Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Много вируси, реклами и бааавен компютър

The Man Of Steel
в Премахване на зловреден софтуер

Featured Replies

Публикувано изображение  Като за начало деинсталирайте следния нежелан софтуер :
 

BitGuard (HKLM-x32...{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}) (Version:  - MediaTechSoft Inc.) <==== ATTENTION
Defaulttab (HKLM-x32...DefaultTab) (Version: 2.5.0.0 - Search Results, LLC) <==== ATTENTION
GoforFiles (HKCU...GoforFiles) (Version: 2.0.2 - http://www.goforfiles.com/) <==== ATTENTION
Mobogenie (HKLM-x32...Mobogenie) (Version:  - Mobogenie.com) <==== ATTENTION
MyPC Backup  (HKLM...MyPC Backup) (Version:  - MyPC Backup) <==== ATTENTION
Optimizer Pro v3.0 (HKLM-x32...Optimizer Pro_is1) (Version: 3.0 - PC Utilities Pro) <==== ATTENTION
SelectionLinks (HKLM-x32...sl-dlc) (Version: 1.0 - SelectionLinks) <==== ATTENTION

 
 
След това:
 
Публикувано изображение

  • [*]Отворете
следния сайт и изтеглете RKill.exe и ги запазете на вашия десктоп. [*]Стартирате програмата с двоен клик върху файла и изчакайте търпеливо. [*]След приключване на проверката ще се генерира лог файл с извършените процедури. [*]Прикачете лог файла в следващия си пост.

 

 

Публикувано изображениеМоля, изтеглете и стартирайте програмата AdwCleaner(by Xplode):

  • [*]Затворете всички стартирани програми и браузъри [*]Кликнете два пъти върху
adwcleaner.exe за да стартирате инструмента. [*]Натиснете OK, за да потвърдите, че всички стартирани програми ще бъдат затворени. [*]Маркирайте Clean [*]Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта. [*]Моля, да публикувате съдържанието на този лог в отговора си [*]Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s0].txt

 

 

 

Публикувано изображение Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

  • [*]Спрете временно работата на защитните програми. [*]Стартирайте инструмента
JRT.exe [*]Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата. [*]Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши. [*]Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt). [*]Моля копирайте съдържанието на лог файла в следващия си пост.

Публикувано изображение
 
 
Публикувано изображение  Моля, изтеглете Malwarebytes Anti -Malware и го запомнете на вашия работен плот .
  Кликнете два пъти върху mbam-setup-consumer-2.0.0.1000.exe и следвайте инструкциите, за да инсталирате програмата .
  В краяна инсатлацията  , трябва да има отметка на следното :

  • [*]Launch Malwarebytes Anti-Malware (Стартиране на Malwarebytes Anti -Malware) [*]14-дневен пробен период  е предварително избран . Можете да премахнете отметката от това, ако желаете, това няма да се ограничи възможностите за сканиране и премахване на програмата.

Щракнете върху Finish.

  • [*]В секцията
Settings = > Detection and Protection => Detection Options, се поставя отметка в квадратчето 'Scan for rootkits'. [*]В главния прозорец на програмата , щракнете върху 'Update Now' [*]След актуализацията завърши, кликнете на бутона " 'Scan Now  " . [*]Ако има налична актуализация , щракнете върху бутона Update Now button . [*]Ще стартира Threat Scan. [*]Когато сканирането приключи, ако има някакви открити зарази , щракнете върху Apply Actions за да се позволи на Mbam да почисти засеченото. . [*]В повечето случаи , ще се изиска рестартиране [*]   След рестарта ,стартирайте Mbam още веднъж. [*]   Кликнете на History tab > Application Logs . [*]   Кликнете два пъти върху реда , който показва датата и часа на сканирането . [*]   Кликнете върху " Copy да Clipboard " [*]   Поставете  съдържанието на клипборда в следващия си  отговор. 

 

 

Публикувано изображениеИзтеглете RogueKiller и го запазете на десктопа.
Забележка: Трябва да изтеглите версия съвместима с вашата система.

  1. [*]
RogueKiller.exe [*]RogueKillerX64.exe

  • [*]Моля,затворете всички стартирани програми [*]Моля, изключете USB или външни дискове от компютъра, преди да стартирате това сканиране [*]Стартирайте
RogueKiller.exe , изчакайте, докато Prescan приключи  и натиснете бутона SCAN. [*]Ще се създаде лог файл на десктопа с името RKreport.txt . [*]Публикувайте лог файла в следващия си пост.

 

 

 

Публикувано изображение Изтеглете Security Check (автор: screen317) от тук

  • [*]Кликнете два пъти върху
SecurityCheck.exe и следвайте инструкциите. [*]Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt. [*]Копирайте съдържанието на checkup.txt с Копирай (Copy) и с Постави (Paste) го поставете в следващия си коментар.

 

 

За финал,подгответе свежи дневници с програмата Farbar Recovery Scan Tool..!

  • Автор

От Rkill

 

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 05/10/2014 03:50:20 PM in x64 mode.
Windows Version: Windows 7 Ultimate Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * D:Users2854~1AppDataLocalTempTeamViewerVersion7TeamViewer.exe (PID: 1516) [T-HEUR]
 * D:Users2854~1AppDataLocalTempTeamViewerVersion7tv_w32.exe (PID: 4100) [T-HEUR]
 * D:Users2854~1AppDataLocalTempTeamViewerVersion7tv_x64.exe (PID: 2136) [T-HEUR]

3 proccesses terminated!

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * No issues found.

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * No issues found.

Program finished at: 05/10/2014 03:52:05 PM
Execution time: 0 hours(s), 1 minute(s), and 45 seconds(s)

от  AdwCleaner

 

# AdwCleaner v3.207 - Създаден отчет 10/05/2014 на 15:59:13
# Актуализиран 05/05/2014 от Xplode
# Операционна система : Windows 7 Ultimate Service Pack 1 (64 bits)
# Потребителско име : валентин - ВАЛЕНТИН-PC
# Стартиран от : D:UsersвалентинDesktopadwcleaner.exe
# Настройка : Почистване

***** [ Услуги ] *****

[#] Услуа Изтрит : BitGuard

***** [ Файлове / Папки ] *****

Папка Изтрит : D:ProgramDataBabylon
Папка Изтрит : D:ProgramDataBetterSoft
Папка Изтрит : D:ProgramDataBitGuard
Папка Изтрит : D:ProgramDatasimplitec
Папка Изтрит : D:ProgramDataStarApp
Папка Изтрит : D:ProgramDatacoinutinuueytoosaave
Папка Изтрит : D:ProgramDataMicrosoftWindowsStart MenuProgramssimplitec
Папка Изтрит : D:ProgramDataMicrosoftWindowsStart MenuProgramscoinutinuueytoosaave
Папка Изтрит : D:Program Files (x86)continuetosave
Папка Изтрит : D:Program Files (x86)DAEMON Tools Toolbar
Папка Изтрит : D:Program Files (x86)goforfiles
Папка Изтрит : D:Program Files (x86)MediaPlayerV1
Папка Изтрит : D:Program Files (x86)MediaViewerV1
Папка Изтрит : D:Program Files (x86)MediaViewV1
Папка Изтрит : D:Program Files (x86)MediaWatchV1
Папка Изтрит : D:Program Files (x86)mixidj
Папка Изтрит : D:Program Files (x86)Mobogenie
Папка Изтрит : D:Program Files (x86)MyPC Backup
Папка Изтрит : D:Program Files (x86)OApps
Папка Изтрит : D:Program Files (x86)Optimizer Pro
Папка Изтрит : D:Program Files (x86)simplitec
Папка Изтрит : D:Program Files (x86)sweetpacks bundle uninstaller
Папка Изтрит : D:Program Files (x86)VideoPlayerV3
Папка Изтрит : D:WindowsSysWOW64AI_RecycleBin
Папка Изтрит : D:WindowsSysWOW64BrowserProtect
Папка Изтрит : D:Users2854~1AppDataLocalTempmt_ffx
Папка Изтрит : D:UsersвалентинAppDataLocalgenienext
Папка Изтрит : D:UsersвалентинAppDataLocalMobogenie
Папка Изтрит : D:UsersвалентинAppDataLocalSwvUpdater
Папка Изтрит : D:UsersвалентинAppDataLocalLowmixidj
Папка Изтрит : D:UsersвалентинAppDataLocalLowcoinutinuueytoosaave
Папка Изтрит : D:UsersвалентинAppDataRoamingBabSolution
Папка Изтрит : D:UsersвалентинAppDataRoamingBabylon
Папка Изтрит : D:UsersвалентинAppDataRoamingDefaultTab
Папка Изтрит : D:UsersвалентинAppDataRoaminggoforfiles
Папка Изтрит : D:UsersвалентинAppDataRoamingsimplitec
Папка Изтрит : D:UsersвалентинAppDataRoamingMicrosoftWindowsStart MenuProgramsBitGuard
Папка Изтрит : D:UsersвалентинDocumentsMobogenie
Папка Изтрит : D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultExtensionsDTToolbar@toolbarnet.com
Файл Изтрит : D:Usersвалентинdaemonprocess.txt
Файл Изтрит : D:UsersвалентинAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupsimplicheck.lnk
Файл Изтрит : D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultsearchpluginsbingp.xml
Файл Изтрит : D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultsearchpluginsBrowserProtect.xml
Файл Изтрит : D:WindowsSystem32TasksBitGuard
Файл Изтрит : D:WindowsSystem32TasksEPUpdater
Файл Изтрит : D:WindowsSystem32TasksGoforFilesUpdate

***** [ Преки пътища ] *****


***** [ Системен регистър ] *****

Ключ Изтрити : HKLMSOFTWAREGoogleChromeExtensionskdidombaedgpfiiedeimiebkmbilgmlc
Стойност Изтрити : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes [bProtectorDefaultScope]
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtbProtectSettings
Ключ Изтрити : HKLMSOFTWAREClasses*shellfilescout
Ключ Изтрити : HKLMSOFTWAREClassesAppIDescort.DLL
Ключ Изтрити : HKLMSOFTWAREClassesAppIDescortApp.DLL
Ключ Изтрити : HKLMSOFTWAREClassesAppIDescortEng.DLL
Ключ Изтрити : HKLMSOFTWAREClassesAppIDescorTlbr.DLL
Ключ Изтрити : HKLMSOFTWAREClassesAppIDesrv.EXE
Ключ Изтрити : HKLMSOFTWAREClassesDTToolbar.ToolBandObj
Ключ Изтрити : HKLMSOFTWAREClassesDTToolbar.ToolBandObj.1
Ключ Изтрити : HKLMSOFTWAREClassesProd.cap
Ключ Изтрити : HKLMSOFTWAREMicrosoftTracingAskPIP_FF__RASAPI32
Ключ Изтрити : HKLMSOFTWAREMicrosoftTracingAskPIP_FF__RASMANCS
Ключ Изтрити : HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp PathsMobogenieAdd
Ключ Изтрити : HKCUSoftware526df8fb668e442
Ключ Изтрити : HKLMSOFTWARE526df8fb668e442
Ключ Изтрити : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallSP_59d8df6f
Ключ Изтрити : HKLMSOFTWAREClassesAppID{09C554C3-109B-483C-A06B-F14172F1A947}
Ключ Изтрити : HKLMSOFTWAREClassesAppID{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Ключ Изтрити : HKLMSOFTWAREClassesAppID{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Ключ Изтрити : HKLMSOFTWAREClassesAppID{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Ключ Изтрити : HKLMSOFTWAREClassesCLSID{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Ключ Изтрити : HKLMSOFTWAREClassesCLSID{32099AAC-C132-4136-9E9A-4E364A424E17}
Ключ Изтрити : HKLMSOFTWAREClassesTypeLib{3E288F79-03E4-4983-A48E-0D879B51FF19}
Ключ Изтрити : HKLMSOFTWAREClassesTypeLib{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Ключ Изтрити : HKLMSOFTWAREClassesTypeLib{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{32099AAC-C132-4136-9E9A-4E364A424E17}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{32099AAC-C132-4136-9E9A-4E364A424E17}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{4D6A9BBF-402C-4301-B1EF-28D04F71D761}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{7F6AFBF1-E065-4627-A2FD-810366367D01}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{CA9B9C89-4662-4ADC-9C23-A452BECD5D19}
Ключ Изтрити : HKCUSoftwareMicrosoftWindowsCurrentVersionExtPreApproved{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Ключ Изтрити : HKLMSOFTWAREMicrosoftWindowsCurrentVersionExtPreApproved{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Ключ Изтрити : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}
Ключ Изтрити : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Ключ Изтрити : HKCUSoftwareMicrosoftInternet ExplorerSearchScopes{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}
Ключ Изтрити : HKLMSOFTWAREMicrosoftInternet ExplorerSearchScopes{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Стойност Изтрити : HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Стойност Изтрити : HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Ключ Изтрити : [x64] HKLMSOFTWAREClassesCLSID{32099AAC-C132-4136-9E9A-4E364A424E17}
Стойност Изтрити : [x64] HKLMSOFTWAREMicrosoftInternet ExplorerToolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Ключ Изтрити : HKCUSoftwareAPN PIP
Ключ Изтрити : HKCUSoftwareBabSolution
Ключ Изтрити : HKCUSoftwareConduit
Ключ Изтрити : HKCUSoftwaredt softdaemon tools toolbar
Ключ Изтрити : HKCUSoftwarefilescout
Ключ Изтрити : HKCUSoftwareGoforFiles
Ключ Изтрити : HKCUSoftwareIM
Ключ Изтрити : HKCUSoftwaremixidj
Ключ Изтрити : HKCUSoftwarePIP
Ключ Изтрити : HKCUSoftwareSoftonic
Ключ Изтрити : HKLMSoftwareBabylon
Ключ Изтрити : HKLMSoftwareDataMngr
Ключ Изтрити : HKLMSoftwaredt softdaemon tools toolbar
Ключ Изтрити : HKLMSoftwareGoforFiles
Ключ Изтрити : HKLMSoftwareMediaPlayerV1
Ключ Изтрити : HKLMSoftwareMediaViewerV1
Ключ Изтрити : HKLMSoftwareMediaViewV1
Ключ Изтрити : HKLMSoftwareMediaWatchV1
Ключ Изтрити : HKLMSoftwaremixidj
Ключ Изтрити : HKLMSoftwarePIP
Ключ Изтрити : HKLMSoftwaresimplitec
Ключ Изтрити : HKLMSoftwareSP Global
Ключ Изтрити : HKLMSoftwareSProtector
Ключ Изтрити : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstalldaemon tools toolbar
Ключ Изтрити : [x64] HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallOptimizer Pro_is1
Данни Изтрити : HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows [AppInit_DLLs] - d:progra~3bitguard271832~1.68{c16c1~1bitguard.dll
Данни Изтрити : [x64] HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows [AppInit_DLLs] - d:progra~3bitguard271832~1.68{c16c1~1loader.dll
Данни Изтрити : [x64] HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindows [AppInit_DLLs] - d:progra~3bitguard271769~1.27{c16c1~1loader.dll

***** [ Браузъри ] *****

- Internet Explorer v11.0.9600.17041

Настройки Възстановен : HKCUSoftwareMicrosoftInternet ExplorerMain [start Page]
Настройки Възстановен : HKCUSoftwareMicrosoftInternet ExplorerMain [secondary Start Pages]

- Mozilla Firefox v29.0.1 (bg)

[ Файл : D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultprefs.js ]

Елемент изтрит : user_pref("aol_toolbar.default.homepage.check", false);
Елемент изтрит : user_pref("aol_toolbar.default.search.check", false);
Елемент изтрит : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=121124&tt=gc_&babsrc=HP_ss_sps&mntrId=901F001D7DD6FB78");
Елемент изтрит : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "WebSearch");
Елемент изтрит : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "WebSearch");
Елемент изтрит : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://websearch.lookforithere.info/?pid=377&r=2013/05/15&hid=840729130&lg=EN&cc=BG&unqvl=14");
Елемент изтрит : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://websearch.lookforithere.info/?pid=377&r=2013/05/15&hid=840729130&lg=EN&cc=BG&unqvl=14&l=1&q=");
Елемент изтрит : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ".*");
Елемент изтрит : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "1");
Елемент изтрит : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "1");
Елемент изтрит : user_pref("sweetim.toolbar.searchguard.enable", "false");

- Google Chrome v27.0.1453.116

[ Файл : D:UsersвалентинAppDataLocalGoogleChromeUser DataDefaultpreferences ]

Изтрити [Extension] : dhdepfaagokllfmhfbcfmocaeigmoebo
Изтрити [Extension] : hphibigbodkkohoglgfkddblldpfohjl
Изтрити [Extension] : kdcnnmifdmlmjffdgeieikcokcogpbej
Изтрити [Extension] : kincjchfokkeneeofpeefomkikfkiedl
Изтрити [Extension] : pgmfkblbflahhponhjmkcnpjinenhlnc

*************************

AdwCleaner[R0].txt - [11675 octets] - [10/05/2014 15:57:39]
AdwCleaner[s0].txt - [10768 octets] - [10/05/2014 15:59:13]

########## EOF - D:AdwCleanerAdwCleaner[s0].txt - [10829 octets] ##########
 

от JRT - Junk Removal Tool

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by ў «Ґ­вЁ­ on бкЎ 10.05.2014 Ј. at 16:11:48,71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerInternetRegistryREGISTRYUSERS-1-5-21-1572348304-2211094912-2870549525-1001Softwaresweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINESoftwaresweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchScopes{34A65E54-8260-47E4-A455-C518CBFFCB31}



~~~ Files

Successfully deleted: [File] "D:WindowsTasksdll-files.com fixer_monthly.job"
Successfully deleted: [File] "D:WindowsTasksdll-files.com fixer_updates.job"



~~~ Folders

Successfully deleted: [Folder] "D:Usersў «Ґ­вЁ­AppDataRoamingdll-files.com"
Successfully deleted: [Folder] "D:Usersў «Ґ­вЁ­AppDataRoamingthinstall"
Successfully deleted: [Folder] "D:Program Files (x86)dll-files.com fixer"



~~~ FireFox

Emptied folder: D:Usersў «Ґ­вЁ­AppDataRoamingmozillafirefoxprofilesojgaxvrr.defaultminidumps [185 files]



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_CURRENT_USERSoftwarePoliciesGoogle [blacklisted Policy]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on бкЎ 10.05.2014 Ј. at 16:27:37,31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

Rogue Killer

 

RogueKiller V8.8.15 _x64_ [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : валентин [Admin rights]
Mode : Scan -- Date : 05/10/2014 16:32:37
| ARK || FAK || MBR |

¤¤¤ Bad processes : 2 ¤¤¤
[sUSP UNIC] tv_x64.exe -- D:UsersвалентинAppDataLocalTempTeamViewerVersion7tv_x64.exe [7] -> KILLED [TermProc]
[sUSP PATH][DLL] explorer.exe -- D:Users2854~1AppDataLocalTempTeamViewerVersion7tv_x64.dll [x] -> UNLOADED

¤¤¤ Registry Entries : 6 ¤¤¤
[RUN][sUSP UNIC] HKCU[...]Run : Microsoft Application Manager ("D:UsersвалентинAppDataRoamingMicrosoftApplicationManagerstub.exe" "D:UsersвалентинAppDataRoamingMicrosoftApplicationManagermst.exe" [x]) -> FOUND
[RUN][sUSP UNIC] HKUSS-1-5-21-1572348304-2211094912-2870549525-1001[...]Run : Microsoft Application Manager ("D:UsersвалентинAppDataRoamingMicrosoftApplicationManagerstub.exe" "D:UsersвалентинAppDataRoamingMicrosoftApplicationManagermst.exe" [x]) -> FOUND
[HJ POL][PUM] HKCU[...]System : DisableTaskMgr (0) -> FOUND
[HJ POL][PUM] HKCU[...]System : DisableRegistryTools (0) -> FOUND
[HJ DESK][PUM] HKLM[...]NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM[...]NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 2 ¤¤¤
[V1][sUSP UNIC] updater.job : D:WindowsSysWOW64rundll32.exe - "D:UsersвалентинAppDataRoamingUpdaterupdater_task.dll",schedule_task [7][-] -> FOUND
[V2][sUSP UNIC] updater : D:WindowsSysWOW64rundll32.exe - "D:UsersвалентинAppDataRoamingUpdaterupdater_task.dll",schedule_task [7][-] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
[Address] EAT @explorer.exe (DllCanUnloadNow) : WINBRAND.dll -> HOOKED (D:Windowssystem32wpdshserviceobj.dll @ 0xF6C03D60)
[Address] EAT @explorer.exe (DllGetClassObject) : WINBRAND.dll -> HOOKED (D:Windowssystem32wpdshserviceobj.dll @ 0xF6C01A74)
[Address] EAT @explorer.exe (DllRegisterServer) : WINBRAND.dll -> HOOKED (D:Windowssystem32wpdshserviceobj.dll @ 0xF6C06070)
[Address] EAT @explorer.exe (DllUnregisterServer) : WINBRAND.dll -> HOOKED (D:Windowssystem32wpdshserviceobj.dll @ 0xF6C06278)

¤¤¤ External Hives: ¤¤¤
-> C:windowssystem32configSYSTEM | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]
-> C:windowssystem32configSOFTWARE | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]
-> C:windowssystem32configSECURITY | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]
-> C:Documents and SettingsAdminNTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]
-> C:Documents and SettingsDefault UserNTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]
-> C:Documents and SettingsLocalServiceNTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]
-> C:Documents and SettingsNetworkServiceNTUSER.DAT | DRVINFO [Drv - C:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%System32driversetchosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (.PHYSICALDRIVE0 @ IDE) ST3320620AS ATA Device +++++
--- User ---
[MBR] 86929473f605e79972390f6a466c4dcd
[bSP] 2dcd1aac64c1e4cec09a7591d994a8c9 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 20002 MB
1 - [XXXXXX] EXTEN (0x05) [VISIBLE] Offset (sectors): 40965750 | Size: 285240 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_05102014_163237.txt >>



 

От Security Check

 

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
ESET Smart Security 7.0   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 55  
 Adobe Flash Player 13.0.0.206  
 Mozilla Firefox (29.0.1)
 Google Chrome 27.0.1453.110  
 Google Chrome 27.0.1453.116  
````````Process Check: objlist.exe by Laurent````````  
 ESET NOD32 Antivirus egui.exe  
 ESET NOD32 Antivirus ekrn.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive D: 6%
````````````````````End of Log``````````````````````
 

И отново FRST

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-05-2014
Ran by валентин (administrator) on ВАЛЕНТИН-PC on 10-05-2014 16:40:14
Running from D:UsersвалентинDesktop
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Bulgarian
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) D:WindowsSystem32nvvsvc.exe
(NVIDIA Corporation) D:Program Files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe
(NVIDIA Corporation) D:Program FilesNVIDIA CorporationDisplaynvxdsync.exe
(NVIDIA Corporation) D:WindowsSystem32nvvsvc.exe
(Apple Inc.) D:Program Files (x86)Common FilesAppleMobile Device SupportAppleMobileDeviceService.exe
(Apple Inc.) D:Program FilesBonjourmDNSResponder.exe
(Microsoft Corporation) D:Program Files (x86)SkypeToolbarsAutoUpdateSkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) D:Program Files (x86)SkypeToolbarsPNRSvcSkypeC2CPNRSvc.exe
(ESET) D:Program FilesESETESET Smart Securityx86ekrn.exe
(HP) D:WindowsSystem32HPSIsvc.exe
() D:Program Files (x86)Tortor.exe
(LogMeIn Inc.) D:Program Files (x86)LogMeIn Hamachihamachi-2.exe
(LogMeIn, Inc.) D:Program Files (x86)LogMeIn HamachiLMIGuardianSvc.exe
(Google Inc.) D:Program Files (x86)GoogleUpdate1.3.24.7GoogleCrashHandler.exe
(Google Inc.) D:Program Files (x86)GoogleUpdate1.3.24.7GoogleCrashHandler64.exe
(NVIDIA Corporation) D:Program FilesNVIDIA CorporationDisplaynvtray.exe
(ESET) D:Program FilesESETESET Smart Securityegui.exe
(BitTorrent Inc.) D:Program Files (x86)uTorrentuTorrent.exe
(DT Soft Ltd) D:Program Files (x86)DAEMON Tools LiteDTLite.exe
(Skype Technologies S.A.) D:Program Files (x86)SkypePhoneSkype.exe
(Apple Inc.) D:Program Files (x86)iTunesiTunesHelper.exe
(LogMeIn Inc.) D:Program Files (x86)LogMeIn Hamachihamachi-2-ui.exe
(Oracle Corporation) D:Program Files (x86)Common FilesJavaJava Updatejusched.exe
(LogMeIn, Inc.) D:Program Files (x86)LogMeIn HamachiLMIGuardianSvc.exe
(Apple Inc.) D:Program FilesiPodbiniPodService.exe
(MAGIX AG) D:Program Files (x86)Common FilesMAGIX ServicesDatabasebinFABS.exe
(NVIDIA Corporation) D:Program Files (x86)NVIDIA CorporationNVIDIA Update Coredaemonu.exe
(TeamViewer GmbH) D:Users2854~1AppDataLocalTempTeamViewerVersion7TeamViewer.exe
(TeamViewer GmbH) D:Users2854~1AppDataLocalTempTeamViewerVersion7tv_w32.exe
(TeamViewer GmbH) D:Users2854~1AppDataLocalTempTeamViewerVersion7TeamViewer_Desktop.exe


==================== Registry (Whitelisted) ==================

HKLM...Run: [egui] => D:Program FilesESETESET Smart Securityegui.exe [5618456 2013-09-12] (ESET)
HKLM-x32...Run: [APSDaemon] => D:Program Files (x86)Common FilesAppleApple Application SupportAPSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32...Run: [iTunesHelper] => D:Program Files (x86)iTunesiTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32...Run: [LogMeIn Hamachi Ui] => D:Program Files (x86)LogMeIn Hamachihamachi-2-ui.exe [3814736 2014-04-15] (LogMeIn Inc.)
HKLM-x32...Run: [sunJavaUpdateSched] => D:Program Files (x86)Common FilesJavaJava Updatejusched.exe [254336 2013-07-02] (Oracle Corporation)
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...Run: [uTorrent] => D:Program Files (x86)uTorrentuTorrent.exe [802136 2013-04-17] (BitTorrent Inc.)
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...Run: [GoogleChromeAutoLaunch_5278D4880F3216C6283BD9E718608697] => D:Program Files (x86)GoogleChromeApplicationchrome.exe [825808 2013-06-15] (Google Inc.)
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...Run: [DAEMON Tools Lite] => D:Program Files (x86)DAEMON Tools LiteDTLite.exe [369200 2009-10-30] (DT Soft Ltd)
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...Run: [skype] => D:Program Files (x86)SkypePhoneSkype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...Run: [Microsoft Application Manager] => "D:UsersвалентинAppDataRoamingMicrosoftApplicationManagerstub.exe" "D:UsersвалентинAppDataRoamingMicrosoftApplicationManagermst.exe"
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...MountPoints2: {b9d56642-4d2d-11e3-8461-001d7dd6fb78} - H:setup.exe
HKUS-1-5-21-1572348304-2211094912-2870549525-1001...MountPoints2: {da9a8b60-d5a7-11e2-b513-001d7dd6fb78} - H:AutoRun.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page Redirect Cache_TIMESTAMP = 0xA8750266D1FBCD01
HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page Redirect Cache AcceptLangs = bg-BG
HKCUSoftwareMicrosoftInternet ExplorerMain,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
SearchScopes: HKCU - 45F8D9700D224BE287D385870F9A1E3F URL = http://websearch.lookforithere.info/?l=1&q={searchTerms}&pid=377&r=2013/05/15&hid=840729130&lg=EN&cc=BG&unqvl=14
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:Program Files (x86)Javajre7binssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:Program Files (x86)SkypeToolbarsInternet ExplorerSkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:Program Files (x86)Javajre7binjp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - D:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll (Microsoft Corporation)
Handler-x32: http0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:Program Files (x86)Common FilesSYSTEMOLE DBmsdaipp.dll (Microsoft Corporation)
Handler-x32: httpoledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:Program Files (x86)Common FilesSYSTEMOLE DBmsdaipp.dll (Microsoft Corporation)
Handler-x32: https0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:Program Files (x86)Common FilesSYSTEMOLE DBmsdaipp.dll (Microsoft Corporation)
Handler-x32: httpsoledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:Program Files (x86)Common FilesSYSTEMOLE DBmsdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:Program Files (x86)Common FilesSYSTEMOLE DBmsdaipp.dll (Microsoft Corporation)
Handler-x32: msdaippoledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:Program Files (x86)Common FilesSYSTEMOLE DBmsdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - D:Program Files (x86)SkypeToolbarsInternet ExplorerSkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:Program Files (x86)Common FilesSkypeSkype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

FireFox:
========
FF ProfilePath: D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&dt=071713&q=
FF Plugin: @adobe.com/FlashPlayer - D:Windowssystem32MacromedFlashNPSWF64_13_0_0_206.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - D:WindowsSysWOW64MacromedFlashNPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:Program Files (x86)iTunesMozilla Pluginsnpitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - D:Program Files (x86)GoogleGoogle Earthpluginnpgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - D:Program Files (x86)Javajre7bindtpluginnpDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - D:Program Files (x86)Javajre7binplugin2npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - D:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - D:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - D:Program Files (x86)Pando NetworksMedia BoosternpPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - D:Program Files (x86)GoogleUpdate1.3.24.7npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - D:Program Files (x86)GoogleUpdate1.3.24.7npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - D:Program Files (x86)Pando NetworksMedia BoosternpPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: D:Program Files (x86)mozilla firefoxbrowsersearchplugins911bg.xml
FF SearchPlugin: D:Program Files (x86)mozilla firefoxbrowsersearchpluginsdiribg.xml
FF SearchPlugin: D:Program Files (x86)mozilla firefoxbrowsersearchpluginspe-bg.xml
FF SearchPlugin: D:Program Files (x86)mozilla firefoxbrowsersearchpluginsportalbgdict.xml
FF Extension: Kozaka - D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultExtensionsfirefox@kozaka.net [2013-12-22]
FF Extension: Adblock Plus - D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultExtensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2014-04-25]
FF Extension: Adblock Plus - D:UsersвалентинAppDataRoamingMozillaFirefoxProfilesojgaxvrr.defaultExtensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-01]
FF Extension: Skype Click to Call - D:Program Files (x86)Mozilla Firefoxbrowserextensions{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-05-10]
FF HKLM-x32...ThunderbirdExtensions: [[email protected]] - D:Program FilesESETESET Smart SecurityMozilla Thunderbird
FF Extension: ESET Smart Security Extension - D:Program FilesESETESET Smart SecurityMozilla Thunderbird [2014-05-06]

Chrome:
=======
CHR HomePage:
CHR DefaultSearchKeyword: songsterr.com
CHR DefaultSearchProvider: songsterr.com
CHR DefaultSearchURL: http://www.songsterr.com/a/wa/search?pattern={searchTerms}
CHR Plugin: (Shockwave Flash) - D:Program Files (x86)GoogleChromeApplication27.0.1453.116PepperFlashpepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - D:Program Files (x86)GoogleChromeApplication27.0.1453.116ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - D:Program Files (x86)GoogleChromeApplication27.0.1453.116pdf.dll ()
CHR Plugin: (Google Earth Plugin) - D:Program Files (x86)GoogleGoogle Earthpluginnpgeplugin.dll (Google)
CHR Plugin: (Google Update) - D:Program Files (x86)GoogleUpdate1.3.23.9npGoogleUpdate3.dll No File
CHR Plugin: (Java Platform SE 7 U25) - D:Program Files (x86)Javajre7binplugin2npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - D:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - D:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Pando Web Plugin) - D:Program Files (x86)Pando NetworksMedia BoosternpPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (iTunes Application Detector) - D:Program Files (x86)iTunesMozilla Pluginsnpitunes.dll ()
CHR Plugin: (Shockwave Flash) - D:WindowsSysWOW64MacromedFlashNPSWF32_12_0_0_43.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - D:WindowsSysWOW64npDeployJava1.dll No File
CHR Extension: (Skype Click to Call) - D:UsersвалентинAppDataLocalGoogleChromeUser DataDefaultExtensionslifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-01-20]
CHR Extension: (Select Links App) - D:UsersвалентинAppDataLocalGoogleChromeUser DataDefaultExtensionsmncnhgihkmcfmbmbkmifbipaglkjpjjo [2014-01-20]
CHR HKLM-x32...ChromeExtension: [ajffdpepcmnknefagdglchbgjkbpllkf] - D:Program Files (x86)MediaViewV1MediaViewV1alpha2777chMediaViewV1alpha2777.crx [2014-01-20]
CHR HKLM-x32...ChromeExtension: [dkpgpalmlhhcakipgodbonbgjjdmbjnl] - D:Program Files (x86)MediaViewerV1MediaViewerV1alpha1423chMediaViewerV1alpha1423.crx [2014-01-20]
CHR HKLM-x32...ChromeExtension: [fknpjnbjgenjlgjkfndlpojkkcepimng] - D:Program Files (x86)VideoPlayerV3VideoPlayerV3beta291chVideoPlayerV3beta291.crx [2014-01-20]
CHR HKLM-x32...ChromeExtension: [hoafijjpffbmkdghdhiigjhefehoegnk] - D:Program Files (x86)WebexpEnhancedV1WebexpEnhancedV1alpha5370chWebexpEnhancedV1alpha5370.crx [2014-01-20]
CHR HKLM-x32...ChromeExtension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - D:Program Files (x86)SkypeToolbarsChromeExtensionskype_chrome_extension.crx [2014-04-11]
CHR HKLM-x32...ChromeExtension: [mciekghplkkgcmofonmkmlomhkamochd] - D:Program Files (x86)Kozakamciekghplkkgcmofonmkmlomhkamochd.crx [2014-04-11]
CHR HKLM-x32...ChromeExtension: [pgoklfignkjofpdnlfdkplonjjkolilp] - D:Program Files (x86)MediaWatchV1MediaWatchV1home778chMediaWatchV1home778.crx [2014-04-11]
CHR HKLM-x32...ChromeExtension: [pnhkglddhcpgkbjojgmcnacpcjniebcj] - D:Program Files (x86)MediaBuzzV1MediaBuzzV1mode5675chMediaBuzzV1mode5675.crx [2014-04-11]
CHR HKLMSOFTWAREPoliciesGoogle: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

S3 Adobe LM Service; D:Program Files (x86)Common FilesAdobe Systems SharedServiceAdobelmsvc.exe [72704 2014-05-10] (Adobe Systems)
R2 c2cautoupdatesvc; D:Program Files (x86)SkypeToolbarsAutoUpdateSkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; D:Program Files (x86)SkypeToolbarsPNRSvcSkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 ekrn; D:Program FilesESETESET Smart Securityx86ekrn.exe [1337752 2013-09-12] (ESET)
R2 tor; D:Program Files (x86)Tortor.exe [3233806 2013-08-29] ()

==================== Drivers (Whitelisted) ====================

R1 eamonm; D:WindowsSystem32DRIVERSeamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; D:WindowsSystem32Driversedevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; D:WindowsSystem32DRIVERSehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; D:WindowsSystem32DRIVERSepfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; D:WindowsSystem32DRIVERSEpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; D:WindowsSystem32DRIVERSepfwwfp.sys [62136 2013-09-17] (ESET)
S3 mvusbews; D:WindowsSystem32Driversmvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)
R0 sptd; D:WindowsSystem32Driverssptd.sys [834544 2013-03-24] ()
R1 {ce2cc6b9-0133-4405-9775-8944501dc17c}w64; D:WindowsSystem32drivers{ce2cc6b9-0133-4405-9775-8944501dc17c}w64.sys [61112 2014-04-24] (StdLib)
U3 alk96tjm; D:WindowsSystem32Driversalk96tjm.sys [0 ] (Microsoft Corporation)
S3 VGPU; System32driversrdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-10 16:40 - 2014-05-10 16:40 - 00016510 _____ () D:UsersвалентинDesktopFRST.txt
2014-05-10 16:40 - 2014-05-10 16:40 - 00000000 ____D () D:UsersвалентинDesktopFRST-OlderVersion
2014-05-10 16:35 - 2014-05-10 16:35 - 00854367 _____ () D:UsersвалентинDesktopSecurityCheck.exe
2014-05-10 16:32 - 2014-05-10 16:32 - 00004280 _____ () D:UsersвалентинDesktopRKreport[0]_S_05102014_163237.txt
2014-05-10 16:32 - 2014-05-10 16:32 - 00000000 ____D () D:UsersвалентинAppDataLocalCrashDumps
2014-05-10 16:28 - 2014-05-10 16:34 - 00000000 ____D () D:UsersвалентинDesktopRK_Quarantine
2014-05-10 16:28 - 2014-05-10 16:28 - 04527616 _____ () D:UsersвалентинDesktopRogueKillerX64.exe
2014-05-10 16:27 - 2014-05-10 16:27 - 00001708 _____ () D:UsersвалентинDesktopJRT.txt
2014-05-10 16:22 - 2014-05-10 16:22 - 00000000 ____D () D:ProgramDataAdobe Systems
2014-05-10 16:11 - 2014-05-10 16:11 - 01016261 _____ (Thisisu) D:UsersвалентинDesktopJRT.exe
2014-05-10 16:11 - 2014-05-10 16:11 - 00000000 ____D () D:WindowsERUNT
2014-05-10 16:10 - 2014-05-10 16:10 - 01016261 _____ (Thisisu) D:UsersвалентинDownloadsJRT.exe
2014-05-10 16:07 - 2014-05-10 16:07 - 00003112 _____ () D:WindowsSystem32TasksRDReminder
2014-05-10 15:58 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) D:WindowsSysWOW64sqlite3.dll
2014-05-10 15:57 - 2014-05-10 15:59 - 00000000 ____D () D:AdwCleaner
2014-05-10 15:56 - 2014-05-10 15:56 - 01316991 _____ () D:UsersвалентинDesktopadwcleaner.exe
2014-05-10 15:50 - 2014-05-10 15:52 - 00002562 _____ () D:UsersвалентинDesktopRkill.txt
2014-05-10 15:49 - 2014-05-10 15:50 - 01933048 _____ (Bleeping Computer, LLC) D:UsersвалентинDesktoprkill.exe
2014-05-10 15:46 - 2014-05-10 16:36 - 00000000 ____D () D:UsersвалентинDesktoppodredi go malko
2014-05-10 15:43 - 2014-05-10 15:43 - 00002213 _____ () D:ProgramDataMicrosoftWindowsStart MenuProgramsAdobe Premiere Pro 2.0.lnk
2014-05-10 15:40 - 2014-05-10 15:40 - 00000000 ____D () D:ProgramDataAdobe
2014-05-10 15:39 - 2014-05-10 15:39 - 00000000 ____D () D:Program Files (x86)Adobe
2014-05-10 15:29 - 2014-05-10 15:29 - 00000000 ____D () D:Program Files (x86)Mozilla Firefox
2014-05-10 14:49 - 2014-05-10 14:49 - 00012138 _____ () D:UsersвалентинDownloadsКнига1.xlsx
2014-05-09 19:12 - 2014-05-09 19:13 - 08773632 _____ () D:UsersвалентинDownloadsИгра -разпознаване на приказки.ppt
2014-05-08 15:44 - 2014-05-08 15:44 - 00503971 _____ () D:UsersвалентинDownloadsматериали.rar
2014-05-07 22:15 - 2014-05-07 22:15 - 00905728 _____ () D:UsersвалентинDownloadsglasni i saglasni.ppt
2014-05-07 22:13 - 2014-05-07 22:13 - 03609088 _____ () D:UsersвалентинDownloadsПознай думата по картинка.ppt
2014-05-07 22:09 - 2014-05-07 22:10 - 42416640 _____ () D:UsersвалентинDownloadskartinna_AZBUKA.ppt
2014-05-07 21:55 - 2014-05-07 21:55 - 06346240 _____ () D:UsersвалентинDownloadsЗапетаи_в_сложното_изречение_2003.ppt
2014-05-06 14:41 - 2014-05-06 14:41 - 00000000 __SHD () D:UsersвалентинAppDataLocalEmieUserList
2014-05-06 14:41 - 2014-05-06 14:41 - 00000000 __SHD () D:UsersвалентинAppDataLocalEmieSiteList
2014-05-06 14:16 - 2014-05-10 16:40 - 00000000 ____D () D:FRST
2014-05-06 14:14 - 2014-05-10 16:40 - 02065408 _____ (Farbar) D:UsersвалентинDesktopFRST64.exe
2014-05-06 12:37 - 2014-05-06 12:37 - 00000000 ____D () D:UsersвалентинAppDataRoamingESET
2014-05-06 12:37 - 2014-05-06 12:37 - 00000000 ____D () D:UsersвалентинAppDataLocalESET
2014-05-06 12:28 - 2014-05-06 12:28 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsESET
2014-05-06 12:28 - 2014-05-06 12:28 - 00000000 ____D () D:ProgramDataESET
2014-05-06 12:28 - 2014-05-06 12:28 - 00000000 ____D () D:Program FilesESET
2014-05-06 12:20 - 2014-05-06 14:38 - 00119512 _____ (Malwarebytes Corporation) D:Windowssystem32DriversMBAMSwissArmy.sys
2014-05-06 12:19 - 2014-05-06 12:19 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes Anti-Malware
2014-05-06 12:19 - 2014-05-06 12:19 - 00000000 ____D () D:ProgramDataMalwarebytes
2014-05-06 12:19 - 2014-05-06 12:19 - 00000000 ____D () D:Program Files (x86)Malwarebytes Anti-Malware
2014-05-06 12:19 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) D:Windowssystem32Driversmbamchameleon.sys
2014-05-06 12:19 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) D:Windowssystem32Driversmwac.sys
2014-05-06 12:19 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) D:Windowssystem32Driversmbam.sys
2014-05-06 12:10 - 2014-05-06 12:12 - 17305616 _____ (Malwarebytes Corporation ) D:UsersвалентинDownloadsmbam-setup-2.0.1.1004 (2).exe
2014-05-06 12:09 - 2014-05-06 12:12 - 17305616 _____ (Malwarebytes Corporation ) D:UsersвалентинDownloadsmbam-setup-2.0.1.1004 (1).exe
2014-05-06 12:08 - 2014-05-06 12:10 - 17305616 _____ (Malwarebytes Corporation ) D:UsersвалентинDownloadsmbam-setup-2.0.1.1004.exe
2014-05-05 13:21 - 2014-05-05 13:21 - 00000000 ____D () D:UsersвалентинAppDataLocalThinstall
2014-05-03 13:15 - 2014-05-03 13:15 - 00036673 _____ () D:UsersвалентинDownloadsquest_pistols-tyi_tak_krasiva.gpx
2014-05-03 11:27 - 2014-04-29 17:01 - 23547904 _____ (Microsoft Corporation) D:Windowssystem32mshtml.dll
2014-05-03 11:27 - 2014-04-29 16:40 - 02724864 _____ (Microsoft Corporation) D:Windowssystem32mshtml.tlb
2014-05-03 11:27 - 2014-04-29 15:48 - 17384448 _____ (Microsoft Corporation) D:WindowsSysWOW64mshtml.dll
2014-05-03 11:27 - 2014-04-29 15:34 - 02724864 _____ (Microsoft Corporation) D:WindowsSysWOW64mshtml.tlb
2014-05-01 12:27 - 2014-05-01 12:27 - 00000000 ____D () D:ProgramDataOracle
2014-05-01 12:26 - 2014-05-01 12:26 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsJava
2014-05-01 12:26 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) D:WindowsSysWOW64WindowsAccessBridge-32.dll
2014-05-01 12:26 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) D:WindowsSysWOW64javaws.exe
2014-05-01 12:26 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) D:WindowsSysWOW64javaw.exe
2014-05-01 12:26 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) D:WindowsSysWOW64java.exe
2014-05-01 12:23 - 2014-05-01 12:26 - 00005883 _____ () D:WindowsSysWOW64jupdate-1.7.0_55-b14.log
2014-04-26 10:22 - 2014-05-06 13:50 - 00000000 ____D () D:Program Files (x86)MediaBuzzV1
2014-04-25 10:42 - 2014-04-24 12:24 - 00061112 _____ (StdLib) D:Windowssystem32Drivers{ce2cc6b9-0133-4405-9775-8944501dc17c}w64.sys
2014-04-16 14:48 - 2014-04-16 14:48 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsLogMeIn Hamachi
2014-04-16 14:48 - 2014-04-16 14:48 - 00000000 ____D () D:Program Files (x86)LogMeIn Hamachi
2014-04-15 07:49 - 2014-03-06 12:31 - 00004096 _____ (Microsoft Corporation) D:Windowssystem32ieetwcollectorres.dll
2014-04-15 07:49 - 2014-03-06 11:59 - 00066048 _____ (Microsoft Corporation) D:Windowssystem32iesetup.dll
2014-04-15 07:49 - 2014-03-06 11:57 - 00548352 _____ (Microsoft Corporation) D:Windowssystem32vbscript.dll
2014-04-15 07:49 - 2014-03-06 11:57 - 00048640 _____ (Microsoft Corporation) D:Windowssystem32ieetwproxystub.dll
2014-04-15 07:49 - 2014-03-06 11:53 - 02767360 _____ (Microsoft Corporation) D:Windowssystem32iertutil.dll
2014-04-15 07:49 - 2014-03-06 11:40 - 00051200 _____ (Microsoft Corporation) D:Windowssystem32jsproxy.dll
2014-04-15 07:49 - 2014-03-06 11:39 - 00033792 _____ (Microsoft Corporation) D:Windowssystem32iernonce.dll
2014-04-15 07:49 - 2014-03-06 11:32 - 00574976 _____ (Microsoft Corporation) D:Windowssystem32ieui.dll
2014-04-15 07:49 - 2014-03-06 11:29 - 00139264 _____ (Microsoft Corporation) D:Windowssystem32ieUnatt.exe
2014-04-15 07:49 - 2014-03-06 11:29 - 00111616 _____ (Microsoft Corporation) D:Windowssystem32ieetwcollector.exe
2014-04-15 07:49 - 2014-03-06 11:28 - 00752640 _____ (Microsoft Corporation) D:Windowssystem32jscript9diag.dll
2014-04-15 07:49 - 2014-03-06 11:15 - 00940032 _____ (Microsoft Corporation) D:Windowssystem32MsSpellCheckingFacility.exe
2014-04-15 07:49 - 2014-03-06 11:11 - 05784064 _____ (Microsoft Corporation) D:Windowssystem32jscript9.dll
2014-04-15 07:49 - 2014-03-06 11:09 - 00453120 _____ (Microsoft Corporation) D:Windowssystem32dxtmsft.dll
2014-04-15 07:49 - 2014-03-06 11:03 - 00586240 _____ (Microsoft Corporation) D:Windowssystem32ie4uinit.exe
2014-04-15 07:49 - 2014-03-06 11:02 - 00455168 _____ (Microsoft Corporation) D:WindowsSysWOW64vbscript.dll
2014-04-15 07:49 - 2014-03-06 11:02 - 00061952 _____ (Microsoft Corporation) D:WindowsSysWOW64iesetup.dll
2014-04-15 07:49 - 2014-03-06 11:01 - 00051200 _____ (Microsoft Corporation) D:WindowsSysWOW64ieetwproxystub.dll
2014-04-15 07:49 - 2014-03-06 10:56 - 00038400 _____ (Microsoft Corporation) D:Windowssystem32JavaScriptCollectionAgent.dll
2014-04-15 07:49 - 2014-03-06 10:48 - 00195584 _____ (Microsoft Corporation) D:Windowssystem32msrating.dll
2014-04-15 07:49 - 2014-03-06 10:47 - 02178048 _____ (Microsoft Corporation) D:WindowsSysWOW64iertutil.dll
2014-04-15 07:49 - 2014-03-06 10:46 - 04254720 _____ (Microsoft Corporation) D:WindowsSysWOW64jscript9.dll
2014-04-15 07:49 - 2014-03-06 10:46 - 00043008 _____ (Microsoft Corporation) D:WindowsSysWOW64jsproxy.dll
2014-04-15 07:49 - 2014-03-06 10:45 - 00032768 _____ (Microsoft Corporation) D:WindowsSysWOW64iernonce.dll
2014-04-15 07:49 - 2014-03-06 10:42 - 00296960 _____ (Microsoft Corporation) D:Windowssystem32dxtrans.dll
2014-04-15 07:49 - 2014-03-06 10:40 - 00440832 _____ (Microsoft Corporation) D:WindowsSysWOW64ieui.dll
2014-04-15 07:49 - 2014-03-06 10:38 - 00112128 _____ (Microsoft Corporation) D:WindowsSysWOW64ieUnatt.exe
2014-04-15 07:49 - 2014-03-06 10:36 - 00592896 _____ (Microsoft Corporation) D:WindowsSysWOW64jscript9diag.dll
2014-04-15 07:49 - 2014-03-06 10:22 - 00367616 _____ (Microsoft Corporation) D:WindowsSysWOW64dxtmsft.dll
2014-04-15 07:49 - 2014-03-06 10:21 - 00628736 _____ (Microsoft Corporation) D:Windowssystem32msfeeds.dll
2014-04-15 07:49 - 2014-03-06 10:13 - 00032256 _____ (Microsoft Corporation) D:WindowsSysWOW64JavaScriptCollectionAgent.dll
2014-04-15 07:49 - 2014-03-06 10:11 - 02043904 _____ (Microsoft Corporation) D:Windowssystem32inetcpl.cpl
2014-04-15 07:49 - 2014-03-06 10:07 - 00164864 _____ (Microsoft Corporation) D:WindowsSysWOW64msrating.dll
2014-04-15 07:49 - 2014-03-06 10:01 - 00244224 _____ (Microsoft Corporation) D:WindowsSysWOW64dxtrans.dll
2014-04-15 07:49 - 2014-03-06 09:53 - 13551104 _____ (Microsoft Corporation) D:Windowssystem32ieframe.dll
2014-04-15 07:49 - 2014-03-06 09:46 - 00524288 _____ (Microsoft Corporation) D:WindowsSysWOW64msfeeds.dll
2014-04-15 07:49 - 2014-03-06 09:40 - 01967104 _____ (Microsoft Corporation) D:WindowsSysWOW64inetcpl.cpl
2014-04-15 07:49 - 2014-03-06 09:36 - 11745792 _____ (Microsoft Corporation) D:WindowsSysWOW64ieframe.dll
2014-04-15 07:49 - 2014-03-06 09:22 - 02260480 _____ (Microsoft Corporation) D:Windowssystem32wininet.dll
2014-04-15 07:49 - 2014-03-06 08:58 - 01400832 _____ (Microsoft Corporation) D:Windowssystem32urlmon.dll
2014-04-15 07:49 - 2014-03-06 08:50 - 00846336 _____ (Microsoft Corporation) D:Windowssystem32ieapfltr.dll
2014-04-15 07:49 - 2014-03-06 08:43 - 00704512 _____ (Microsoft Corporation) D:WindowsSysWOW64ieapfltr.dll
2014-04-15 07:49 - 2014-03-06 08:41 - 01789440 _____ (Microsoft Corporation) D:WindowsSysWOW64wininet.dll
2014-04-15 07:49 - 2014-03-06 08:36 - 01143808 _____ (Microsoft Corporation) D:WindowsSysWOW64urlmon.dll
2014-04-11 12:18 - 2014-04-11 12:21 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsHalo Combat Evolved
2014-04-11 12:18 - 2014-04-11 12:18 - 00000000 ____D () D:Program Files (x86)Bungie

==================== One Month Modified Files and Folders =======

2014-05-10 16:40 - 2014-05-10 16:40 - 00016510 _____ () D:UsersвалентинDesktopFRST.txt
2014-05-10 16:40 - 2014-05-10 16:40 - 00000000 ____D () D:UsersвалентинDesktopFRST-OlderVersion
2014-05-10 16:40 - 2014-05-06 14:16 - 00000000 ____D () D:FRST
2014-05-10 16:40 - 2014-05-06 14:14 - 02065408 _____ (Farbar) D:UsersвалентинDesktopFRST64.exe
2014-05-10 16:39 - 2013-01-26 17:37 - 00000000 ____D () D:UsersвалентинAppDataRoaminguTorrent
2014-05-10 16:36 - 2014-05-10 15:46 - 00000000 ____D () D:UsersвалентинDesktoppodredi go malko
2014-05-10 16:35 - 2014-05-10 16:35 - 00854367 _____ () D:UsersвалентинDesktopSecurityCheck.exe
2014-05-10 16:34 - 2014-05-10 16:28 - 00000000 ____D () D:UsersвалентинDesktopRK_Quarantine
2014-05-10 16:32 - 2014-05-10 16:32 - 00004280 _____ () D:UsersвалентинDesktopRKreport[0]_S_05102014_163237.txt
2014-05-10 16:32 - 2014-05-10 16:32 - 00000000 ____D () D:UsersвалентинAppDataLocalCrashDumps
2014-05-10 16:28 - 2014-05-10 16:28 - 04527616 _____ () D:UsersвалентинDesktopRogueKillerX64.exe
2014-05-10 16:27 - 2014-05-10 16:27 - 00001708 _____ () D:UsersвалентинDesktopJRT.txt
2014-05-10 16:27 - 2013-01-26 17:30 - 00001002 _____ () D:WindowsTasksGoogleUpdateTaskMachineUA.job
2014-05-10 16:22 - 2014-05-10 16:22 - 00000000 ____D () D:ProgramDataAdobe Systems
2014-05-10 16:22 - 2013-04-07 15:10 - 00000000 ____D () D:UsersвалентинAppDataRoamingSkype
2014-05-10 16:11 - 2014-05-10 16:11 - 01016261 _____ (Thisisu) D:UsersвалентинDesktopJRT.exe
2014-05-10 16:11 - 2014-05-10 16:11 - 00000000 ____D () D:WindowsERUNT
2014-05-10 16:10 - 2014-05-10 16:10 - 01016261 _____ (Thisisu) D:UsersвалентинDownloadsJRT.exe
2014-05-10 16:09 - 2013-01-26 17:18 - 01675035 _____ () D:WindowsWindowsUpdate.log
2014-05-10 16:07 - 2014-05-10 16:07 - 00003112 _____ () D:WindowsSystem32TasksRDReminder
2014-05-10 16:04 - 2013-05-16 17:39 - 00000000 ____D () D:UsersвалентинAppDataLocalLogMeIn Hamachi
2014-05-10 16:02 - 2014-03-22 21:38 - 00000000 ____D () D:Program Files (x86)Mozilla Maintenance Service
2014-05-10 16:02 - 2013-01-27 14:50 - 00000000 ____D () D:ProgramDataNVIDIA
2014-05-10 16:02 - 2013-01-26 17:30 - 00000998 _____ () D:WindowsTasksGoogleUpdateTaskMachineCore.job
2014-05-10 16:02 - 2010-11-21 06:47 - 00237910 _____ () D:WindowsPFRO.log
2014-05-10 16:02 - 2009-07-14 08:08 - 00000006 ____H () D:WindowsTasksSA.DAT
2014-05-10 16:02 - 2009-07-14 07:51 - 00179136 _____ () D:Windowssetupact.log
2014-05-10 16:02 - 2009-07-14 07:45 - 00363976 _____ () D:Windowssystem32FNTCACHE.DAT
2014-05-10 16:00 - 2009-07-14 07:45 - 00016640 ____H () D:Windowssystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-10 16:00 - 2009-07-14 07:45 - 00016640 ____H () D:Windowssystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-10 15:59 - 2014-05-10 15:57 - 00000000 ____D () D:AdwCleaner
2014-05-10 15:59 - 2013-01-26 17:24 - 00000000 ___RD () D:UsersвалентинAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
2014-05-10 15:59 - 2013-01-26 17:23 - 00000000 ____D () D:Usersвалентин
2014-05-10 15:56 - 2014-05-10 15:56 - 01316991 _____ () D:UsersвалентинDesktopadwcleaner.exe
2014-05-10 15:53 - 2014-03-31 15:53 - 00000376 _____ () D:WindowsTasksupdater.job
2014-05-10 15:52 - 2014-05-10 15:50 - 00002562 _____ () D:UsersвалентинDesktopRkill.txt
2014-05-10 15:50 - 2014-05-10 15:49 - 01933048 _____ (Bleeping Computer, LLC) D:UsersвалентинDesktoprkill.exe
2014-05-10 15:44 - 2013-01-26 17:29 - 00103576 _____ () D:UsersвалентинAppDataLocalGDIPFONTCACHEV1.DAT
2014-05-10 15:43 - 2014-05-10 15:43 - 00002213 _____ () D:ProgramDataMicrosoftWindowsStart MenuProgramsAdobe Premiere Pro 2.0.lnk
2014-05-10 15:40 - 2014-05-10 15:40 - 00000000 ____D () D:ProgramDataAdobe
2014-05-10 15:39 - 2014-05-10 15:39 - 00000000 ____D () D:Program Files (x86)Adobe
2014-05-10 15:29 - 2014-05-10 15:29 - 00000000 ____D () D:Program Files (x86)Mozilla Firefox
2014-05-10 14:49 - 2014-05-10 14:49 - 00012138 _____ () D:UsersвалентинDownloadsКнига1.xlsx
2014-05-09 19:13 - 2014-05-09 19:12 - 08773632 _____ () D:UsersвалентинDownloadsИгра -разпознаване на приказки.ppt
2014-05-09 16:17 - 2013-07-27 17:48 - 00000000 ____D () D:UsersвалентинAppDataRoamingAnvSoft
2014-05-08 21:22 - 2013-01-26 17:30 - 00003998 _____ () D:WindowsSystem32TasksGoogleUpdateTaskMachineUA
2014-05-08 21:22 - 2013-01-26 17:30 - 00003746 _____ () D:WindowsSystem32TasksGoogleUpdateTaskMachineCore
2014-05-08 18:25 - 2013-01-27 14:16 - 00000000 ____D () D:UsersвалентинAppDataRoamingTeamViewer
2014-05-08 15:44 - 2014-05-08 15:44 - 00503971 _____ () D:UsersвалентинDownloadsматериали.rar
2014-05-07 22:15 - 2014-05-07 22:15 - 00905728 _____ () D:UsersвалентинDownloadsglasni i saglasni.ppt
2014-05-07 22:13 - 2014-05-07 22:13 - 03609088 _____ () D:UsersвалентинDownloadsПознай думата по картинка.ppt
2014-05-07 22:10 - 2014-05-07 22:09 - 42416640 _____ () D:UsersвалентинDownloadskartinna_AZBUKA.ppt
2014-05-07 21:55 - 2014-05-07 21:55 - 06346240 _____ () D:UsersвалентинDownloadsЗапетаи_в_сложното_изречение_2003.ppt
2014-05-07 12:59 - 2009-07-14 08:08 - 00032540 _____ () D:WindowsTasksSCHEDLGU.TXT
2014-05-06 18:50 - 2013-05-01 00:09 - 00048128 ____H () D:UsersвалентинDesktopphotothumb.db
2014-05-06 14:41 - 2014-05-06 14:41 - 00000000 __SHD () D:UsersвалентинAppDataLocalEmieUserList
2014-05-06 14:41 - 2014-05-06 14:41 - 00000000 __SHD () D:UsersвалентинAppDataLocalEmieSiteList
2014-05-06 14:38 - 2014-05-06 12:20 - 00119512 _____ (Malwarebytes Corporation) D:Windowssystem32DriversMBAMSwissArmy.sys
2014-05-06 13:50 - 2014-04-26 10:22 - 00000000 ____D () D:Program Files (x86)MediaBuzzV1
2014-05-06 13:48 - 2013-05-15 20:01 - 00000000 ____D () D:ProgramDataInstallMate
2014-05-06 13:48 - 2009-07-14 05:34 - 00000601 _____ () D:Windowswin.ini
2014-05-06 12:37 - 2014-05-06 12:37 - 00000000 ____D () D:UsersвалентинAppDataRoamingESET
2014-05-06 12:37 - 2014-05-06 12:37 - 00000000 ____D () D:UsersвалентинAppDataLocalESET
2014-05-06 12:28 - 2014-05-06 12:28 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsESET
2014-05-06 12:28 - 2014-05-06 12:28 - 00000000 ____D () D:ProgramDataESET
2014-05-06 12:28 - 2014-05-06 12:28 - 00000000 ____D () D:Program FilesESET
2014-05-06 12:19 - 2014-05-06 12:19 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes Anti-Malware
2014-05-06 12:19 - 2014-05-06 12:19 - 00000000 ____D () D:ProgramDataMalwarebytes
2014-05-06 12:19 - 2014-05-06 12:19 - 00000000 ____D () D:Program Files (x86)Malwarebytes Anti-Malware
2014-05-06 12:12 - 2014-05-06 12:10 - 17305616 _____ (Malwarebytes Corporation ) D:UsersвалентинDownloadsmbam-setup-2.0.1.1004 (2).exe
2014-05-06 12:12 - 2014-05-06 12:09 - 17305616 _____ (Malwarebytes Corporation ) D:UsersвалентинDownloadsmbam-setup-2.0.1.1004 (1).exe
2014-05-06 12:10 - 2014-05-06 12:08 - 17305616 _____ (Malwarebytes Corporation ) D:UsersвалентинDownloadsmbam-setup-2.0.1.1004.exe
2014-05-06 10:18 - 2013-06-22 12:35 - 00001140 __RSH () D:Usersвалентинntuser.pol
2014-05-05 13:21 - 2014-05-05 13:21 - 00000000 ____D () D:UsersвалентинAppDataLocalThinstall
2014-05-04 16:53 - 2013-06-30 16:43 - 00692400 _____ (Adobe Systems Incorporated) D:WindowsSysWOW64FlashPlayerApp.exe
2014-05-04 16:53 - 2013-06-30 16:43 - 00070832 _____ (Adobe Systems Incorporated) D:WindowsSysWOW64FlashPlayerCPLApp.cpl
2014-05-03 13:15 - 2014-05-03 13:15 - 00036673 _____ () D:UsersвалентинDownloadsquest_pistols-tyi_tak_krasiva.gpx
2014-05-01 12:27 - 2014-05-01 12:27 - 00000000 ____D () D:ProgramDataOracle
2014-05-01 12:26 - 2014-05-01 12:26 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsJava
2014-05-01 12:26 - 2014-05-01 12:23 - 00005883 _____ () D:WindowsSysWOW64jupdate-1.7.0_55-b14.log
2014-05-01 12:26 - 2013-02-02 20:20 - 00000000 ____D () D:Program Files (x86)Java
2014-04-29 17:01 - 2014-05-03 11:27 - 23547904 _____ (Microsoft Corporation) D:Windowssystem32mshtml.dll
2014-04-29 16:40 - 2014-05-03 11:27 - 02724864 _____ (Microsoft Corporation) D:Windowssystem32mshtml.tlb
2014-04-29 15:48 - 2014-05-03 11:27 - 17384448 _____ (Microsoft Corporation) D:WindowsSysWOW64mshtml.dll
2014-04-29 15:34 - 2014-05-03 11:27 - 02724864 _____ (Microsoft Corporation) D:WindowsSysWOW64mshtml.tlb
2014-04-27 17:55 - 2014-01-31 19:18 - 00000000 ____D () D:UsersвалентинAppDataLocalAdobe
2014-04-26 10:23 - 2014-01-29 17:31 - 00001256 __RSH () D:ProgramDatantuser.pol
2014-04-24 12:24 - 2014-04-25 10:42 - 00061112 _____ (StdLib) D:Windowssystem32Drivers{ce2cc6b9-0133-4405-9775-8944501dc17c}w64.sys
2014-04-21 13:19 - 2012-01-29 13:26 - 00000000 ____D () D:DTEXT23
2014-04-19 09:41 - 2013-01-26 17:40 - 00000000 ___RD () D:Program Files (x86)Skype
2014-04-16 14:48 - 2014-04-16 14:48 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsLogMeIn Hamachi
2014-04-16 14:48 - 2014-04-16 14:48 - 00000000 ____D () D:Program Files (x86)LogMeIn Hamachi
2014-04-15 08:19 - 2009-07-14 06:20 - 00000000 ____D () D:WindowsSysWOW64bg-BG
2014-04-15 08:19 - 2009-07-14 06:20 - 00000000 ____D () D:Windowssystem32bg-BG
2014-04-15 08:19 - 2009-07-14 06:20 - 00000000 ____D () D:WindowsPolicyDefinitions
2014-04-14 20:13 - 2014-05-01 12:26 - 00096168 _____ (Oracle Corporation) D:WindowsSysWOW64WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-05-01 12:26 - 00264616 _____ (Oracle Corporation) D:WindowsSysWOW64javaws.exe
2014-04-14 20:05 - 2014-05-01 12:26 - 00175528 _____ (Oracle Corporation) D:WindowsSysWOW64javaw.exe
2014-04-14 20:04 - 2014-05-01 12:26 - 00175016 _____ (Oracle Corporation) D:WindowsSysWOW64java.exe
2014-04-13 13:26 - 2009-07-14 08:13 - 00779266 _____ () D:Windowssystem32PerfStringBackup.INI
2014-04-12 19:29 - 2013-06-30 16:44 - 00000000 ____D () D:po
2014-04-11 12:22 - 2013-07-02 15:08 - 00000000 ____D () D:UsersвалентинDocumentsMy Games
2014-04-11 12:21 - 2014-04-11 12:18 - 00000000 ____D () D:ProgramDataMicrosoftWindowsStart MenuProgramsHalo Combat Evolved
2014-04-11 12:21 - 2014-01-10 21:18 - 00000000 ____D () D:UsersвалентинAppDataRoamingMicrosoftWindowsStart MenuProgramsGames
2014-04-11 12:18 - 2014-04-11 12:18 - 00000000 ____D () D:Program Files (x86)Bungie

Files to move or delete:
====================
D:UsersвалентинPortable Microsoft Office 2003.exe


Some content of TEMP:
====================
D:UsersвалентинAppDataLocalTempAskPIP_FF_.exe
D:UsersвалентинAppDataLocalTempBackupSetup.exe
D:UsersвалентинAppDataLocalTempfp_pl_pfs_installer-1.exe
D:UsersвалентинAppDataLocalTempfp_pl_pfs_installer.exe
D:UsersвалентинAppDataLocalTempGoogleSetup.exe
D:UsersвалентинAppDataLocalTemphtmlayout.dll
D:UsersвалентинAppDataLocalTempInstHelper.exe
D:UsersвалентинAppDataLocalTempjre-7u55-windows-i586-iftw.exe
D:UsersвалентинAppDataLocalTempntdll_dump.dll
D:UsersвалентинAppDataLocalTempQuarantine.exe
D:UsersвалентинAppDataLocalTempsiinst.exe
D:UsersвалентинAppDataLocalTempSkypeSetup.exe
D:UsersвалентинAppDataLocalTempstrings.dll
D:UsersвалентинAppDataLocalTempswt-win32-3349.dll
D:UsersвалентинAppDataLocalTemptoolbar3003814.exe
D:UsersвалентинAppDataLocalTempuninst1.exe
D:UsersвалентинAppDataLocalTempvcredist_x64.exe
D:UsersвалентинAppDataLocalTempwget.exe


==================== Bamital & volsnap Check =================

D:WindowsSystem32winlogon.exe => MD5 is legit
D:WindowsSystem32wininit.exe => MD5 is legit
D:WindowsSysWOW64wininit.exe => MD5 is legit
D:Windowsexplorer.exe => MD5 is legit
D:WindowsSysWOW64explorer.exe => MD5 is legit
D:WindowsSystem32svchost.exe => MD5 is legit
D:WindowsSysWOW64svchost.exe => MD5 is legit
D:WindowsSystem32services.exe => MD5 is legit
D:WindowsSystem32User32.dll => MD5 is legit
D:WindowsSysWOW64User32.dll => MD5 is legit
D:WindowsSystem32userinit.exe => MD5 is legit
D:WindowsSysWOW64userinit.exe => MD5 is legit
D:WindowsSystem32rpcss.dll => MD5 is legit
D:WindowsSystem32Driversvolsnap.sys => MD5 is legit


LastRegBack: 2014-04-02 15:51

==================== End Of Log ============================

Редактирано от The Man Of Steel (преглед на промените)

Пропуснали сте да публикувате файла Addition.txt ..!Между другото как се държи системата ви след процедурите до тук..?

Публикувано изображение  Моля, изтеглете Malwarebytes Anti -Malware и го запомнете на вашия работен плот .
  Кликнете два пъти върху mbam-setup-consumer-2.0.0.1000.exe и следвайте инструкциите, за да инсталирате програмата .
  В краяна инсатлацията  , трябва да има отметка на следното :

  • [*]Launch Malwarebytes Anti-Malware (Стартиране на Malwarebytes Anti -Malware) [*]14-дневен пробен период  е предварително избран . Можете да премахнете отметката от това, ако желаете, това няма да се ограничи възможностите за сканиране и премахване на програмата.

Щракнете върху Finish.

  • [*]В секцията
Settings = > Detection and Protection => Detection Options, се поставя отметка в квадратчето 'Scan for rootkits'. [*]В главния прозорец на програмата , щракнете върху 'Update Now' [*]След актуализацията завърши, кликнете на бутона " 'Scan Now  " . [*]Ако има налична актуализация , щракнете върху бутона Update Now button . [*]Ще стартира Threat Scan. [*]Когато сканирането приключи, ако има някакви открити зарази , щракнете върху Apply Actions за да се позволи на Mbam да почисти засеченото. . [*]В повечето случаи , ще се изиска рестартиране [*]   След рестарта ,стартирайте Mbam още веднъж. [*]   Кликнете на History tab > Application Logs . [*]   Кликнете два пъти върху реда , който показва датата и часа на сканирането . [*]   Кликнете върху " Copy to Clipboard " [*]   Поставете  съдържанието на клипборда в следващия си  отговор.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.