Unable to cancel {38757184-C4AA-4258-85FF-6548C1FDB943}.
{72652964-5F3B-4CF2-88A1-185B542211EF} canceled.
Unable to cancel {D50AE37B-2AC9-49EB-8CBB-CAF38490C1B4}.
{B95F5556-A73F-4A90-BA52-E8B19315E0FE} canceled.
{F89EABCA-7B70-4673-BB6D-DEBD57DD637E} canceled.
3 out of 5 jobs canceled.

========= End of CMD: =========


========= netsh advfirewall reset =========

Aceptar


========= End of CMD: =========


========= netsh advfirewall set allprofiles state ON =========

Aceptar


========= End of CMD: =========


#17

========= netsh int ipv4 reset =========

Reenv¡o de compartimiento se restableci¢ correctamente.
Compartimiento se restableci¢ correctamente.
Protocolo de control se restableci¢ correctamente.
Solicitud de secuencia eco se restableci¢ correctamente.
Global se restableci¢ correctamente.
Interfaz se restableci¢ correctamente.
Direcci¢n de difusi¢n por proximidad (a se restableci¢ correctamente.
Direcciones de multidifusi¢n se restableci¢ correctamente.
Direcci¢n de unidifusi¢n se restableci¢ correctamente.
Vecino se restableci¢ correctamente.
Ruta de acceso se restableci¢ correctamente.
Posible se restableci¢ correctamente.
Directiva de prefijo se restableci¢ correctamente.
Vecino de proxy se restableci¢ correctamente.
Ruta se restableci¢ correctamente.
Prefijo de sitio se restableci¢ correctamente.
Subinterfaz se restableci¢ correctamente.
Patr¢n de reactivaci¢n se restableci¢ correctamente.
Resolver vecino se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
Error al restablecer .
Acceso denegado.

 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
Reinicie el equipo para completar esta acci¢n.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Reenv¡o de compartimiento se restableci¢ correctamente.
Compartimiento se restableci¢ correctamente.
Protocolo de control se restableci¢ correctamente.
Solicitud de secuencia eco se restableci¢ correctamente.
Global se restableci¢ correctamente.
Interfaz se restableci¢ correctamente.
Direcci¢n de difusi¢n por proximidad (a se restableci¢ correctamente.
Direcciones de multidifusi¢n se restableci¢ correctamente.
Direcci¢n de unidifusi¢n se restableci¢ correctamente.
Vecino se restableci¢ correctamente.
Ruta de acceso se restableci¢ correctamente.
Posible se restableci¢ correctamente.
Directiva de prefijo se restableci¢ correctamente.
Vecino de proxy se restableci¢ correctamente.
Ruta se restableci¢ correctamente.
Prefijo de sitio se restableci¢ correctamente.
Subinterfaz se restableci¢ correctamente.
Patr¢n de reactivaci¢n se restableci¢ correctamente.
Resolver vecino se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
Error al restablecer .
Acceso denegado.

 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
 se restableci¢ correctamente.
Reinicie el equipo para completar esta acci¢n.


========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 52350757 B
Java, Flash, Steam htmlcache => 343 B
Windows/system/drivers => 1839842 B
Edge => 35840 B
Chrome => 711293 B
Firefox => 16603260 B
Opera => 153004 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 912 B
LocalService => 0 B
NetworkService => 0 B
NetworkService => 0 B
Marcos => 21562809 B

RecycleBin => 0 B
EmptyTemp: => 99 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 06:45:54 ====

#18

por mi parte se soluciono el problema, espero que no vuerva al ataque el hacker. Muchas gracias por su tiempo


#19

El Hacker ataca denuvo

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build:    09-25-2018
# Database: 2018-09-21.1 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    11-14-2018
# Duration: 00:00:00
# OS:       Windows 10 Pro
# Cleaned:  1
# Failed:   0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted       C:\ProgramData\9EF66CEA

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

No malicious registry entries cleaned.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


AdwCleaner[S00].txt - [8777 octets] - [30/07/2018 09:24:18]
AdwCleaner[C00].txt - [7820 octets] - [30/07/2018 09:24:44]
AdwCleaner[S01].txt - [1419 octets] - [30/07/2018 14:30:20]
AdwCleaner[C01].txt - [1585 octets] - [30/07/2018 14:35:55]
AdwCleaner[S02].txt - [1485 octets] - [30/07/2018 16:33:42]
AdwCleaner[C02].txt - [1671 octets] - [30/07/2018 16:35:01]
AdwCleaner[S03].txt - [1607 octets] - [31/07/2018 03:04:41]
AdwCleaner[S04].txt - [1668 octets] - [03/08/2018 18:38:46]
AdwCleaner[C04].txt - [1854 octets] - [03/08/2018 18:39:07]
AdwCleaner[S05].txt - [1790 octets] - [11/08/2018 14:04:49]
AdwCleaner[C05].txt - [1976 octets] - [11/08/2018 14:05:13]
AdwCleaner[S06].txt - [1912 octets] - [13/08/2018 08:36:00]
AdwCleaner[S07].txt - [1973 octets] - [13/08/2018 08:36:33]
AdwCleaner[C07].txt - [2159 octets] - [13/08/2018 08:36:53]
AdwCleaner[S08].txt - [2095 octets] - [20/08/2018 21:55:41]
AdwCleaner[C08].txt - [2281 octets] - [20/08/2018 21:56:14]
AdwCleaner[S09].txt - [3057 octets] - [02/09/2018 15:45:13]
AdwCleaner[C09].txt - [3059 octets] - [02/09/2018 15:45:36]
AdwCleaner[S10].txt - [8084 octets] - [05/09/2018 22:46:46]
AdwCleaner[C10].txt - [7473 octets] - [05/09/2018 22:47:07]
AdwCleaner[S11].txt - [2469 octets] - [05/09/2018 22:51:35]
AdwCleaner[S12].txt - [9365 octets] - [24/09/2018 04:53:32]
AdwCleaner[C12].txt - [8574 octets] - [24/09/2018 04:53:59]
AdwCleaner[S13].txt - [2640 octets] - [24/09/2018 05:03:21]
AdwCleaner[S14].txt - [2701 octets] - [24/09/2018 17:35:33]
AdwCleaner[S15].txt - [2762 octets] - [26/09/2018 04:40:17]
AdwCleaner[S16].txt - [2835 octets] - [27/09/2018 15:06:41]
AdwCleaner[C16].txt - [3021 octets] - [27/09/2018 15:06:57]
AdwCleaner[S17].txt - [2957 octets] - [30/09/2018 22:09:31]
AdwCleaner[C17].txt - [3143 octets] - [30/09/2018 22:09:43]
AdwCleaner[S18].txt - [3278 octets] - [03/10/2018 20:33:08]
AdwCleaner[C18].txt - [3426 octets] - [03/10/2018 20:33:30]
AdwCleaner[S19].txt - [3201 octets] - [04/10/2018 21:27:10]
AdwCleaner[S20].txt - [3262 octets] - [05/10/2018 22:54:13]
AdwCleaner[S21].txt - [3323 octets] - [10/10/2018 17:26:25]
AdwCleaner[S22].txt - [3412 octets] - [14/10/2018 21:38:04]
AdwCleaner[C22].txt - [3578 octets] - [14/10/2018 21:38:20]
AdwCleaner[S23].txt - [3534 octets] - [15/10/2018 03:07:02]
AdwCleaner[C23].txt - [3700 octets] - [15/10/2018 03:07:21]
AdwCleaner[S24].txt - [3656 octets] - [15/10/2018 10:54:07]
AdwCleaner[C24].txt - [3822 octets] - [15/10/2018 10:54:24]
AdwCleaner[S25].txt - [3778 octets] - [15/10/2018 17:04:04]
AdwCleaner[C25].txt - [3944 octets] - [15/10/2018 17:04:17]
AdwCleaner[S26].txt - [3900 octets] - [15/10/2018 21:47:42]
AdwCleaner[C26].txt - [4066 octets] - [15/10/2018 21:48:05]
AdwCleaner[S27].txt - [4022 octets] - [17/10/2018 14:16:21]
AdwCleaner[C27].txt - [4188 octets] - [17/10/2018 14:16:36]
AdwCleaner[S28].txt - [4144 octets] - [27/10/2018 13:53:02]
AdwCleaner[C28].txt - [4310 octets] - [27/10/2018 13:53:28]
AdwCleaner[S29].txt - [4266 octets] - [29/10/2018 13:33:54]
AdwCleaner[C29].txt - [4432 octets] - [29/10/2018 13:35:02]
AdwCleaner[S30].txt - [4587 octets] - [31/10/2018 06:43:48]
AdwCleaner[C30].txt - [4715 octets] - [31/10/2018 06:44:02]
AdwCleaner[S31].txt - [4510 octets] - [01/11/2018 06:39:39]
AdwCleaner[C31].txt - [4676 octets] - [01/11/2018 06:39:54]
AdwCleaner[S32].txt - [4705 octets] - [05/11/2018 12:46:09]
AdwCleaner[C32].txt - [4851 octets] - [05/11/2018 12:46:20]
AdwCleaner[S33].txt - [4754 octets] - [06/11/2018 05:16:06]
AdwCleaner[C33].txt - [4920 octets] - [06/11/2018 05:16:19]
AdwCleaner[S34].txt - [4925 octets] - [06/11/2018 06:38:20]
AdwCleaner[C34].txt - [5071 octets] - [06/11/2018 06:38:54]
AdwCleaner[S35].txt - [4970 octets] - [06/11/2018 09:02:20]
AdwCleaner[C35].txt - [5156 octets] - [06/11/2018 09:03:07]
AdwCleaner[S36].txt - [5092 octets] - [06/11/2018 13:51:21]
AdwCleaner[S37].txt - [5756 octets] - [07/11/2018 01:09:24]
AdwCleaner[C37].txt - [5772 octets] - [07/11/2018 01:09:54]
AdwCleaner[S38].txt - [5303 octets] - [07/11/2018 07:53:15]
AdwCleaner[C38].txt - [5469 octets] - [07/11/2018 07:53:29]
AdwCleaner[S39].txt - [5425 octets] - [07/11/2018 09:06:39]
AdwCleaner[C39].txt - [5591 octets] - [07/11/2018 09:06:51]
AdwCleaner[S40].txt - [5519 octets] - [07/11/2018 12:33:04]
AdwCleaner[S41].txt - [5580 octets] - [07/11/2018 15:07:02]
AdwCleaner[S42].txt - [5641 octets] - [07/11/2018 19:44:36]
AdwCleaner[S43].txt - [5730 octets] - [10/11/2018 02:28:48]
AdwCleaner[C43].txt - [5896 octets] - [10/11/2018 02:29:01]
AdwCleaner[S44].txt - [5852 octets] - [10/11/2018 02:34:11]
AdwCleaner[C44].txt - [6018 octets] - [10/11/2018 02:35:15]
AdwCleaner[S45].txt - [5974 octets] - [10/11/2018 02:41:30]
AdwCleaner[C45].txt - [6140 octets] - [10/11/2018 02:41:53]
AdwCleaner[S46].txt - [6096 octets] - [10/11/2018 02:49:31]
AdwCleaner[C46].txt - [6262 octets] - [10/11/2018 02:49:46]
AdwCleaner[S47].txt - [6218 octets] - [10/11/2018 02:55:10]
AdwCleaner[C47].txt - [6384 octets] - [10/11/2018 02:55:20]
AdwCleaner[S48].txt - [6312 octets] - [10/11/2018 03:05:00]
AdwCleaner[S49].txt - [6373 octets] - [10/11/2018 03:17:52]
AdwCleaner[S50].txt - [6462 octets] - [10/11/2018 21:52:56]
AdwCleaner[C50].txt - [6628 octets] - [10/11/2018 21:53:17]
AdwCleaner[S51].txt - [6584 octets] - [11/11/2018 03:43:41]
AdwCleaner[C51].txt - [6750 octets] - [11/11/2018 03:43:51]
AdwCleaner[S52].txt - [6706 octets] - [11/11/2018 03:51:20]
AdwCleaner[C52].txt - [6872 octets] - [11/11/2018 03:51:31]
AdwCleaner[S53].txt - [6828 octets] - [11/11/2018 14:32:59]
AdwCleaner[C53].txt - [6994 octets] - [11/11/2018 14:33:07]
AdwCleaner[S54].txt - [6922 octets] - [11/11/2018 14:40:14]
AdwCleaner[S55].txt - [6983 octets] - [11/11/2018 15:47:54]
AdwCleaner[S56].txt - [7072 octets] - [12/11/2018 12:42:04]
AdwCleaner[C56].txt - [7238 octets] - [12/11/2018 12:42:12]
AdwCleaner[S57].txt - [7166 octets] - [12/11/2018 12:50:26]
AdwCleaner[S58].txt - [7227 octets] - [12/11/2018 13:34:47]
AdwCleaner[S59].txt - [7316 octets] - [12/11/2018 16:55:59]
AdwCleaner[C59].txt - [7482 octets] - [12/11/2018 16:57:21]
AdwCleaner[S60].txt - [7438 octets] - [12/11/2018 17:04:27]
AdwCleaner[C60].txt - [7604 octets] - [12/11/2018 17:05:40]
AdwCleaner[S61].txt - [7532 octets] - [12/11/2018 17:14:03]
AdwCleaner[S62].txt - [7593 octets] - [12/11/2018 17:34:33]
AdwCleaner[S63].txt - [7682 octets] - [12/11/2018 21:42:46]
AdwCleaner[C63].txt - [7848 octets] - [12/11/2018 21:43:05]
AdwCleaner[S64].txt - [7776 octets] - [12/11/2018 23:21:22]
AdwCleaner[S65].txt - [7865 octets] - [13/11/2018 00:37:01]
AdwCleaner[C65].txt - [8031 octets] - [13/11/2018 00:37:11]
AdwCleaner[S66].txt - [7987 octets] - [13/11/2018 00:42:47]
AdwCleaner[C66].txt - [8153 octets] - [13/11/2018 00:44:33]
AdwCleaner[S67].txt - [8109 octets] - [13/11/2018 00:50:35]
AdwCleaner[C67].txt - [8275 octets] - [13/11/2018 00:50:51]
AdwCleaner[S68].txt - [8203 octets] - [13/11/2018 00:58:51]
AdwCleaner[S69].txt - [8264 octets] - [13/11/2018 01:26:05]
AdwCleaner[S70].txt - [8353 octets] - [13/11/2018 02:10:41]
AdwCleaner[C70].txt - [8519 octets] - [13/11/2018 02:13:37]
AdwCleaner[S71].txt - [8475 octets] - [13/11/2018 02:26:58]
AdwCleaner[C71].txt - [8641 octets] - [13/11/2018 02:27:11]
AdwCleaner[S72].txt - [8597 octets] - [13/11/2018 03:31:32]
AdwCleaner[C72].txt - [8763 octets] - [13/11/2018 03:32:17]
AdwCleaner[S73].txt - [8719 octets] - [13/11/2018 03:40:37]
AdwCleaner[C73].txt - [8885 octets] - [13/11/2018 03:40:48]
AdwCleaner[S74].txt - [8841 octets] - [13/11/2018 03:48:32]
AdwCleaner[C74].txt - [9007 octets] - [13/11/2018 03:48:50]
AdwCleaner[S75].txt - [8963 octets] - [13/11/2018 05:08:07]
AdwCleaner[C75].txt - [9129 octets] - [13/11/2018 05:08:18]
AdwCleaner[S76].txt - [9085 octets] - [13/11/2018 05:55:23]
AdwCleaner[C76].txt - [9251 octets] - [13/11/2018 05:55:39]
AdwCleaner[S77].txt - [9207 octets] - [13/11/2018 14:21:51]
AdwCleaner[C77].txt - [9373 octets] - [13/11/2018 14:22:00]
AdwCleaner[S78].txt - [9301 octets] - [13/11/2018 14:29:19]
AdwCleaner[S79].txt - [9362 octets] - [13/11/2018 16:50:06]
AdwCleaner[S80].txt - [9451 octets] - [14/11/2018 06:19:08]
AdwCleaner[C80].txt - [9513 octets] - [14/11/2018 06:19:19]
AdwCleaner[S81].txt - [9573 octets] - [14/11/2018 06:24:52]
AdwCleaner[C81].txt - [9635 octets] - [14/11/2018 06:25:01]
AdwCleaner[S82].txt - [9695 octets] - [14/11/2018 06:57:42]
AdwCleaner[C82].txt - [9757 octets] - [14/11/2018 06:57:47]
AdwCleaner[S83].txt - [9817 octets] - [14/11/2018 07:06:37]
AdwCleaner[C83].txt - [9879 octets] - [14/11/2018 07:06:42]
AdwCleaner[S84].txt - [9911 octets] - [14/11/2018 08:07:24]
AdwCleaner[S85].txt - [10112 octets] - [14/11/2018 08:52:01]
AdwCleaner[C85].txt - [10155 octets] - [14/11/2018 08:52:08]
AdwCleaner[S86].txt - [10096 octets] - [14/11/2018 09:06:13]
AdwCleaner[S87].txt - [10158 octets] - [14/11/2018 09:32:40]
AdwCleaner[S88].txt - [10220 octets] - [14/11/2018 09:44:44]
AdwCleaner[S89].txt - [10282 octets] - [14/11/2018 10:10:08]
AdwCleaner[S90].txt - [10344 octets] - [14/11/2018 10:22:12]
AdwCleaner[S91].txt - [10406 octets] - [14/11/2018 11:50:30]
AdwCleaner[S92].txt - [10468 octets] - [14/11/2018 13:04:43]
AdwCleaner[S93].txt - [10558 octets] - [14/11/2018 21:34:25]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C93].txt ##########

PUP.Adaware.Heuristic

Salud y Suerte

Ata


#20

Hola

Copiaste el script para el Fixlist en el “notepad”? :roll_eyes:

Analiza de nuevo con FRST y traes los reportes.

Un saludo


#21

Lo borre todo, pense que estava resuelto el tema


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 14.11.2018
Ran by Marcos (administrator) on DESKTOP-51BG0PM (15-11-2018 07:13:17)
Running from C:\Users\Marcos\Desktop
Loaded Profiles: Marcos (Available Profiles: Marcos)
Platform: Windows 10 Pro Version 1803 17134.407 (X64) Language: Español (España, internacional)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\isesrv.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 2019\Nero BackItUp\NBService.exe
(Nitro PDF Software) C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe
() C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\SkypeApp.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.34.81.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 2019\Nero BackItUp\BackItUp.exe
(Nero AG) C:\Program Files (x86)\Nero\Transfer\Transfer.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Zbshareware Lab) C:\Program Files (x86)\USB Disk Security\USBGuard.exe
(Piriform Software Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(COMODO) C:\Program Files (x86)\Comodo\Internet Security Essentials\vkise.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
(Mega Limited) C:\Users\Marcos\AppData\Local\MEGAsync\MEGAsync.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Microsoft Corporation) C:\Windows\SysWOW64\systeminfo.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
() C:\Program Files\AVAST Software\Avast\AvastNM.exe
() C:\Program Files\AVAST Software\Avast\AvastNM.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe
(AVAST Software) C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9229280 2017-05-18] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2670056 2018-09-10] (Adobe Systems, Incorporated)
HKLM\...\Run: [COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1598144 2018-10-29] (COMODO)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242392 2018-11-07] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Nero BackItUp] => C:\Program Files (x86)\Nero\Nero 2019\Nero BackItup\BackItUp.exe [1170712 2018-08-07] (Nero AG)
HKLM-x32\...\Run: [DriveSpan] => C:\Program Files (x86)\Nero\Transfer\Transfer.exe [138520 2018-08-29] (Nero AG)
HKLM-x32\...\Run: [USB Security] => C:\Program Files (x86)\USB Disk Security\USBGuard.exe [695528 2015-01-31] (Zbshareware Lab)
HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [4251336 2018-10-10] (COMODO)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [TIDAL] => C:\Users\Marcos\AppData\Local\TIDAL\update.exe [1872168 2018-11-13] ()
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [19476424 2018-11-06] (Piriform Software Ltd)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [9ef66cea] => C:\ProgramData\9ef66cea\9ef66cea.exe [0 ] (AutoIt Team)
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\...\Run: [9ef66cea2] => C:\ProgramData\XdVbrLPtH\9ef66cea.exe [937776 2018-11-15] (AutoIt Team)
Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\39ef66cea7f6fd56e0cf454a162647bf.lnk [2018-11-15]
ShortcutTarget: 39ef66cea7f6fd56e0cf454a162647bf.lnk -> C:\DESKTOP-51BG0PM\swtknafkxq.exe (AutoIt Team)
Startup: C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2018-10-05]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Marcos\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 212.40.224.73 62.42.230.24
Tcpip\..\Interfaces\{7eafddf7-d1e6-4435-9929-fabbd50a8078}: [NameServer] 77.234.40.79
Tcpip\..\Interfaces\{b7683127-4afb-470e-a22b-325af95007f6}: [DhcpNameServer] 212.40.224.73 62.42.230.24

Internet Explorer:
==================
HKU\S-1-5-21-2511560098-4189382557-1041078835-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://es.yahoo.com/?fr=fp-comodo&type=33050001005_11.0.0.6728_i_hp_sp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
SearchScopes: HKU\S-1-5-21-2511560098-4189382557-1041078835-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02&pc=UE04
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-07-31] (Microsoft Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-07-31] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File

FireFox:
========
FF DefaultProfile: nmun83lg.default
FF ProfilePath: C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default [2018-11-15]
FF user.js: detected! => C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\user.js [2018-10-30]
FF Homepage: Mozilla\Firefox\Profiles\nmun83lg.default -> hxxps://es.yahoo.com/?fr=fp-comodo&type=33050001004_11.0.0.6728_i_hp_sp
FF Extension: (Avast Passwords) - C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\Extensions\[email protected] [2018-11-07]
FF Extension: (Avast SafePrice) - C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\Extensions\[email protected] [2018-11-07]
FF Extension: (Avast Online Security) - C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\nmun83lg.default\Extensions\[email protected] [2018-11-07]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi => not found
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\e10ssaffplg.xpi => not found
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 10\npnitromozilla.dll [2016-03-03] (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-07-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-07-30] (Google Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxps://www.google.es/","hxxps://www.google.com/","hxxp://www.google.com/","hxxps://www.google.com/","hxxps://www.google.com/","hxxps://es.yahoo.com/?fr=fpc-comodo&type=33050001006_11.0.0.6728_i_hp_sp","hxxps://es.yahoo.com/?fr=fpc-comodo&type=81_33050001006_69.0.3497.81_u_hp_sp"
CHR Profile: C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default [2018-11-14]
CHR Extension: (Presentaciones) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-07-30]
CHR Extension: (Dr.Web Anti-Virus Link Checker) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aleggpabliehgbeagmfhnodcijcmbonb [2018-07-30]
CHR Extension: (Documentos) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-07-30]
CHR Extension: (Google Drive) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-17]
CHR Extension: (YouTube) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-07-30]
CHR Extension: (Adblock Plus) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-10-31]
CHR Extension: (Spotify - Music for every moment) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnkjkdjlofllcpbemipjbcpfnglbgieh [2018-07-30]
CHR Extension: (FLV Player) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhogabmliblgpadclikpkjfnnipeebjm [2018-07-30]
CHR Extension: (Avast Passwords) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\emhginjpijfggbofeediiojmdlmlkoik [2018-11-13]
CHR Extension: (Avast SafePrice | Comparaciones, ofertas y cupones) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2018-11-13]
CHR Extension: (Drive ePub, PDF book to Google Books™) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabbklgdcbijclhlffpmllpgnkalmbfd [2018-07-30]
CHR Extension: (Hojas de cálculo) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-07-30]
CHR Extension: (Documentos de Google sin conexión) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-17]
CHR Extension: (MagicScroll eBook Reader) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgnmgfdoiplfmhgghbmlphanpfmjble [2018-07-30]
CHR Extension: (AdBlock) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-10-11]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2018-11-14]
CHR Extension: (Avast Online Security) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2018-11-07]
CHR Extension: (Flash® Player for YouTube™) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\lajdkhdcndkniopfefocbgbkofflagpm [2018-07-30]
CHR Extension: (Sistema de pagos de Chrome Web Store) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-07-30]
CHR Extension: (Gmail) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-07-30]
CHR Extension: (Chrome Media Router) - C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-10-26]
CHR Profile: C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\System Profile [2018-11-14]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2910696 2018-09-10] (Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2704872 2018-09-10] (Adobe Systems, Incorporated)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [8188768 2018-11-07] (AVAST Software)
S2 avast; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-07-30] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [325024 2018-11-07] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [338632 2018-11-07] (AVAST Software)
S3 avastm; C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-07-30] (AVAST Software)
S3 AvastWscReporter; C:\Program Files\AVAST Software\Avast\wsc_proxy.exe [57504 2018-11-07] (AVAST Software)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [10747264 2018-10-29] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2876096 2018-10-29] (COMODO)
R2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [1044680 2018-10-10] (COMODO)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6347056 2018-09-19] (Malwarebytes)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [604824 2018-07-17] (McAfee, Inc.)
R2 NeroBackItUpBackgroundService2019; C:\Program Files (x86)\Nero\Nero 2019\Nero BackItUp\NBService.exe [287000 2018-08-07] (Nero AG)
R2 NitroDriverReadSpool10; C:\Program Files\Nitro\Pro 10\NitroPDFDriverService10x64.exe [327320 2016-03-03] (Nitro PDF Software)
R2 NitroUpdateService; C:\Program Files\Nitro\Pro 10\Nitro_UpdateService.exe [417944 2016-03-03] ()
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-08-04] (Microsoft Corporation)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [11644656 2018-09-10] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4451616 2018-04-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107136 2018-09-21] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 amdgpio3; C:\WINDOWS\System32\drivers\amdgpio3.sys [33144 2017-04-01] (Advanced Micro Devices, Inc)
S3 amdkmcsp; C:\WINDOWS\system32\DRIVERS\amdkmcsp.sys [101232 2017-06-12] (Advanced Micro Devices, Inc. )
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0313866.inf_amd64_440e3fec3e221547\atikmdag.sys [36547464 2017-04-13] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0313866.inf_amd64_440e3fec3e221547\atikmpag.sys [520072 2017-04-13] (Advanced Micro Devices, Inc.)
R0 amdpsp; C:\WINDOWS\System32\DRIVERS\amdpsp.sys [243048 2017-06-12] (Advanced Micro Devices, Inc. )
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [201408 2018-11-07] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [230512 2018-11-07] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [201928 2018-11-07] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [346760 2018-11-07] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [59664 2018-11-07] (AVAST Software)
R0 aswElam; C:\WINDOWS\System32\drivers\aswElam.sys [15360 2018-11-07] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [47064 2018-11-07] (AVAST Software)
R1 aswKbd; C:\WINDOWS\System32\drivers\aswKbd.sys [42456 2018-11-07] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [163376 2018-11-07] (AVAST Software)
R1 aswNetSec; C:\WINDOWS\System32\drivers\aswNetSec.sys [483384 2018-11-07] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111968 2018-11-07] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [88112 2018-11-07] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1028840 2018-11-07] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [467904 2018-11-07] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [208640 2018-11-07] (AVAST Software)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2018-07-30] (The OpenVPN Project)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381144 2018-11-07] (AVAST Software)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [110088 2017-04-26] (Advanced Micro Devices)
S3 avgTap; C:\WINDOWS\System32\drivers\avgTap.sys [54888 2018-09-05] (The OpenVPN Project)
S0 cmdboot; C:\WINDOWS\System32\DRIVERS\cmdboot.sys [17944 2018-05-23] (COMODO)
R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [44056 2018-05-23] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [832032 2018-05-23] (COMODO)
R1 cmdhlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [50768 2018-05-23] (COMODO)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [152688 2018-10-30] (Malwarebytes)
R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [134400 2018-05-23] (COMODO)
R1 isedrv; C:\WINDOWS\system32\drivers\isedrv.sys [63256 2018-08-29] (COMODO)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
R0 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [198000 2018-11-14] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [119136 2018-11-15] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [63768 2018-11-15] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [260480 2018-11-15] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [111152 2018-11-15] (Malwarebytes)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [111608 2017-02-14] (McAfee, Inc.)
R0 pwdrvio; C:\WINDOWS\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\WINDOWS\system32\pwdspio.sys [12504 2013-09-30] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [954368 2017-04-12] (Realtek )
S3 smbdirect; C:\WINDOWS\System32\DRIVERS\smbdirect.sys [152064 2018-04-12] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44616 2018-04-12] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [331680 2018-04-12] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [44032 2018-04-12] (Microsoft Corporation)
S0 AEE3DF28; system32\drivers\AEE3DF28.sys [X]
U1 aswbdisk; no ImagePath
U3 avgbdisk; no ImagePath
S3 DrvAgent64; \??\C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS [X]
S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-15 07:17 - 2018-11-15 07:17 - 000000000 ____D C:\ProgramData\ERsOYEm
2018-11-15 07:13 - 2018-11-15 07:14 - 000025890 _____ C:\Users\Marcos\Desktop\FRST.txt
2018-11-15 07:09 - 2018-11-15 07:10 - 002416128 _____ (Farbar) C:\Users\Marcos\Desktop\FRST64.exe
2018-11-15 06:49 - 2018-11-15 06:49 - 000000000 ___HD C:\OneDriveTemp
2018-11-15 06:47 - 2018-11-15 06:47 - 000063768 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2018-11-15 06:46 - 2018-11-15 06:46 - 000260480 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-11-15 06:46 - 2018-11-15 06:46 - 000119136 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2018-11-15 06:46 - 2018-11-15 06:46 - 000111152 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2018-11-15 00:07 - 2018-11-15 00:07 - 076534856 _____ (Malwarebytes ) C:\Users\Marcos\Downloads\mb3-setup-cb.NT-3.5.1.2522-1.0.365-1.0.5292.exe
2018-11-15 00:05 - 2018-11-15 00:05 - 079876624 _____ (Malwarebytes ) C:\Users\Marcos\Downloads\mb3-setup-consumer-3.6.1.2711-1.0.482-1.0.7841.exe
2018-11-15 00:02 - 2018-11-15 00:02 - 007456384 _____ (AVAST Software) C:\Users\Marcos\Downloads\avast_premier_antivirus_setup_online.exe
2018-11-14 17:03 - 2018-11-14 17:03 - 381644471 _____ C:\Users\Marcos\Downloads\2001_Super_Skunk_Sea_Como_Sea.rar
2018-11-14 16:55 - 2018-11-14 16:56 - 435536262 _____ C:\Users\Marcos\Downloads\2014_Lepoka_Folkoholic_Metal.rar
2018-11-14 16:50 - 2018-11-14 16:50 - 311393614 _____ C:\Users\Marcos\Downloads\2018_La_Vela_Puerca_Destilar.rar
2018-11-14 14:42 - 2018-11-14 14:47 - 346441329 _____ C:\Users\Marcos\Downloads\2O18_Sk4-P_G4M3_0V3R.rar
2018-11-14 13:16 - 2018-11-14 13:16 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\54AB96AA.sys
2018-11-14 12:56 - 2018-11-14 12:57 - 303614631 _____ C:\Users\Marcos\Downloads\2004_Con_Todo_Respeto.7z
2018-11-14 12:56 - 2018-11-14 12:56 - 364283201 _____ C:\Users\Marcos\Downloads\1999_Apocalypshit.7z
2018-11-14 12:55 - 2018-11-14 12:56 - 344578550 _____ C:\Users\Marcos\Downloads\1997_Donde_Jugarán_Las_Niñas.7z
2018-11-14 12:48 - 2018-11-14 12:48 - 441593894 _____ C:\Users\Marcos\Downloads\2018_Molotov_MTV_Unplugged_El_Desconecte.rar
2018-11-14 12:42 - 2018-11-14 12:42 - 294674561 _____ C:\Users\Marcos\Downloads\2018_Cuatro_Madres_El_Fin_Del_Principio.rar
2018-11-14 12:40 - 2018-11-14 12:40 - 000001778 _____ C:\Users\Marcos\Downloads\SK4-P-G4M3-0V3R.txt
2018-11-14 12:31 - 2018-11-14 12:31 - 389587392 _____ C:\Users\Marcos\Downloads\1994_Cicatriz_En_Directo_(Ver.Zika_Records_1995).rar
2018-11-14 12:25 - 2018-11-14 12:25 - 552584312 _____ C:\Users\Marcos\Downloads\2018_Escuela_De_Odio_XXV.rar
2018-11-14 12:16 - 2018-11-14 12:16 - 255202862 _____ C:\Users\Marcos\Downloads\2018_Decibelios_Insurgents.rar
2018-11-14 12:14 - 2018-11-14 12:14 - 361926472 _____ C:\Users\Marcos\Downloads\1997_Potato_PKO_Original.rar
2018-11-14 11:13 - 2018-11-01 12:45 - 004527776 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2018-11-14 11:13 - 2018-11-01 12:45 - 001617320 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2018-11-14 11:13 - 2018-11-01 12:29 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-11-14 11:13 - 2018-11-01 10:15 - 023861760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-11-14 11:13 - 2018-11-01 10:13 - 019525120 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-11-14 11:13 - 2018-11-01 08:27 - 001017152 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2adec.dll
2018-11-14 11:13 - 2018-11-01 08:26 - 007432120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-11-14 11:13 - 2018-11-01 08:25 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-11-14 11:13 - 2018-11-01 08:25 - 007520088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-11-14 11:13 - 2018-11-01 08:25 - 002371296 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-11-14 11:13 - 2018-11-01 08:09 - 025855488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-11-14 11:13 - 2018-11-01 08:03 - 003397120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-11-14 11:13 - 2018-11-01 08:01 - 022716416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-11-14 11:13 - 2018-11-01 08:00 - 008189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-11-14 11:13 - 2018-11-01 07:58 - 007573504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-11-14 11:13 - 2018-11-01 07:58 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-11-14 11:13 - 2018-11-01 05:48 - 006039064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-11-14 11:13 - 2018-11-01 05:47 - 006570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-11-14 11:13 - 2018-11-01 05:40 - 022015488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-11-14 11:13 - 2018-11-01 05:35 - 019403776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-11-14 11:12 - 2018-11-01 12:49 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-11-14 11:12 - 2018-11-01 12:46 - 002394960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVCORE.DLL
2018-11-14 11:12 - 2018-11-01 12:45 - 001376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2018-11-14 11:12 - 2018-11-01 12:32 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-11-14 11:12 - 2018-11-01 12:31 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-11-14 11:12 - 2018-11-01 12:30 - 000122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2018-11-14 11:12 - 2018-11-01 12:30 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\msisip.dll
2018-11-14 11:12 - 2018-11-01 12:29 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SMSRouter.dll
2018-11-14 11:12 - 2018-11-01 12:28 - 004491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2018-11-14 11:12 - 2018-11-01 12:28 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-11-14 11:12 - 2018-11-01 12:28 - 000253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2018-11-14 11:12 - 2018-11-01 12:27 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-11-14 11:12 - 2018-11-01 12:27 - 000878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2018-11-14 11:12 - 2018-11-01 12:26 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-11-14 11:12 - 2018-11-01 12:26 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2018-11-14 11:12 - 2018-11-01 12:26 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpshell.exe
2018-11-14 11:12 - 2018-11-01 12:26 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-11-14 11:12 - 2018-11-01 12:26 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpinit.exe
2018-11-14 11:12 - 2018-11-01 12:25 - 000577024 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2018-11-14 11:12 - 2018-11-01 11:09 - 001027000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2018-11-14 11:12 - 2018-11-01 10:59 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-11-14 11:12 - 2018-11-01 10:56 - 011902464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-11-14 11:12 - 2018-11-01 10:56 - 000226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2018-11-14 11:12 - 2018-11-01 10:56 - 000024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msisip.dll
2018-11-14 11:12 - 2018-11-01 10:54 - 003397632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2018-11-14 11:12 - 2018-11-01 10:54 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-11-14 11:12 - 2018-11-01 10:53 - 000908288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2018-11-14 11:12 - 2018-11-01 10:52 - 002892800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-11-14 11:12 - 2018-11-01 08:39 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-11-14 11:12 - 2018-11-01 08:38 - 000269336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-11-14 11:12 - 2018-11-01 08:37 - 000272408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-11-14 11:12 - 2018-11-01 08:28 - 001221432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-11-14 11:12 - 2018-11-01 08:28 - 001062712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-11-14 11:12 - 2018-11-01 08:28 - 001029944 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-11-14 11:12 - 2018-11-01 08:28 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-11-14 11:12 - 2018-11-01 08:28 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-11-14 11:12 - 2018-11-01 08:28 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-11-14 11:12 - 2018-11-01 08:27 - 000491200 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2018-11-14 11:12 - 2018-11-01 08:26 - 003291640 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2018-11-14 11:12 - 2018-11-01 08:26 - 003180080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2018-11-14 11:12 - 2018-11-01 08:26 - 001363536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 004404912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 002822456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-11-14 11:12 - 2018-11-01 08:25 - 002571320 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 001934808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 001784680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 001456728 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-11-14 11:12 - 2018-11-01 08:25 - 001288920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 001257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-11-14 11:12 - 2018-11-01 08:25 - 001209888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 001190248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-11-14 11:12 - 2018-11-01 08:25 - 000982592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-11-14 11:12 - 2018-11-01 08:25 - 000885968 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 000793080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-11-14 11:12 - 2018-11-01 08:25 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 000594224 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2018-11-14 11:12 - 2018-11-01 08:25 - 000463672 _____ (Microsoft Corporation) C:\WINDOWS\system32\coml2.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 000413720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-11-14 11:12 - 2018-11-01 08:25 - 000375824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msrpc.sys
2018-11-14 11:12 - 2018-11-01 08:25 - 000268088 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-11-14 11:12 - 2018-11-01 08:25 - 000261000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-11-14 11:12 - 2018-11-01 08:03 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmtask.exe
2018-11-14 11:12 - 2018-11-01 08:02 - 000047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmapi.dll
2018-11-14 11:12 - 2018-11-01 08:02 - 000023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\CSystemEventsBrokerClient.dll
2018-11-14 11:12 - 2018-11-01 08:01 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-11-14 11:12 - 2018-11-01 08:01 - 007057408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-11-14 11:12 - 2018-11-01 08:00 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2018-11-14 11:12 - 2018-11-01 08:00 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-11-14 11:12 - 2018-11-01 08:00 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-11-14 11:12 - 2018-11-01 08:00 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-11-14 11:12 - 2018-11-01 07:59 - 000322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-11-14 11:12 - 2018-11-01 07:59 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2018-11-14 11:12 - 2018-11-01 07:59 - 000192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll
2018-11-14 11:12 - 2018-11-01 07:59 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WPTaskScheduler.dll
2018-11-14 11:12 - 2018-11-01 07:59 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2018-11-14 11:12 - 2018-11-01 07:58 - 004867072 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-11-14 11:12 - 2018-11-01 07:58 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-11-14 11:12 - 2018-11-01 07:58 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-11-14 11:12 - 2018-11-01 07:58 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-11-14 11:12 - 2018-11-01 07:58 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 002364928 _____ (Microsoft Corporation) C:\WINDOWS\system32\OpcServices.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000835584 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneService.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\dusmsvc.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2018-11-14 11:12 - 2018-11-01 07:57 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-11-14 11:12 - 2018-11-01 07:56 - 002929664 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2018-11-14 11:12 - 2018-11-01 07:56 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-11-14 11:12 - 2018-11-01 07:56 - 001768448 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2018-11-14 11:12 - 2018-11-01 07:56 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-11-14 11:12 - 2018-11-01 07:56 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-11-14 11:12 - 2018-11-01 07:55 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-11-14 11:12 - 2018-11-01 07:55 - 001058304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-11-14 11:12 - 2018-11-01 07:55 - 000684544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 001679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 001264640 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll

#22

2018-11-14 11:12 - 2018-11-01 07:54 - 001023488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-11-14 11:12 - 2018-11-01 07:54 - 000606208 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-11-14 11:12 - 2018-11-01 07:53 - 002248192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2018-11-14 11:12 - 2018-11-01 07:53 - 001373696 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-11-14 11:12 - 2018-11-01 07:53 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-11-14 11:12 - 2018-11-01 07:53 - 000889344 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2018-11-14 11:12 - 2018-11-01 07:53 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-11-14 11:12 - 2018-11-01 07:53 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-11-14 11:12 - 2018-11-01 06:39 - 000001310 _____ C:\WINDOWS\system32\tcbres.wim
2018-11-14 11:12 - 2018-11-01 06:08 - 002417952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2018-11-14 11:12 - 2018-11-01 05:50 - 000861712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2adec.dll
2018-11-14 11:12 - 2018-11-01 05:50 - 000786288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 004790184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 002478872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 002331480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 001805656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 001011872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 000880248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2018-11-14 11:12 - 2018-11-01 05:48 - 000384520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\coml2.dll
2018-11-14 11:12 - 2018-11-01 05:47 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-11-14 11:12 - 2018-11-01 05:47 - 001379792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2018-11-14 11:12 - 2018-11-01 05:47 - 001020064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2018-11-14 11:12 - 2018-11-01 05:47 - 000581600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-11-14 11:12 - 2018-11-01 05:47 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-11-14 11:12 - 2018-11-01 05:47 - 000129304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-11-14 11:12 - 2018-11-01 05:34 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-11-14 11:12 - 2018-11-01 05:33 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-11-14 11:12 - 2018-11-01 05:33 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-11-14 11:12 - 2018-11-01 05:32 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-11-14 11:12 - 2018-11-01 05:31 - 005307904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-11-14 11:12 - 2018-11-01 05:31 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 005883904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 005775872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-11-14 11:12 - 2018-11-01 05:30 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 001862656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsservices.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 000848384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-11-14 11:12 - 2018-11-01 05:29 - 000165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll
2018-11-14 11:12 - 2018-11-01 05:28 - 001348096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OpcServices.dll
2018-11-14 11:12 - 2018-11-01 05:28 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-11-14 11:12 - 2018-11-01 05:28 - 000978944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2018-11-14 11:12 - 2018-11-01 05:27 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-11-14 11:12 - 2018-11-01 05:27 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-11-14 11:12 - 2018-11-01 05:27 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-11-14 11:12 - 2018-11-01 05:27 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-11-14 11:12 - 2018-11-01 05:27 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-11-14 11:12 - 2018-11-01 05:26 - 000795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2018-11-14 11:12 - 2018-11-01 05:26 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-11-14 11:12 - 2018-11-01 05:26 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-11-14 09:34 - 2018-11-14 09:34 - 001145984 _____ C:\Users\Marcos\Downloads\megalodon-blurayrip-ac3-5-1.torrent.zip
2018-11-14 09:34 - 2018-11-14 09:34 - 000021391 _____ C:\Users\Marcos\Downloads\megalodon-blurayrip-ac3-5-1.torrent
2018-11-14 09:34 - 2018-11-14 09:34 - 000000000 ____D C:\Users\Marcos\Downloads\Megalodon [BluRay Rip][AC3 5.1 Castellano][2018][www.descargas2020.com]
2018-11-14 09:20 - 2018-11-14 17:48 - 000000000 ____D C:\Users\Marcos\AppData\LocalLow\BitTorrent
2018-11-14 09:20 - 2018-11-14 09:24 - 000000000 ____D C:\Users\Marcos\Downloads\Adobe.Photoshop.CC.2019.v20.0.0.13785.MULTi.WIN64.Incl.Crack
2018-11-14 08:26 - 2018-11-14 08:26 - 000198000 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2018-11-14 08:22 - 2018-11-14 08:22 - 002912840 _____ (BitTorrent Inc.) C:\Users\Marcos\Downloads\BitTorrent.exe
2018-11-14 08:20 - 2018-11-14 08:20 - 002241224 _____ (BitTorrent Inc.) C:\Users\Marcos\Downloads\bittorrent-7-9-9-build-43296.exe
2018-11-14 06:37 - 2018-11-14 06:37 - 000000254 _____ C:\DelFix.txt
2018-11-14 06:37 - 2018-11-14 06:37 - 000000000 ____D C:\WINDOWS\ERUNT
2018-11-13 18:41 - 2018-11-13 18:41 - 137369788 _____ C:\Users\Marcos\Downloads\2018_Non_Servium_&_Bull_Brigade_The_Chaos_Brotherhood-SPLIT.rar
2018-11-13 17:37 - 2018-11-13 17:37 - 018071560 _____ (Piriform Software Ltd) C:\Users\Marcos\Downloads\ccsetup549.exe
2018-11-13 17:37 - 2018-11-13 17:37 - 000003936 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-11-13 17:37 - 2018-11-13 17:37 - 000002890 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2018-11-13 17:37 - 2018-11-13 17:37 - 000000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2018-11-13 17:37 - 2018-11-13 17:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2018-11-13 17:37 - 2018-11-13 17:37 - 000000000 ____D C:\Program Files\CCleaner
2018-11-13 13:08 - 2018-11-13 13:08 - 000000000 ____D C:\Users\Marcos\AppData\Local\OneDrive
2018-11-13 10:06 - 2018-11-13 14:56 - 000000000 ____D C:\ProgramData\IsBVOc
2018-11-13 04:25 - 2018-10-21 14:04 - 002267448 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 021386368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 001639560 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 001516120 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-11-13 04:25 - 2018-10-21 14:00 - 000790416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-11-13 04:25 - 2018-10-21 14:00 - 000396304 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2018-11-13 04:25 - 2018-10-21 13:59 - 000766480 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll
2018-11-13 04:25 - 2018-10-21 13:46 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-11-13 04:25 - 2018-10-21 13:46 - 004393472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2018-11-13 04:25 - 2018-10-21 13:43 - 000345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll
2018-11-13 04:25 - 2018-10-21 13:43 - 000182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\LanguageComponentsInstaller.dll
2018-11-13 04:25 - 2018-10-21 13:42 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-11-13 04:25 - 2018-10-21 13:42 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-11-13 04:25 - 2018-10-21 13:42 - 000592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
2018-11-13 04:25 - 2018-10-21 13:41 - 001180672 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-11-13 04:25 - 2018-10-21 12:41 - 001540408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2018-11-13 04:25 - 2018-10-21 12:38 - 001322376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-11-13 04:25 - 2018-10-21 12:38 - 000662312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-11-13 04:25 - 2018-10-21 12:38 - 000660480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll
2018-11-13 04:25 - 2018-10-21 12:37 - 020381808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-11-13 04:25 - 2018-10-21 12:37 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-11-13 04:25 - 2018-10-21 12:28 - 012501504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-11-13 04:25 - 2018-10-21 12:23 - 000622080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-11-13 04:25 - 2018-10-21 12:22 - 002405888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll
2018-11-13 04:25 - 2018-10-21 08:48 - 005602456 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 000717112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 000611640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2018-11-13 04:25 - 2018-10-21 08:46 - 000560136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2018-11-13 04:25 - 2018-10-21 08:46 - 000497864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2018-11-13 04:25 - 2018-10-21 08:46 - 000171024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 003283512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 001946208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 001098064 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 000607136 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 000185120 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2018-11-13 04:25 - 2018-10-21 08:45 - 000175624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spacedump.sys
2018-11-13 04:25 - 2018-10-21 08:45 - 000139792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2018-11-13 04:25 - 2018-10-21 08:28 - 016592384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2018-11-13 04:25 - 2018-10-21 08:22 - 004710912 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2018-11-13 04:25 - 2018-10-21 08:21 - 001589248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2018-11-13 04:25 - 2018-10-21 08:21 - 000123424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2018-11-13 04:25 - 2018-10-21 08:20 - 000424000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2018-11-13 04:25 - 2018-10-21 08:20 - 000050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 002487088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 001620776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 001130768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-11-13 04:25 - 2018-10-21 08:19 - 000505616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-11-13 04:25 - 2018-10-21 08:19 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\ofdeploy.exe
2018-11-13 04:25 - 2018-10-21 08:18 - 000461824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Activities.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2018-11-13 04:25 - 2018-10-21 08:18 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\officecsp.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2018-11-13 04:25 - 2018-10-21 08:17 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000473600 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcp.dll
2018-11-13 04:25 - 2018-10-21 08:17 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 002584576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 000847360 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2018-11-13 04:25 - 2018-10-21 08:16 - 000514048 _____ (Microsoft Corporation) C:\WINDOWS\system32\BTAGService.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 003212800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-11-13 04:25 - 2018-10-21 08:15 - 000743936 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
2018-11-13 04:25 - 2018-10-21 08:14 - 002224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-11-13 04:25 - 2018-10-21 08:14 - 001919488 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 001034752 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000453632 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpusersvc.dll
2018-11-13 04:25 - 2018-10-21 08:14 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2018-11-13 04:25 - 2018-10-21 08:09 - 013873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2018-11-13 04:25 - 2018-10-21 08:02 - 002966528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2018-11-13 04:25 - 2018-10-21 08:01 - 001189376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2018-11-13 04:25 - 2018-10-21 07:59 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-11-13 04:25 - 2018-10-21 07:58 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-11-13 04:25 - 2018-10-21 07:57 - 002611200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2018-11-13 04:25 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\SysWOW64\locale.nls
2018-11-13 04:25 - 2018-10-21 06:59 - 000806320 _____ C:\WINDOWS\system32\locale.nls
2018-11-13 04:24 - 2018-10-21 13:59 - 000236728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2018-11-13 04:24 - 2018-10-21 13:45 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-11-13 04:24 - 2018-10-21 13:44 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2018-11-13 04:24 - 2018-10-21 13:44 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-11-13 04:24 - 2018-10-21 13:43 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2018-11-13 04:24 - 2018-10-21 13:42 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll
2018-11-13 04:24 - 2018-10-21 12:41 - 000023056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hvsicontainerservice.dll
2018-11-13 04:24 - 2018-10-21 12:38 - 000221216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll
2018-11-13 04:24 - 2018-10-21 12:28 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-11-13 04:24 - 2018-10-21 12:23 - 000523264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
2018-11-13 04:24 - 2018-10-21 12:22 - 000224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2018-11-13 04:24 - 2018-10-21 10:29 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-11-13 04:24 - 2018-10-21 09:44 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-11-13 04:24 - 2018-10-21 08:47 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-11-13 04:24 - 2018-10-21 08:46 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-11-13 04:24 - 2018-10-21 08:45 - 000058088 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2018-11-13 04:24 - 2018-10-21 08:20 - 000295224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-11-13 04:24 - 2018-10-21 08:20 - 000161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\spacebridge.dll
2018-11-13 04:24 - 2018-10-21 08:20 - 000141312 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2018-11-13 04:24 - 2018-10-21 08:19 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-11-13 04:24 - 2018-10-21 08:19 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2018-11-13 04:24 - 2018-10-21 08:19 - 000060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvrcpAppSvc.dll
2018-11-13 04:24 - 2018-10-21 08:19 - 000036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhf.sys
2018-11-13 04:24 - 2018-10-21 08:19 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspisrv.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthAvctpSvc.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\scecli.dll
2018-11-13 04:24 - 2018-10-21 08:18 - 000030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll
2018-11-13 04:24 - 2018-10-21 08:16 - 000323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2018-11-13 04:24 - 2018-10-21 08:15 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-11-13 04:24 - 2018-10-21 08:02 - 000157184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spacebridge.dll
2018-11-13 04:24 - 2018-10-21 08:01 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2018-11-13 04:24 - 2018-10-21 08:00 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scecli.dll
2018-11-13 04:24 - 2018-10-21 07:58 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-11-13 04:24 - 2018-10-21 07:58 - 000230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2018-11-13 04:24 - 2018-04-28 05:02 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-11-13 02:44 - 2018-11-13 02:44 - 000001032 _____ C:\Users\Public\Desktop\WinRAR.lnk
2018-11-13 02:43 - 2018-11-13 02:43 - 000000000 ____D C:\Users\Marcos\Downloads\WinRAR.v5.61.FINAL.ES.x86.x64.Incl.REGGED
2018-11-13 02:36 - 2018-11-13 02:36 - 000000000 ____D C:\Users\Marcos\Downloads\CCleaner.v5.47.6716.FREE.PRO.BUSINESS.TECH.Multilingual.With.Portable.Incl.Serial
2018-11-12 20:38 - 2018-11-12 20:38 - 000000036 _____ C:\Users\Marcos\.nodemid
2018-11-12 17:51 - 2018-11-12 17:51 - 000000000 ____D C:\Users\Marcos\Downloads\Office_Professional_Plus_2016_Spanish-Actualizado-Julio-2018
2018-11-12 17:51 - 2018-11-12 17:51 - 000000000 ____D C:\Users\Marcos\Downloads\Office_Professional_Plus_2016_Spanish-Actualizado-Agosto-2018
2018-11-11 20:50 - 2018-11-11 20:50 - 000000000 ____D C:\Users\Marcos\AppData\Local\TeamViewer
2018-11-11 20:43 - 2018-11-15 06:46 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-11-11 20:43 - 2018-11-11 20:43 - 000001116 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 13.lnk
2018-11-11 20:43 - 2018-11-11 20:43 - 000001104 _____ C:\Users\Public\Desktop\TeamViewer 13.lnk
2018-11-11 20:43 - 2018-11-11 20:43 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\TeamViewer
2018-11-11 20:42 - 2018-11-11 20:42 - 020689928 _____ (TeamViewer GmbH) C:\Users\Marcos\Downloads\TeamViewer_Setup.exe
2018-11-11 20:01 - 2018-11-11 20:01 - 000000000 ____D C:\ProgramData\DAEMON Tools Lite
2018-11-11 19:50 - 2018-11-12 18:00 - 000000000 ____D C:\Users\Marcos\Downloads\KMS_Tools_Portable_18.10.2018
2018-11-11 16:05 - 2018-11-11 16:05 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\651117D7.sys
2018-11-09 04:50 - 2018-11-09 04:53 - 000000000 ____D C:\Users\Marcos\Downloads\The Chevin - Borderland {320 kbps}
2018-11-08 21:52 - 2018-11-08 22:57 - 000000000 ____D C:\Users\Marcos\Downloads\Soulfly - Savages 2013 Metal 320kbps CBR MP3 [VX] [P2PDL]
2018-11-08 20:02 - 2018-11-08 20:19 - 000000000 ____D C:\Users\Marcos\Downloads\Richie Kotzen - Discography
2018-11-08 13:32 - 2018-11-08 13:33 - 000000000 ____D C:\Users\Marcos\Downloads\I SEE STARS - DISCOGRAPHY (2008-13) [CHANNEL NEO]
2018-11-08 01:45 - 2018-11-08 01:53 - 000000000 ____D C:\Users\Marcos\Downloads\Boston [Discography]
2018-11-07 23:27 - 2018-11-07 23:27 - 000000000 ____D C:\Users\Marcos\Downloads\El.leon.En.Invierno.Miniserie(www.TorrentSpain.com)
2018-11-07 21:24 - 2018-11-07 21:24 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\6DB3D489.sys
2018-11-07 16:57 - 2018-11-07 16:57 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\HandBrake
2018-11-07 16:56 - 2018-11-07 16:56 - 011728248 _____ C:\Users\Marcos\Downloads\HandBrake-1.1.2-x86_64-Win_GUI.exe
2018-11-07 16:56 - 2018-11-07 16:56 - 000000865 _____ C:\Users\Marcos\Desktop\HandBrake.lnk
2018-11-07 16:56 - 2018-11-07 16:56 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HandBrake
2018-11-07 16:56 - 2018-11-07 16:56 - 000000000 ____D C:\Program Files\HandBrake
2018-11-07 12:30 - 2018-11-07 12:58 - 000000000 ____D C:\Users\Marcos\Downloads\ANATHEMA - DISCOGRAPHY (1990-14) [CHANNEL NEO]
2018-11-07 00:47 - 2018-11-07 00:47 - 000001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Premier.lnk
2018-11-07 00:47 - 2018-11-07 00:47 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\AVAST Software
2018-11-07 00:46 - 2018-11-13 13:03 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-11-07 00:46 - 2018-11-07 00:45 - 001028840 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000483384 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000467904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000381144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000346760 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbloga.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000230512 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000208640 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000201928 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000201408 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswArPot.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000163376 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000111968 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000088112 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000059664 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000047064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000042456 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2018-11-07 00:46 - 2018-11-07 00:45 - 000015360 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswElam.sys
2018-11-07 00:45 - 2018-11-07 00:45 - 000378584 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2018-11-07 00:45 - 2018-11-07 00:45 - 000000000 ____D C:\Program Files\AVAST Software
2018-11-06 19:55 - 2018-11-06 19:55 - 000948192 _____ (Doctor Web, Ltd.) C:\Users\Marcos\Downloads\drw_remover.exe
2018-11-06 19:54 - 2018-11-06 19:55 - 012244272 _____ (Doctor Web, Ltd.) C:\Users\Marcos\Downloads\dwsysinfo.exe
2018-11-06 19:02 - 2018-11-06 19:18 - 784454256 _____ (Doctor Web, Ltd.) C:\Users\Marcos\Downloads\drweb-livedisk-900-usb.exe
2018-11-06 17:55 - 2018-11-06 17:55 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\52511338.sys
2018-11-06 15:55 - 2018-11-06 15:55 - 000000000 ___HD C:\VTRoot
2018-11-06 14:33 - 2018-11-07 00:11 - 000000000 ____D C:\Program Files\Common Files\AV
2018-11-06 14:24 - 2018-11-06 14:24 - 001060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc71.dll
2018-11-06 14:24 - 2018-11-06 14:24 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2018-11-06 14:10 - 2018-11-15 06:29 - 000777222 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
2018-11-06 14:09 - 2018-11-06 14:09 - 000000000 ____D C:\WINDOWS\System32\Tasks\COMODO
2018-11-06 14:08 - 2018-11-06 14:08 - 000000000 ____D C:\Program Files\COMODO
2018-11-06 14:08 - 2018-05-23 05:06 - 000017944 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdboot.sys
2018-11-06 14:07 - 2018-10-10 07:24 - 000255520 _____ (COMODO) C:\WINDOWS\system32\iseguard64.dll
2018-11-06 14:07 - 2018-10-10 07:24 - 000205528 _____ (COMODO) C:\WINDOWS\SysWOW64\iseguard32.dll
2018-11-06 14:07 - 2018-08-29 23:55 - 000063256 _____ (COMODO) C:\WINDOWS\system32\Drivers\isedrv.sys
2018-11-06 14:06 - 2018-11-06 15:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2018-11-06 14:06 - 2018-11-06 15:08 - 000000000 ____D C:\Program Files (x86)\Comodo
2018-11-06 14:06 - 2018-11-06 14:06 - 000000000 ____D C:\Users\Marcos\AppData\Local\Comodo
2018-11-06 14:04 - 2018-11-06 14:07 - 000000000 ____D C:\ProgramData\Comodo
2018-11-06 14:04 - 2018-11-06 14:05 - 000000000 ____D C:\ProgramData\Comodo Downloader
2018-11-06 14:04 - 2018-11-06 14:04 - 005581928 _____ (COMODO) C:\Users\Marcos\Downloads\cfw_installer.exe
2018-11-06 14:04 - 2018-11-06 14:04 - 000000000 ____D C:\ProgramData\Shared Space
2018-11-06 06:16 - 2018-11-13 14:56 - 000000000 ____D C:\Program Files (x86)\USB Disk Security
2018-11-06 06:16 - 2018-11-06 06:16 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Zbshareware Lab
2018-11-06 06:16 - 2018-11-06 06:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USB Disk Security
2018-11-06 06:08 - 2018-11-06 06:11 - 1953349632 _____ C:\Users\Marcos\Downloads\ubuntu-18.04.1-desktop-amd64.iso
2018-11-06 05:50 - 2018-11-06 05:50 - 003285888 _____ C:\Users\Marcos\Downloads\ZHPCleaner.exe
2018-11-06 05:25 - 2018-11-06 05:25 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\3422667A.sys
2018-11-06 05:21 - 2018-11-06 05:21 - 000001152 _____ C:\Users\Public\Desktop\SpywareBlaster.lnk
2018-11-06 05:20 - 2018-11-06 05:20 - 004291320 _____ (BrightFort LLC ) C:\Users\Marcos\Downloads\spywareblastersetup55.exe
2018-11-06 04:49 - 2018-11-06 04:49 - 000255928 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\A2674327.sys
2018-11-06 04:48 - 2018-11-14 13:29 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-11-05 12:44 - 2018-11-14 08:05 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2018-11-04 10:24 - 2018-11-04 10:24 - 000000000 ____D C:\Users\Marcos\Desktop\Nueva carpeta
2018-11-04 10:01 - 2018-11-04 10:01 - 000018092 _____ C:\Users\Marcos\Downloads\creedenceclearwaterrevival.torrent
2018-11-02 13:51 - 2018-11-02 13:51 - 000000000 ____D C:\Users\Default\AppData\Local\Google
2018-11-02 13:51 - 2018-11-02 13:51 - 000000000 ____D C:\Users\Default User\AppData\Local\Google
2018-11-01 06:23 - 2018-11-01 06:23 - 000000000 ____D C:\Users\Marcos\Desktop\Musica
2018-10-31 05:44 - 2018-10-31 05:44 - 007456384 _____ (AVAST Software) C:\Users\Marcos\Downloads\avast_free_antivirus_setup_online_a2j.exe
2018-10-30 20:08 - 2018-09-05 22:01 - 000054888 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\avgTap.sys
2018-10-30 18:40 - 2018-10-31 06:37 - 000000000 ____D C:\Users\Marcos\AppData\Local\AvgSetupLog
2018-10-30 17:34 - 2018-10-31 05:42 - 000000000 ____D C:\Users\Marcos\AppData\Local\AVG
2018-10-30 17:33 - 2018-10-30 17:33 - 000000000 ____D C:\WINDOWS\System32\Tasks\AVG
2018-10-30 17:32 - 2018-10-30 17:32 - 000000000 ____D C:\Program Files\Common Files\AVG
2018-10-29 12:20 - 2018-10-29 12:20 - 000925832 _____ (COMODO) C:\WINDOWS\system32\guard64.dll
2018-10-29 12:20 - 2018-10-29 12:20 - 000712216 _____ (COMODO) C:\WINDOWS\SysWOW64\guard32.dll
2018-10-29 12:20 - 2018-10-29 12:20 - 000051808 _____ (COMODO) C:\WINDOWS\system32\cmdcsr.dll
2018-10-29 12:17 - 2018-10-29 12:17 - 000469696 _____ (COMODO) C:\WINDOWS\system32\cmdvrt64.dll
2018-10-29 12:16 - 2018-10-29 12:16 - 000371904 _____ (COMODO) C:\WINDOWS\SysWOW64\cmdvrt32.dll
2018-10-28 21:06 - 2018-10-31 06:36 - 000002730 _____ C:\WINDOWS\System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-51BG0PM-Marcos
2018-10-27 14:19 - 2018-09-18 10:33 - 000000000 ____D C:\ProgramData\Adobe
2018-10-27 14:14 - 2018-10-27 14:19 - 000001085 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2019.lnk
2018-10-27 13:47 - 2018-10-27 14:19 - 000000000 ____D C:\Users\Marcos\Documents\Adobe
2018-10-22 18:19 - 2018-10-29 21:07 - 000000147 _____ C:\Users\Marcos\Desktop\UCDM.txt
2018-10-16 17:15 - 2018-10-16 17:16 - 000085548 _____ C:\TDSSKiller.3.1.0.17_16.10.2018_18.15.18_log.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-11-15 07:13 - 2018-09-06 13:19 - 000000000 ____D C:\FRST
2018-11-15 07:07 - 2018-07-30 21:24 - 000000000 ____D C:\Users\Marcos\AppData\Local\AVAST Software
2018-11-15 06:53 - 2018-04-12 17:19 - 000750432 _____ C:\WINDOWS\system32\perfh00A.dat
2018-11-15 06:53 - 2018-04-12 17:19 - 000147354 _____ C:\WINDOWS\system32\perfc00A.dat
2018-11-15 06:53 - 2018-04-12 00:36 - 000000000 ____D C:\WINDOWS\INF
2018-11-15 06:53 - 2016-04-27 07:09 - 001679422 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-11-15 06:50 - 2018-08-06 12:21 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\TIDAL
2018-11-15 06:49 - 2018-07-30 21:13 - 000000000 ___RD C:\Users\Marcos\OneDrive
2018-11-15 06:48 - 2018-10-12 21:02 - 000000000 ___HD C:\DESKTOP-51BG0PM
2018-11-15 06:48 - 2017-12-25 00:00 - 000000000 ____D C:\ProgramData\9ef66cea
2018-11-15 06:46 - 2018-08-04 18:30 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-11-15 06:46 - 2018-04-12 00:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-11-15 06:45 - 2018-07-30 21:10 - 000065536 _____ C:\WINDOWS\psp_storage.bin
2018-11-15 06:45 - 2018-04-11 22:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-11-15 06:42 - 2018-08-15 16:46 - 000000000 _____ C:\WINDOWS\SysWOW64\last.dump
2018-11-15 01:02 - 2018-08-04 18:10 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-11-15 00:19 - 2018-10-12 21:02 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\2e91124867341581a3e88a67355fdc67
2018-11-14 22:36 - 2018-07-31 00:28 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\BitTorrent
2018-11-14 17:47 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-11-14 17:46 - 2018-08-04 18:10 - 005057616 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-11-14 17:42 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-11-14 17:42 - 2018-04-12 00:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-11-14 17:42 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-11-14 17:42 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-11-14 17:41 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-11-14 17:41 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-11-14 17:16 - 2018-07-31 03:07 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\AIMP
2018-11-14 13:38 - 2018-09-05 20:51 - 000000000 ____D C:\ProgramData\TEMP
2018-11-14 12:12 - 2018-10-05 21:05 - 000000000 ____D C:\Users\Marcos\Documents\MEGAsync Downloads
2018-11-14 11:22 - 2018-04-12 00:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-11-14 09:02 - 2018-04-12 00:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-11-14 08:24 - 2018-10-10 16:51 - 000000000 ____D C:\Users\Marcos\AppData\LocalLow\Mozilla
2018-11-14 08:24 - 2018-07-31 00:28 - 000000897 _____ C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk
2018-11-14 06:52 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\system32\NDF
2018-11-13 16:05 - 2018-08-04 18:30 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2511560098-4189382557-1041078835-1001
2018-11-13 16:05 - 2018-08-04 18:21 - 000002404 _____ C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-11-13 15:47 - 2018-08-06 12:21 - 000000000 ____D C:\Users\Marcos\AppData\Local\TIDAL
2018-11-13 05:25 - 2018-09-06 03:07 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\ZHP
2018-11-13 04:44 - 2018-08-04 18:32 - 000000000 ___RD C:\Users\Marcos\3D Objects
2018-11-13 04:44 - 2016-04-27 07:13 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-11-13 04:39 - 2018-04-12 00:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-11-13 02:52 - 2018-07-30 22:04 - 000000000 ____D C:\Program Files\WinRAR
2018-11-13 02:44 - 2018-07-30 22:04 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-11-13 02:44 - 2018-07-30 22:04 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-11-13 02:38 - 2018-07-30 21:13 - 000002299 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-11-13 02:34 - 2018-09-05 20:51 - 000000000 ____D C:\Program Files (x86)\SpywareBlaster
2018-11-13 00:37 - 2018-08-04 18:21 - 000000000 ____D C:\Users\Marcos
2018-11-12 21:52 - 2018-08-22 12:31 - 000000000 ____D C:\Users\Marcos\AppData\Local\ElevatedDiagnostics
2018-11-12 21:28 - 2018-04-22 18:59 - 000000000 ____D C:\DrWeb Quarantine
2018-11-12 17:38 - 2018-09-24 05:04 - 003286912 _____ C:\Users\Marcos\ZHPCleaner.exe
2018-11-12 13:20 - 2018-09-05 20:51 - 000041090 __RSH C:\ProgramData\ntuser.pol
2018-11-11 21:06 - 2018-08-10 20:51 - 000003478 _____ C:\WINDOWS\System32\Tasks\AutoPico Daily Restart
2018-11-08 15:38 - 2018-07-31 03:32 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\MPC-HC
2018-11-07 00:45 - 2018-04-12 00:38 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2018-11-07 00:44 - 2018-07-30 21:15 - 000000000 ____D C:\ProgramData\AVAST Software
2018-11-06 22:52 - 2018-08-21 14:33 - 000000000 ____D C:\ProgramData\Freemake
2018-11-06 22:52 - 2018-08-21 14:32 - 000000000 ____D C:\Program Files (x86)\Freemake
2018-11-06 20:16 - 2018-04-12 00:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-11-06 20:02 - 2018-07-30 23:31 - 000000000 ____D C:\Users\Marcos\Doctor Web
2018-11-06 17:41 - 2018-09-13 16:46 - 000000000 ____D C:\Users\Marcos\AppData\Local\CrashDumps
2018-11-06 14:54 - 2018-04-11 22:04 - 000008192 _____ C:\WINDOWS\system32\config\ELAM
2018-11-06 14:12 - 2018-10-10 16:50 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-11-06 14:12 - 2018-10-10 16:50 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-11-06 14:03 - 2018-10-10 16:50 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-11-06 05:21 - 2018-09-05 20:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster
2018-11-06 04:49 - 2018-07-31 01:51 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-11-02 18:22 - 2018-07-30 21:08 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Adobe
2018-11-02 13:52 - 2018-10-04 15:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Backup and Sync from Google
2018-10-31 06:36 - 2018-10-05 20:41 - 000002590 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2018-10-31 06:36 - 2018-08-04 18:30 - 000003034 _____ C:\WINDOWS\System32\Tasks\klcp_update
2018-10-31 06:35 - 2018-08-22 21:01 - 000002372 _____ C:\WINDOWS\System32\Tasks\PandaUSBVaccine
2018-10-30 19:24 - 2018-07-30 23:46 - 000000000 ____D C:\Users\Marcos\AppData\Local\Microsoft Help
2018-10-30 18:43 - 2018-08-06 03:03 - 000002146 _____ C:\WINDOWS\System32\Tasks\StartCN
2018-10-30 03:58 - 2018-10-04 08:38 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-10-27 14:22 - 2018-09-05 19:45 - 000000000 ____D C:\Program Files\Adobe
2018-10-27 14:19 - 2018-09-05 19:41 - 000000000 ____D C:\Program Files\Common Files\Adobe
2018-10-27 14:07 - 2018-09-05 19:44 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-10-27 13:58 - 2018-07-30 21:11 - 000000000 ____D C:\ProgramData\Package Cache
2018-10-27 13:07 - 2018-07-31 02:12 - 000000000 ____D C:\Users\Marcos\AppData\Local\Spotify
2018-10-27 13:02 - 2018-07-31 02:11 - 000000000 ____D C:\Users\Marcos\AppData\Roaming\Spotify
2018-10-26 15:33 - 2018-07-30 21:27 - 000002496 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Secure Browser.lnk
2018-10-26 02:21 - 2018-08-04 18:30 - 000000000 ____D C:\WINDOWS\System32\Tasks\Avast Software
2018-10-16 03:28 - 2018-08-04 18:49 - 000000000 ____D C:\ProgramData\Packages

==================== Files in the root of some directories =======

2018-09-24 05:04 - 2018-11-12 17:38 - 003286912 _____ () C:\Users\Marcos\ZHPCleaner.exe
2018-09-05 18:37 - 2018-09-05 18:37 - 000041071 _____ () C:\Users\Marcos\AppData\Roaming\Switch.dmp
2018-10-30 02:59 - 2018-10-30 02:59 - 000000000 _____ () C:\Users\Marcos\AppData\Local\oobelibMkey.log

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-08-04 18:10

==================== End of FRST.txt ============================