Днес попаднах на един лаптоп с антивирусна eset Endpoint security. Вчера ползвателя на компютъра е отворил някакъв линк и антивирусната му постоянно открива вирус spy.zbot.yw. Изписва че го изтрива, но явно не успява понеже през 1 час антивирусната пак го открива.

Постоянно спира различни програми, като: Outlook, IE, Mozilla

Ето логовете от FRST

 

FRST

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2014 01

Ran by Kremena Georgieva (administrator) on AVANTYS-LPC on 09-05-2014 13:47:26

Running from C:UsersKremena GeorgievaDesktop

Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

 

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(Enigma Software Group USA, LLC.) C:Program FilesEnigma Software GroupSpyHunterSH4Service.exe

(NVIDIA Corporation) C:WindowsSystem32nvvsvc.exe

(NVIDIA Corporation) C:Program Files (x86)NVIDIA Corporation3D VisionnvSCPAPISvr.exe

(IDT, Inc.) C:Program FilesIDTWDMstacsv64.exe

(NVIDIA Corporation) C:Program FilesNVIDIA CorporationDisplayNvXDSync.exe

(NVIDIA Corporation) C:WindowsSystem32nvvsvc.exe

(Microsoft Corporation) C:WindowsSystem32wlanext.exe

(ABBYY (BIT Software)) C:Program Files (x86)ABBYY FineReader 9.0NetworkLicenseServer.exe

(Andrea Electronics Corporation) C:Program FilesIDTWDMAESTSr64.exe

(Microsoft Corporation) C:Program Files (x86)SkypeToolbarsAutoUpdateSkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:Program Files (x86)SkypeToolbarsPNRSvcSkypeC2CPNRSvc.exe

(ESET) C:Program FilesESETESET NOD32 Antivirusx86ekrn.exe

(Intel® Corporation) C:Program FilesIntelWiFibinEvtEng.exe

(COMPANYVERS_NAME) C:Program Files (x86)FromDocToPDF_65bar1.bin65barsvc.exe

() C:WindowsSysWOW64FUSServices.exe

(HP) C:Program Files (x86)HPHPLaserJetServiceHPLaserJetService.exe

(HP) C:WindowsSystem32HPSIsvc.exe

(Intel® Corporation) C:Program FilesCommon FilesIntelWirelessCommonRegSrvc.exe

(TeamViewer GmbH) C:Program Files (x86)TeamViewerVersion8TeamViewer_Service.exe

(Intel Corporation) C:WindowsSystem32igfxtray.exe

(Intel Corporation) C:WindowsSystem32igfxpers.exe

(Alps Electric Co., Ltd.) C:Program FilesDellTPadApoint.exe

(Alps Electric Co., Ltd.) C:Program FilesDellTPadApMsgFwd.exe

(Dell Inc.) C:Program FilesDellQuickSetquickset.exe

(Synaptics Incorporated) C:Program FilesSynapticsSynTPSynTPEnh.exe

(Alps Electric Co., Ltd.) C:Program FilesDellTPadhidfind.exe

(Alps Electric Co., Ltd.) C:Program FilesDellTPadApntEx.exe

(IDT, Inc.) C:Program FilesIDTWDMsttray64.exe

(Intel Corporation) C:WindowsSystem32hkcmd.exe

(Intel® Corporation) C:Program FilesCommon FilesIntelWirelessCommoniFrmewrk.exe

(ESET) C:Program FilesESETESET NOD32 Antivirusegui.exe

() C:Program Files (x86)FromDocToPDF_65bar1.binAppIntegrator64.exe

(Nero AG) C:Program Files (x86)Common FilesNeroLibNMIndexStoreSvr.exe

(Synaptics Incorporated) C:Program Files (x86)SynapticsScrybescrybe.exe

(Renesas Electronics Corporation) C:Program Files (x86)Renesas ElectronicsUSB 3.0 Host Controller DriverApplicationnusb3mon.exe

(Intel Corporation) C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe

(Nero AG) C:Program Files (x86)Common FilesNeroLibNMIndexingService.exe

(NVIDIA Corporation) C:Program FilesNVIDIA CorporationDisplaynvtray.exe

(Microsoft Corporation) C:Program FilesCommon FilesMicrosoft SharedOfficeSoftwareProtectionPlatformOSPPSVC.EXE

(Intel Corporation) C:Program FilesIntelBluetoothHSBTHSAmpPalService.exe

(Intel® Corporation) C:Program FilesIntelBluetoothHSBTHSSecurityMgr.exe

(Intel Corporation) C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorDataMgrSvc.exe

(Intel Corporation) C:Program Files (x86)IntelIntel® Management Engine ComponentsLMSLMS.exe

(Intel Corporation) C:Program Files (x86)IntelIntel® Management Engine ComponentsUNSUNS.exe

(Google) C:UsersKremena GeorgievaAppDataLocalGoogleGoogle Talk Plugingoogletalkplugin.exe

(Malwarebytes Corporation) C:Program Files (x86)Malwarebytes Anti-Malwarembam.exe

(Microsoft Corporation) C:Program Files (x86)Common Filesmicrosoft sharedDWDW20.EXE

(Skype Technologies S.A.) C:Program Files (x86)SkypePhoneSkype.exe

(TeamViewer GmbH) C:Program Files (x86)TeamViewerVersion8TeamViewer.exe

(TeamViewer GmbH) C:Program Files (x86)TeamViewerVersion8tv_w32.exe

(TeamViewer GmbH) C:Program Files (x86)TeamViewerVersion8tv_x64.exe

(TeamViewer GmbH) C:Program Files (x86)TeamViewerVersion8TeamViewer_Desktop.exe

(Microsoft Corporation) C:Program FilesInternet Exploreriexplore.exe

 

 

==================== Registry (Whitelisted) ==================

 

HKLM...Run: [Apoint] => C:Program FilesDellTPadApoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.)

HKLM...Run: [intelTBRunOnce] => wscript.exe //b //nologo "C:Program FilesIntelTurboBoostRunTBGadgetOnce.vbs"

HKLM...Run: [QuickSet] => C:Program FilesDellQuickSetQuickSet.exe [3668336 2011-03-24] (Dell Inc.)

HKLM...Run: [synTPEnh] => C:Program FilesSynapticsSynTPSynTPEnh.exe [2735400 2011-03-31] (Synaptics Incorporated)

HKLM...Run: [sysTrayApp] => C:Program FilesIDTWDMsttray64.exe [525312 2011-01-25] (IDT, Inc.)

HKLM...Run: [intelPROSet] => C:Program FilesCommon FilesIntelWirelessCommoniFrmewrk.exe [1935120 2012-01-04] (Intel® Corporation)

HKLM...Run: [egui] => C:Program FilesESETESET NOD32 Antivirusegui.exe [4144944 2013-02-14] (ESET)

HKLM...Run: [FromDocToPDF Home Page Guard 64 bit] => C:Program Files (x86)FromDocToPDF_65bar1.binAppIntegrator64.exe [548936 2013-10-02] ()

HKLM-x32...Run: [NUSB3MON] => C:Program Files (x86)Renesas ElectronicsUSB 3.0 Host Controller DriverApplicationnusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32...Run: [iAStorIcon] => C:Program Files (x86)IntelIntel® Rapid Storage TechnologyIAStorIcon.exe [283160 2010-11-05] (Intel Corporation)

HKLM-x32...Run: [PWRISOVM.EXE] => C:Program Files (x86)PowerISOPWRISOVM.EXE [307200 2011-06-15] (PowerISO Computing, Inc.)

HKLM-x32...Run: [] => [X]

HKLM-x32...Run: [HPUsageTrackingLEDM] => C:Program Files (x86)HPHP UT LEDMbinhppusg.exe [30264 2009-10-15] (Hewlett-Packard Company)

HKLM-x32...Run: [FromDocToPDF Search Scope Monitor] => C:Program Files (x86)FromDocToPDF_65bar1.bin65SrchMn.exe [44784 2013-10-02] (MindSpark)

WinlogonNotifyigfxcui: C:Windowssystem32igfxdev.dll (Intel Corporation)

HKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:Program Files (x86)Common FilesNeroLibNMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)

HKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [Google Update] => C:UsersKremena GeorgievaAppDataLocalGoogleUpdateGoogleUpdate.exe [136176 2011-09-02] (Google Inc.)

HKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [internet Security] => C:ProgramDataildefender.exe

HKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [skype] => C:Program Files (x86)SkypePhoneSkype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

HKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [dufy.exe] => C:UsersKremena GeorgievaAppDataRoamingUxmidufy.exe [0 2014-05-09] ()

HKUS-1-5-21-1639035527-594000354-161818179-1000...MountPoints2: F - F:OriginInstaller.exe

HKUS-1-5-21-1639035527-594000354-161818179-1000...MountPoints2: {4194b8eb-d5ea-11e0-a8cc-bc77373ea80e} - G:setup_vmb_lite.exe /checkApplicationPresence

HKUS-1-5-21-1639035527-594000354-161818179-1000...MountPoints2: {4194b8fb-d5ea-11e0-a8cc-bc77373ea80e} - G:setup_vmc_lite.exe /checkApplicationPresence

HKUS-1-5-21-1639035527-594000354-161818179-1000...MountPoints2: {4194b900-d5ea-11e0-a8cc-bc77373ea80e} - G:setup_vmc_lite.exe /checkApplicationPresence

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:Program Files (x86)Common FilesNeroLibNMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Run: [Google Update] => C:UsersKremena GeorgievaAppDataLocalGoogleUpdateGoogleUpdate.exe [136176 2011-09-02] (Google Inc.)

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Run: [internet Security] => C:ProgramDataildefender.exe

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Run: [skype] => C:Program Files (x86)SkypePhoneSkype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: F - F:OriginInstaller.exe

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: {4194b8eb-d5ea-11e0-a8cc-bc77373ea80e} - G:setup_vmb_lite.exe /checkApplicationPresence

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: {4194b8fb-d5ea-11e0-a8cc-bc77373ea80e} - G:setup_vmc_lite.exe /checkApplicationPresence

HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: {4194b900-d5ea-11e0-a8cc-bc77373ea80e} - G:setup_vmc_lite.exe /checkApplicationPresence

HKUS-1-5-21-1639035527-594000354-161818179-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Run: [skype] => C:Program Files (x86)SkypePhoneSkype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

HKUS-1-5-21-1639035527-594000354-161818179-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Policiessystem: [DisableLockWorkstation] 0

HKUS-1-5-21-1639035527-594000354-161818179-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: G - G:DriverPackSolution.exe

HKUS-1-5-21-1639035527-594000354-161818179-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: {6187428b-a310-11e1-b0de-bc77373ea80e} - G:SISetup.exe

HKUS-1-5-21-1639035527-594000354-161818179-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...MountPoints2: {618742ac-a310-11e1-b0de-bc77373ea80e} - G:SISetup.exe

AppInit_DLLs: C:Windowssystem32nvinitx.dll => C:Windowssystem32nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)

AppInit_DLLs-x32: C:WindowsSysWOW64nvinit.dll => C:WindowsSysWOW64nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)

Startup: C:ProgramDataMicrosoftWindowsStart MenuProgramsStartupScrybe.lnk

ShortcutTarget: Scrybe.lnk -> C:WindowsInstaller{147DFAD8-34C3-4DE1-9FCA-ACEFDE9EF810}NewShortcut11_8ACB210B42E44145A8C31F8E3DD765A3.exe (Acresso Software Inc.)

 

==================== Internet (Whitelisted) ====================

 

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page Redirect Cache_TIMESTAMP = 0x6DC78D5E1431CE01

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page Redirect Cache AcceptLangs = bg-BG

HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.bg/

URLSearchHook: HKCU - (No Name) - {96f454ea-9d38-474f-b504-56193e00c1a5} - No File

SearchScopes: HKLM-x32 - DefaultScope {5245D202-A352-4632-81D5-B71195D794E9} URL = 

BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:Program FilesMicrosoft OfficeOffice14URLREDIR.DLL (Microsoft Corporation)

BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:Program Files (x86)Hotspot ShieldHssIEHssIE_64.dll No File

BHO-x32: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program Files (x86)Common FilesAdobeAcrobatActiveXAcroIEHelper.dll (Adobe Systems Incorporated)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program Files (x86)Javajre6binssv.dll (Sun Microsystems, Inc.)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:Program Files (x86)AdobeAcrobat 8.0AcrobatAcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:Program Files (x86)SkypeToolbarsInternet ExplorerSkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:Program Files (x86)Microsoft OfficeOffice14URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program Files (x86)Javajre6binjp2ssv.dll (Sun Microsystems, Inc.)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:Program Files (x86)AdobeAcrobat 8.0AcrobatAcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {96F454EA-9D38-474F-B504-56193E00C1A5} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} -  No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:Program Files (x86)SkypeToolbarsInternet Explorer x64skypeieplugin.dll (Microsoft Corporation)

Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:Program Files (x86)BelarcAdvisorSystemBAVoilaX.dll (Belarc, Inc.)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:Program Files (x86)SkypeToolbarsInternet ExplorerSkypeIEPlugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:Program Files (x86)Common FilesSkypeSkype4COM.dll (Skype Technologies)

TcpipParameters: [DhcpNameServer] 192.168.0.1

Tcpip..Interfaces{723903CB-F96D-4D6F-9FD9-B4E8ED979191}: [NameServer]0.0.0.0

 

FireFox:

========

FF ProfilePath: C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.default

FF DefaultSearchEngine: uTorrentControl_v6 Customized Web Search

FF SelectedSearchEngine: uTorrentControl_v6 Customized Web Search

FF Homepage: about:home

FF Keyword.URL: hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=370858F4-7C20-4B75-B1EA-B1C50A43C025&n=77fd78b7&ind=2013100215&p2=^Y6^xdm007^YYA^bg&si=CKDIvOeR-LkCFcmV3godrlUA-g&searchfor=

FF Plugin: @adobe.com/FlashPlayer - C:Windowssystem32MacromedFlashNPSWF64_13_0_0_206.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:Program FilesMicrosoft Silverlight5.1.30214.0npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:PROGRA~1MICROS~1Office14NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:WindowsSysWOW64MacromedFlashNPSWF32_13_0_0_206.dll ()

FF Plugin-x32: @FromDocToPDF_65.com/Plugin - C:Program Files (x86)FromDocToPDF_65bar1.binNP65Stub.dll (MindSpark)

FF Plugin-x32: @java.com/JavaPlugin - C:Program Files (x86)Javajre6binplugin2npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:Program Files (x86)Microsoft Silverlight5.1.30214.0npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:PROGRA~2MICROS~1Office14NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:PROGRA~2MICROS~1Office14NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:Program Files (x86)NVIDIA Corporation3D Visionnpnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:UsersKremena GeorgievaAppDataRoamingMozillapluginsnpgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin - C:UsersKremena GeorgievaAppDataRoamingMozillapluginsnpo1d.dll (Google)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:UsersKremena GeorgievaAppDataLocalGoogleUpdate1.3.23.9npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:UsersKremena GeorgievaAppDataLocalGoogleUpdate1.3.23.9npGoogleUpdate3.dll (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:Program Files (x86)mozilla firefoxpluginsnpBitCometAgent.dll (BitComet)

FF Plugin ProgramFiles/Appdata: C:Program Files (x86)mozilla firefoxpluginsnpdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin ProgramFiles/Appdata: C:Program Files (x86)mozilla firefoxpluginsnppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:UsersKremena GeorgievaAppDataRoamingmozillapluginsnpgoogletalk.dll (Google)

FF Plugin ProgramFiles/Appdata: C:UsersKremena GeorgievaAppDataRoamingmozillapluginsnpo1d.dll (Google)

FF SearchPlugin: C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultsearchpluginsask-web-search.xml

FF SearchPlugin: C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultsearchpluginsutorrentcontrolv6-customized-web-search.xml

FF Extension: FromDocToPDF - C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultExtensions65ffxtbr@FromDocToPDF_65.com [2014-05-09]

FF Extension: Skype Click to Call - C:Program Files (x86)Mozilla Firefoxbrowserextensions{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-08]

FF HKLM...ThunderbirdExtensions: [[email protected]] - C:Program FilesESETESET NOD32 AntivirusMozilla Thunderbird

FF Extension: ESET Endpoint Security Extension - C:Program FilesESETESET NOD32 AntivirusMozilla Thunderbird [2013-06-18]

FF HKLM-x32...FirefoxExtensions: [65ffxtbr@FromDocToPDF_65.com] - C:Program Files (x86)FromDocToPDF_65bar1.bin

FF Extension: FromDocToPDF - C:Program Files (x86)FromDocToPDF_65bar1.bin [2013-10-02]

FF HKLM-x32...ThunderbirdExtensions: [[email protected]] - C:Program FilesESETESET NOD32 AntivirusMozilla Thunderbird

FF Extension: ESET Endpoint Security Extension - C:Program FilesESETESET NOD32 AntivirusMozilla Thunderbird [2013-06-18]

 

Chrome: 

=======

CHR HomePage: hxxp://search.conduit.com/?ctid=CT3289075&SearchSource=48&CUI=UN42719476852070012&UM=1

CHR RestoreOnStartup: "hxxp://search.conduit.com/?ctid=CT3289075&SearchSource=48&CUI=UN42719476852070012&UM=1]},"spdy":{"servers":["googleads.g.doubleclick.net:443","toolbarqueries.google.com:443","clients2.google.com:443"]},"tabs":{"use_compact_navigation_bar":false,"use_vertical_tabs":false},"translate_accepted_count":{"de":1,"en":0},"translate_denied_count":{"de":0,"en":8},"translate_language_blacklist":["en"

CHR Extension: (No Name) - C:UsersKremena GeorgievaAppDataLocalGoogleChromeUser DataDefaultExtensionscflheckfmhopnialghigdlggahiomebp [2013-04-04]

CHR HKCU...ChromeExtension: [cflheckfmhopnialghigdlggahiomebp] - C:UsersKremena GeorgievaAppDataLocalCREcflheckfmhopnialghigdlggahiomebp.crx [2013-03-27]

CHR HKLM-x32...ChromeExtension: [cflheckfmhopnialghigdlggahiomebp] - C:UsersKremena GeorgievaAppDataLocalCREcflheckfmhopnialghigdlggahiomebp.crx [2013-03-27]

CHR HKLM-x32...ChromeExtension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:Program Files (x86)SkypeToolbarsChromeExtensionskype_chrome_extension.crx [2014-03-03]

CHR StartMenuInternet: Google Chrome - C:UsersKremena GeorgievaAppDataLocalGoogleChromeApplicationchrome.exe

 

==================== Services (Whitelisted) =================

 

R2 ABBYY.Licensing.FineReader.Professional.9.0; C:Program Files (x86)ABBYY FineReader 9.0NetworkLicenseServer.exe [566560 2007-09-24] (ABBYY (BIT Software))

R2 c2cautoupdatesvc; C:Program Files (x86)SkypeToolbarsAutoUpdateSkypeC2CAutoUpdateSvc.exe [1363584 2014-03-03] (Microsoft Corporation)

R2 c2cpnrsvc; C:Program Files (x86)SkypeToolbarsPNRSvcSkypeC2CPNRSvc.exe [1748608 2014-03-03] (Microsoft Corporation)

S3 EhttpSrv; C:Program FilesESETESET NOD32 AntivirusEHttpSrv.exe [40888 2013-02-14] (ESET)

R2 ekrn; C:Program FilesESETESET NOD32 Antivirusx86ekrn.exe [1020304 2013-02-14] (ESET)

S3 ESHASRV; C:Program FilesESETESET NOD32 AntivirusEShaSrv.exe [190208 2013-02-14] (ESET)

R2 FromDocToPDF_65Service; C:Program Files (x86)FromDocToPDF_65bar1.bin65barsvc.exe [42504 2013-10-02] (COMPANYVERS_NAME)

R2 FUSServices; C:WindowsSysWOW64FUSServices.exe [10752 2009-04-22] ()

S3 MyWiFiDHCPDNS; C:Program FilesIntelWiFibinPanDhcpDns.exe [340240 2012-01-04] ()

R3 NMIndexingService; C:Program Files (x86)Common FilesNeroLibNMIndexingService.exe [529704 2008-02-28] (Nero AG)

S2 ScrybeUpdater; C:Program Files (x86)SynapticsScrybeServiceScrybeUpdater.exe [1300264 2011-05-27] (Synaptics, Inc.)

R2 SpyHunter 4 Service; C:Program FilesEnigma Software GroupSpyHunterSH4Service.exe [1025408 2013-05-07] (Enigma Software Group USA, LLC.)

 

==================== Drivers (Whitelisted) ====================

 

S2 ALIWEHCD; C:WindowsSystem32Driversmfpec.sys [39552 2007-05-06] (None)

S3 AliWGP; C:WindowsSystem32DRIVERSmfpcomp.sys [13184 2007-01-09] (None)

R1 eamonm; C:WindowsSystem32DRIVERSeamonm.sys [217000 2013-02-04] (ESET)

U5 edevmon; C:WindowsSystem32Driversedevmon.sys [183016 2013-04-09] (ESET)

R1 ehdrv; C:WindowsSystem32DRIVERSehdrv.sys [153200 2013-02-04] (ESET)

R2 epfwwfpr; C:WindowsSystem32DRIVERSepfwwfpr.sys [141304 2013-02-04] (ESET)

S3 EsgScanner; C:WindowsSystem32DRIVERSEsgScanner.sys [22704 2012-06-22] ()

S3 FaxLffv2; C:WindowsSystem32DriversFaxLffv2.sys [31232 2008-06-18] (OEM)

R3 MBAMSwissArmy; C:Windowssystem32driversMBAMSwissArmy.sys [119512 2014-05-09] (Malwarebytes Corporation)

S3 mvusbews; C:WindowsSystem32Driversmvusbews.sys [20480 2010-04-28] (Marvell Semiconductor, Inc.)

R1 nvkflt; C:WindowsSystem32DRIVERSnvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)

S3 RimUsb; C:WindowsSystem32DriversRimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

S3 taphss6; C:WindowsSystem32DRIVERStaphss6.sys [42184 2013-02-22] (Anchorfree Inc.)

S3 WUSBVBus; C:WindowsSystem32DRIVERSmfpvbus.sys [12416 2006-10-20] (None)

S3 XMLDIUSB; C:WindowsSystem32DriversXMLDIUSB.sys [55808 2010-01-29] (OEM)

S3 AthBTPort; system32DRIVERSbtath_flt.sys [X]

S3 BTATH_A2DP; system32driversbtath_a2dp.sys [X]

S3 BTATH_BUS; system32DRIVERSbtath_bus.sys [X]

S3 BTATH_HCRP; system32DRIVERSbtath_hcrp.sys [X]

S3 BTATH_LWFLT; system32DRIVERSbtath_lwflt.sys [X]

S3 BTATH_RCP; system32DRIVERSbtath_rcp.sys [X]

S3 btmaudio; system32driversbtmaud.sys [X]

S3 btmaux; system32DRIVERSbtmaux.sys [X]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2014-05-09 13:47 - 2014-05-09 13:48 - 00023407 _____ () C:UsersKremena GeorgievaDesktopFRST.txt

2014-05-09 13:47 - 2014-05-09 13:47 - 00000000 ____D () C:FRST

2014-05-09 13:46 - 2014-05-09 13:46 - 02064384 _____ (Farbar) C:UsersKremena GeorgievaDesktopFRST64.exe

2014-05-09 10:48 - 2014-05-09 10:49 - 00119512 _____ (Malwarebytes Corporation) C:Windowssystem32DriversMBAMSwissArmy.sys

2014-05-09 10:48 - 2014-05-09 10:48 - 00000000 ____D () C:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes Anti-Malware

2014-05-09 10:48 - 2014-05-09 10:48 - 00000000 ____D () C:Program Files (x86)Malwarebytes Anti-Malware

2014-05-09 10:48 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:Windowssystem32Driversmbamchameleon.sys

2014-05-09 10:48 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:Windowssystem32Driversmwac.sys

2014-05-09 10:48 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:Windowssystem32Driversmbam.sys

2014-05-08 14:36 - 2014-05-07 18:44 - 00156783 _____ () C:UsersKremena GeorgievaDesktopflipper.swf

2014-05-08 14:33 - 2014-05-08 14:33 - 00000000 ____D () C:UsersKremena GeorgievaDesktopInterton_2014

2014-05-08 14:32 - 2014-05-08 14:34 - 13142453 _____ () C:UsersKremena GeorgievaDesktopInterton_2014.rar

2014-05-08 14:30 - 2014-05-08 14:30 - 00000000 ____D () C:UsersKremena GeorgievaDesktopEuropeanColorCosmeticPackaging

2014-05-08 14:28 - 2014-05-08 14:35 - 13142453 _____ () C:UsersKremena GeorgievaDesktopEuropeanColorCosmeticPackaging.rar

2014-05-08 14:23 - 2014-05-09 12:41 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingIwbeis

2014-05-08 14:23 - 2014-05-09 12:40 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingUxmi

2014-05-08 08:54 - 2014-05-08 08:54 - 00000000 ___SD () C:Windowssystem32CompatTel

2014-05-06 09:27 - 2014-04-14 05:24 - 00465408 _____ (Microsoft Corporation) C:Windowssystem32aepdu.dll

2014-05-06 09:27 - 2014-04-14 05:19 - 00424448 _____ (Microsoft Corporation) C:Windowssystem32aeinv.dll

2014-05-03 05:20 - 2014-04-29 17:01 - 23547904 _____ (Microsoft Corporation) C:Windowssystem32mshtml.dll

2014-05-03 05:20 - 2014-04-29 15:48 - 17384448 _____ (Microsoft Corporation) C:WindowsSysWOW64mshtml.dll

2014-05-03 05:19 - 2014-04-29 16:40 - 02724864 _____ (Microsoft Corporation) C:Windowssystem32mshtml.tlb

2014-05-03 05:19 - 2014-04-29 15:34 - 02724864 _____ (Microsoft Corporation) C:WindowsSysWOW64mshtml.tlb

2014-04-21 12:51 - 2014-04-21 12:51 - 00000000 __SHD () C:UsersKremena GeorgievaAppDataLocalEmieUserList

2014-04-21 12:51 - 2014-04-21 12:51 - 00000000 __SHD () C:UsersKremena GeorgievaAppDataLocalEmieSiteList

2014-04-21 11:29 - 2014-03-06 12:31 - 00004096 _____ (Microsoft Corporation) C:Windowssystem32ieetwcollectorres.dll

2014-04-21 11:29 - 2014-03-06 11:59 - 00066048 _____ (Microsoft Corporation) C:Windowssystem32iesetup.dll

2014-04-21 11:29 - 2014-03-06 11:57 - 00548352 _____ (Microsoft Corporation) C:Windowssystem32vbscript.dll

2014-04-21 11:29 - 2014-03-06 11:57 - 00048640 _____ (Microsoft Corporation) C:Windowssystem32ieetwproxystub.dll

2014-04-21 11:29 - 2014-03-06 11:40 - 00051200 _____ (Microsoft Corporation) C:Windowssystem32jsproxy.dll

2014-04-21 11:29 - 2014-03-06 11:39 - 00033792 _____ (Microsoft Corporation) C:Windowssystem32iernonce.dll

2014-04-21 11:29 - 2014-03-06 11:32 - 00574976 _____ (Microsoft Corporation) C:Windowssystem32ieui.dll

2014-04-21 11:29 - 2014-03-06 11:29 - 00139264 _____ (Microsoft Corporation) C:Windowssystem32ieUnatt.exe

2014-04-21 11:29 - 2014-03-06 11:29 - 00111616 _____ (Microsoft Corporation) C:Windowssystem32ieetwcollector.exe

2014-04-21 11:29 - 2014-03-06 11:28 - 00752640 _____ (Microsoft Corporation) C:Windowssystem32jscript9diag.dll

2014-04-21 11:29 - 2014-03-06 11:15 - 00940032 _____ (Microsoft Corporation) C:Windowssystem32MsSpellCheckingFacility.exe

2014-04-21 11:29 - 2014-03-06 11:09 - 00453120 _____ (Microsoft Corporation) C:Windowssystem32dxtmsft.dll

2014-04-21 11:29 - 2014-03-06 11:03 - 00586240 _____ (Microsoft Corporation) C:Windowssystem32ie4uinit.exe

2014-04-21 11:29 - 2014-03-06 11:02 - 00455168 _____ (Microsoft Corporation) C:WindowsSysWOW64vbscript.dll

2014-04-21 11:29 - 2014-03-06 11:02 - 00061952 _____ (Microsoft Corporation) C:WindowsSysWOW64iesetup.dll

2014-04-21 11:29 - 2014-03-06 11:01 - 00051200 _____ (Microsoft Corporation) C:WindowsSysWOW64ieetwproxystub.dll

2014-04-21 11:29 - 2014-03-06 10:56 - 00038400 _____ (Microsoft Corporation) C:Windowssystem32JavaScriptCollectionAgent.dll

2014-04-21 11:29 - 2014-03-06 10:48 - 00195584 _____ (Microsoft Corporation) C:Windowssystem32msrating.dll

2014-04-21 11:29 - 2014-03-06 10:46 - 00043008 _____ (Microsoft Corporation) C:WindowsSysWOW64jsproxy.dll

2014-04-21 11:29 - 2014-03-06 10:45 - 00032768 _____ (Microsoft Corporation) C:WindowsSysWOW64iernonce.dll

2014-04-21 11:29 - 2014-03-06 10:42 - 00296960 _____ (Microsoft Corporation) C:Windowssystem32dxtrans.dll

2014-04-21 11:29 - 2014-03-06 10:40 - 00440832 _____ (Microsoft Corporation) C:WindowsSysWOW64ieui.dll

2014-04-21 11:29 - 2014-03-06 10:38 - 00112128 _____ (Microsoft Corporation) C:WindowsSysWOW64ieUnatt.exe

2014-04-21 11:29 - 2014-03-06 10:36 - 00592896 _____ (Microsoft Corporation) C:WindowsSysWOW64jscript9diag.dll

2014-04-21 11:29 - 2014-03-06 10:22 - 00367616 _____ (Microsoft Corporation) C:WindowsSysWOW64dxtmsft.dll

2014-04-21 11:29 - 2014-03-06 10:21 - 00628736 _____ (Microsoft Corporation) C:Windowssystem32msfeeds.dll

2014-04-21 11:29 - 2014-03-06 10:13 - 00032256 _____ (Microsoft Corporation) C:WindowsSysWOW64JavaScriptCollectionAgent.dll

2014-04-21 11:29 - 2014-03-06 10:07 - 00164864 _____ (Microsoft Corporation) C:WindowsSysWOW64msrating.dll

2014-04-21 11:29 - 2014-03-06 10:01 - 00244224 _____ (Microsoft Corporation) C:WindowsSysWOW64dxtrans.dll

2014-04-21 11:29 - 2014-03-06 09:46 - 00524288 _____ (Microsoft Corporation) C:WindowsSysWOW64msfeeds.dll

2014-04-21 11:29 - 2014-03-06 08:50 - 00846336 _____ (Microsoft Corporation) C:Windowssystem32ieapfltr.dll

2014-04-21 11:29 - 2014-03-06 08:43 - 00704512 _____ (Microsoft Corporation) C:WindowsSysWOW64ieapfltr.dll

2014-04-21 07:23 - 2014-03-06 11:53 - 02767360 _____ (Microsoft Corporation) C:Windowssystem32iertutil.dll

2014-04-21 07:23 - 2014-03-06 10:47 - 02178048 _____ (Microsoft Corporation) C:WindowsSysWOW64iertutil.dll

2014-04-21 07:23 - 2014-03-06 08:41 - 01789440 _____ (Microsoft Corporation) C:WindowsSysWOW64wininet.dll

2014-04-21 07:22 - 2014-03-06 11:11 - 05784064 _____ (Microsoft Corporation) C:Windowssystem32jscript9.dll

2014-04-21 07:22 - 2014-03-06 10:46 - 04254720 _____ (Microsoft Corporation) C:WindowsSysWOW64jscript9.dll

2014-04-21 07:22 - 2014-03-06 10:11 - 02043904 _____ (Microsoft Corporation) C:Windowssystem32inetcpl.cpl

2014-04-21 07:22 - 2014-03-06 09:53 - 13551104 _____ (Microsoft Corporation) C:Windowssystem32ieframe.dll

2014-04-21 07:22 - 2014-03-06 09:40 - 01967104 _____ (Microsoft Corporation) C:WindowsSysWOW64inetcpl.cpl

2014-04-21 07:22 - 2014-03-06 09:36 - 11745792 _____ (Microsoft Corporation) C:WindowsSysWOW64ieframe.dll

2014-04-21 07:22 - 2014-03-06 09:22 - 02260480 _____ (Microsoft Corporation) C:Windowssystem32wininet.dll

2014-04-21 07:22 - 2014-03-06 08:58 - 01400832 _____ (Microsoft Corporation) C:Windowssystem32urlmon.dll

2014-04-21 07:22 - 2014-03-06 08:36 - 01143808 _____ (Microsoft Corporation) C:WindowsSysWOW64urlmon.dll

2014-04-10 13:33 - 2014-03-04 12:44 - 01163264 _____ (Microsoft Corporation) C:Windowssystem32kernel32.dll

2014-04-10 13:33 - 2014-03-04 12:44 - 00362496 _____ (Microsoft Corporation) C:Windowssystem32wow64win.dll

2014-04-10 13:33 - 2014-03-04 12:44 - 00243712 _____ (Microsoft Corporation) C:Windowssystem32wow64.dll

2014-04-10 13:33 - 2014-03-04 12:44 - 00016384 _____ (Microsoft Corporation) C:Windowssystem32ntvdm64.dll

2014-04-10 13:33 - 2014-03-04 12:44 - 00013312 _____ (Microsoft Corporation) C:Windowssystem32wow64cpu.dll

2014-04-10 13:33 - 2014-03-04 12:17 - 00014336 _____ (Microsoft Corporation) C:WindowsSysWOW64ntvdm64.dll

2014-04-10 13:33 - 2014-03-04 12:16 - 01114112 _____ (Microsoft Corporation) C:WindowsSysWOW64kernel32.dll

2014-04-10 13:33 - 2014-03-04 12:16 - 00025600 _____ (Microsoft Corporation) C:WindowsSysWOW64setup16.exe

2014-04-10 13:33 - 2014-03-04 12:16 - 00005120 _____ (Microsoft Corporation) C:WindowsSysWOW64wow32.dll

2014-04-10 13:33 - 2014-03-04 11:09 - 00007680 _____ (Microsoft Corporation) C:WindowsSysWOW64instnm.exe

2014-04-10 13:33 - 2014-03-04 11:09 - 00002048 _____ (Microsoft Corporation) C:WindowsSysWOW64user.exe

2014-04-10 13:33 - 2014-02-04 05:35 - 00274880 _____ (Microsoft Corporation) C:Windowssystem32Driversmsiscsi.sys

2014-04-10 13:33 - 2014-02-04 05:35 - 00190912 _____ (Microsoft Corporation) C:Windowssystem32Driversstorport.sys

2014-04-10 13:33 - 2014-02-04 05:35 - 00027584 _____ (Microsoft Corporation) C:Windowssystem32DriversDiskdump.sys

2014-04-10 13:33 - 2014-02-04 05:28 - 00002048 _____ (Microsoft Corporation) C:Windowssystem32iologmsg.dll

2014-04-10 13:33 - 2014-02-04 05:00 - 00002048 _____ (Microsoft Corporation) C:WindowsSysWOW64iologmsg.dll

2014-04-10 13:33 - 2014-01-24 05:37 - 01684928 _____ (Microsoft Corporation) C:Windowssystem32Driversntfs.sys

 

==================== One Month Modified Files and Folders =======

 

2014-05-09 13:48 - 2014-05-09 13:47 - 00023407 _____ () C:UsersKremena GeorgievaDesktopFRST.txt

2014-05-09 13:47 - 2014-05-09 13:47 - 00000000 ____D () C:FRST

2014-05-09 13:46 - 2014-05-09 13:46 - 02064384 _____ (Farbar) C:UsersKremena GeorgievaDesktopFRST64.exe

2014-05-09 13:40 - 2011-09-02 16:31 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingSkype

2014-05-09 13:37 - 2014-04-03 09:32 - 00001056 _____ () C:WindowsTasksGoogleUpdateTaskUserS-1-5-21-1639035527-594000354-161818179-1000UA1cf4f06770d21cf.job

2014-05-09 13:36 - 2012-07-22 22:25 - 00000830 _____ () C:WindowsTasksAdobe Flash Player Updater.job

2014-05-09 13:16 - 2011-09-06 20:05 - 00000000 ____D () C:UsersKremena GeorgievaAppDataLocalCrashDumps

2014-05-09 13:16 - 2011-09-03 09:04 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingTeamViewer

2014-05-09 13:14 - 2013-12-20 12:00 - 00020923 _____ () C:UsersKremena GeorgievaDesktop2014.xlsx

2014-05-09 12:42 - 2009-07-14 08:13 - 00006446 _____ () C:Windowssystem32PerfStringBackup.INI

2014-05-09 12:41 - 2014-05-08 14:23 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingIwbeis

2014-05-09 12:40 - 2014-05-08 14:23 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingUxmi

2014-05-09 12:40 - 2009-07-14 06:20 - 00000000 ____D () C:Windowstracing

2014-05-09 10:49 - 2014-05-09 10:48 - 00119512 _____ (Malwarebytes Corporation) C:Windowssystem32DriversMBAMSwissArmy.sys

2014-05-09 10:48 - 2014-05-09 10:48 - 00000000 ____D () C:ProgramDataMicrosoftWindowsStart MenuProgramsMalwarebytes Anti-Malware

2014-05-09 10:48 - 2014-05-09 10:48 - 00000000 ____D () C:Program Files (x86)Malwarebytes Anti-Malware

2014-05-09 10:48 - 2013-06-18 12:55 - 00000000 ____D () C:ProgramDataMalwarebytes

2014-05-09 10:45 - 2009-07-14 07:45 - 00022096 ____H () C:Windowssystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-05-09 10:45 - 2009-07-14 07:45 - 00022096 ____H () C:Windowssystem327B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-05-09 10:38 - 2011-09-04 07:33 - 00000000 ____D () C:WindowsMinidump

2014-05-09 10:30 - 2011-09-02 15:10 - 01962955 _____ () C:WindowsWindowsUpdate.log

2014-05-09 10:04 - 2011-12-07 12:08 - 00000000 ____D () C:UsersKremena GeorgievaAppDataLocalESET

2014-05-09 09:49 - 2011-09-02 19:25 - 00001004 _____ () C:WindowsTasksGoogleUpdateTaskUserS-1-5-21-1639035527-594000354-161818179-1000Core.job

2014-05-08 14:35 - 2014-05-08 14:28 - 13142453 _____ () C:UsersKremena GeorgievaDesktopEuropeanColorCosmeticPackaging.rar

2014-05-08 14:34 - 2014-05-08 14:32 - 13142453 _____ () C:UsersKremena GeorgievaDesktopInterton_2014.rar

2014-05-08 14:33 - 2014-05-08 14:33 - 00000000 ____D () C:UsersKremena GeorgievaDesktopInterton_2014

2014-05-08 14:30 - 2014-05-08 14:30 - 00000000 ____D () C:UsersKremena GeorgievaDesktopEuropeanColorCosmeticPackaging

2014-05-08 14:29 - 2012-08-08 11:45 - 00000000 ____D () C:ProgramDataboost_interprocess

2014-05-08 10:23 - 2013-09-07 12:08 - 00000000 ____D () C:UsersKremena GeorgievaDesktopimages

2014-05-08 09:23 - 2011-11-22 17:07 - 00065536 _____ () C:Windowssystem32Ikeext.etl

2014-05-08 09:22 - 2011-09-02 18:08 - 00000000 ____D () C:ProgramDataNVIDIA

2014-05-08 09:22 - 2009-07-14 08:08 - 00000006 ____H () C:WindowsTasksSA.DAT

2014-05-08 09:22 - 2009-07-14 07:51 - 00104465 _____ () C:Windowssetupact.log

2014-05-08 08:54 - 2014-05-08 08:54 - 00000000 ___SD () C:Windowssystem32CompatTel

2014-05-07 18:44 - 2014-05-08 14:36 - 00156783 _____ () C:UsersKremena GeorgievaDesktopflipper.swf

2014-05-01 12:48 - 2011-09-02 16:03 - 00000000 ____D () C:UsersKremena GeorgievaAppDataRoamingMozilla

2014-04-30 10:56 - 2013-09-22 12:10 - 00000000 ____D () C:UsersKremena GeorgievaDesktopInvoices

2014-04-29 17:01 - 2014-05-03 05:20 - 23547904 _____ (Microsoft Corporation) C:Windowssystem32mshtml.dll

2014-04-29 16:40 - 2014-05-03 05:19 - 02724864 _____ (Microsoft Corporation) C:Windowssystem32mshtml.tlb

2014-04-29 15:48 - 2014-05-03 05:20 - 17384448 _____ (Microsoft Corporation) C:WindowsSysWOW64mshtml.dll

2014-04-29 15:34 - 2014-05-03 05:19 - 02724864 _____ (Microsoft Corporation) C:WindowsSysWOW64mshtml.tlb

2014-04-29 11:37 - 2012-07-22 22:25 - 00003768 _____ () C:WindowsSystem32TasksAdobe Flash Player Updater

2014-04-29 11:37 - 2012-05-21 09:37 - 00692400 _____ (Adobe Systems Incorporated) C:WindowsSysWOW64FlashPlayerApp.exe

2014-04-29 11:37 - 2011-09-02 16:05 - 00070832 _____ (Adobe Systems Incorporated) C:WindowsSysWOW64FlashPlayerCPLApp.cpl

2014-04-21 14:18 - 2009-07-14 06:20 - 00000000 ____D () C:Windowsrescache

2014-04-21 12:51 - 2014-04-21 12:51 - 00000000 __SHD () C:UsersKremena GeorgievaAppDataLocalEmieUserList

2014-04-21 12:51 - 2014-04-21 12:51 - 00000000 __SHD () C:UsersKremena GeorgievaAppDataLocalEmieSiteList

2014-04-21 12:49 - 2009-07-14 06:20 - 00000000 ____D () C:WindowsPolicyDefinitions

2014-04-18 11:21 - 2010-11-21 06:47 - 00233646 _____ () C:WindowsPFRO.log

2014-04-17 15:26 - 2012-02-06 12:47 - 00031232 _____ () C:UsersKremena GeorgievaDesktopCopy of Kopas 30 50.xls

2014-04-15 08:58 - 2011-09-02 17:49 - 00000000 ____D () C:ProgramDataMicrosoft Help

2014-04-15 08:56 - 2013-07-16 09:24 - 00000000 ____D () C:Windowssystem32MRT

2014-04-15 08:52 - 2011-09-02 16:03 - 90655440 _____ (Microsoft Corporation) C:Windowssystem32MRT.exe

2014-04-14 05:24 - 2014-05-06 09:27 - 00465408 _____ (Microsoft Corporation) C:Windowssystem32aepdu.dll

2014-04-14 05:19 - 2014-05-06 09:27 - 00424448 _____ (Microsoft Corporation) C:Windowssystem32aeinv.dll

2014-04-11 08:47 - 2013-03-10 21:00 - 00000000 ____D () C:Program Files (x86)Mozilla Maintenance Service

2014-04-09 09:03 - 2013-01-24 16:16 - 00000000 ____D () C:UsersKremena GeorgievaDesktopMe

 

ZeroAccess:

C:$Recycle.BinS-1-5-21-1639035527-594000354-161818179-1000$b3625afb9fe626920b66025267b1f4f9

 

Files to move or delete:

====================

C:UsersKremena GeorgievaLJM1130_M1210_Full_Solution.exe

 

 

Some content of TEMP:

====================

C:UsersAdministratorAppDataLocalTempGomEncDnInstaller.exe

C:UsersAdministratorAppDataLocalTempSHSetup.exe

C:UsersAdministratorAppDataLocalTempsiinst.exe

C:UsersAdministratorAppDataLocalTempstrings.dll

C:UsersAdministratorAppDataLocalTemptbuTor.dll

 

 

==================== Bamital & volsnap Check =================

 

C:WindowsSystem32winlogon.exe => MD5 is legit

C:WindowsSystem32wininit.exe => MD5 is legit

C:WindowsSysWOW64wininit.exe => MD5 is legit

C:Windowsexplorer.exe => MD5 is legit

C:WindowsSysWOW64explorer.exe => MD5 is legit

C:WindowsSystem32svchost.exe => MD5 is legit

C:WindowsSysWOW64svchost.exe => MD5 is legit

C:WindowsSystem32services.exe => MD5 is legit

C:WindowsSystem32User32.dll => MD5 is legit

C:WindowsSysWOW64User32.dll => MD5 is legit

C:WindowsSystem32userinit.exe => MD5 is legit

C:WindowsSysWOW64userinit.exe => MD5 is legit

C:WindowsSystem32rpcss.dll => MD5 is legit

C:WindowsSystem32Driversvolsnap.sys => MD5 is legit

 

 

LastRegBack: 2014-04-29 09:05

 

==================== End Of Log ============================

 

Прикачих и от Eset лог-а

Addition.txt

eset.txt

FRST.txt

Редактирано 13 май 201412 г. от B-boy[StyLe] (преглед на промените)

Заемам се.

Здравейте отново,

 

 

СТЪПКА 1

 

 

Преди да продължим направете нова точка за възстановяване (Restore Point).

 

 

СТЪПКА 2

 

 

След това отворете Control Panel и деинсталирайте следните програми от списъка:

 

FromDocToPDF Firefox Toolbar

SpyHunter

 

 

СТЪПКА 3

 

Изтеглете fixlist.txt и го запазете в папката от която стартирахте FRST.exe.

Стартирайте FRST.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата.

 

Пишете за състоянието на системата след процедурите до момента.

 

 

Поздрави!

Първо да кажа че 2те програмки ги махнах преди да прочета поста ви и направих restore point-a след това. Също така сканирах с malware bytes също преди да видя поста.

Прикачам лога

 

Ето и лога от FRST

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-05-2014 01Ran by Administrator at 2014-05-09 15:51:04 Run:1Running from C:UsersAdministratorDesktopBoot Mode: Normal==============================================

Content of fixlist:*****************startHKLM...Run: [FromDocToPDF Home Page Guard 64 bit] => C:Program Files (x86)FromDocToPDF_65bar1.binAppIntegrator64.exe [548936 2013-10-02] ()C:Program Files (x86)FromDocToPDF_65HKLM-x32...Run: [] => [X]HKLM-x32...Run: [FromDocToPDF Search Scope Monitor] => C:Program Files (x86)FromDocToPDF_65bar1.bin65SrchMn.exe [44784 2013-10-02] (MindSpark)HKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [internet Security] => C:ProgramDataildefender.exeC:ProgramDataildefender.exeHKUS-1-5-21-1639035527-594000354-161818179-1000...Run: [dufy.exe] => C:UsersKremena GeorgievaAppDataRoamingUxmidufy.exe [0 2014-05-09] ()HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0...Run: [internet Security] => C:ProgramDataildefender.exeURLSearchHook: HKCU - (No Name) - {96f454ea-9d38-474f-b504-56193e00c1a5} - No FileBHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:Program Files (x86)Hotspot ShieldHssIEHssIE_64.dll No FileToolbar: HKCU - No Name - {96F454EA-9D38-474F-B504-56193E00C1A5} -  No FileFF DefaultSearchEngine: uTorrentControl_v6 Customized Web SearchFF SelectedSearchEngine: uTorrentControl_v6 Customized Web SearchFF Keyword.URL: hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=370858F4-7C20-4B75-B1EA-B1C50A43C025&n=77fd78b7&ind=2013100215&p2=^Y6^xdm007^YYA^bg&si=CKDIvOeR-LkCFcmV3godrlUA-g&searchfor=FF Plugin-x32: @FromDocToPDF_65.com/Plugin - C:Program Files (x86)FromDocToPDF_65bar1.binNP65Stub.dll (MindSpark)FF Plugin ProgramFiles/Appdata: C:Program Files (x86)mozilla firefoxpluginsnpBitCometAgent.dll (BitComet)FF SearchPlugin: C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultsearchpluginsask-web-search.xmlFF SearchPlugin: C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultsearchpluginsutorrentcontrolv6-customized-web-search.xmlFF Extension: FromDocToPDF - C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultExtensions65ffxtbr@FromDocToPDF_65.com [2014-05-09]FF HKLM-x32...FirefoxExtensions: [65ffxtbr@FromDocToPDF_65.com] - C:Program Files (x86)FromDocToPDF_65bar1.binFF Extension: FromDocToPDF - C:Program Files (x86)FromDocToPDF_65bar1.bin [2013-10-02]CHR Extension: (No Name) - C:UsersKremena GeorgievaAppDataLocalGoogleChromeUser DataDefaultExtensionscflheckfmhopnialghigdlggahiomebp [2013-04-04]CHR HKCU...ChromeExtension: [cflheckfmhopnialghigdlggahiomebp] - C:UsersKremena GeorgievaAppDataLocalCREcflheckfmhopnialghigdlggahiomebp.crx [2013-03-27]CHR HKLM-x32...ChromeExtension: [cflheckfmhopnialghigdlggahiomebp] - C:UsersKremena GeorgievaAppDataLocalCREcflheckfmhopnialghigdlggahiomebp.crx [2013-03-27]R2 FromDocToPDF_65Service; C:Program Files (x86)FromDocToPDF_65bar1.bin65barsvc.exe [42504 2013-10-02] (COMPANYVERS_NAME)R2 SpyHunter 4 Service; C:Program FilesEnigma Software GroupSpyHunterSH4Service.exe [1025408 2013-05-07] (Enigma Software Group USA, LLC.)C:Program FilesEnigma Software GroupS3 EsgScanner; C:WindowsSystem32DRIVERSEsgScanner.sys [22704 2012-06-22] ()C:WindowsSystem32DRIVERSEsgScanner.sysC:UsersKremena GeorgievaAppDataRoamingUxmiC:UsersKremena GeorgievaAppDataRoamingIwbeisC:$Recycle.BinS-1-5-21-1639035527-594000354-161818179-1000$b3625afb9fe626920b66025267b1f4f9cmd: netsh winsock reset catalotcmd: ipconfig /flushdnscmd: bcdedit /enum all /vend*****************

HKLMSoftwareMicrosoftWindowsCurrentVersionRunFromDocToPDF Home Page Guard 64 bit => Value not found."C:Program Files (x86)FromDocToPDF_65" => File/Directory not found.HKLMSoftwareWOW6432NodeMicrosoftWindowsCurrentVersionRun => Value deleted successfully.HKLMSoftwareWOW6432NodeMicrosoftWindowsCurrentVersionRunFromDocToPDF Search Scope Monitor => Value not found.HKUS-1-5-21-1639035527-594000354-161818179-1000SoftwareMicrosoftWindowsCurrentVersionRunInternet Security => Value not found."C:ProgramDataildefender.exe" => File/Directory not found.HKUS-1-5-21-1639035527-594000354-161818179-1000SoftwareMicrosoftWindowsCurrentVersionRundufy.exe => Value not found.HKUS-1-5-21-1639035527-594000354-161818179-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0SoftwareMicrosoftWindowsCurrentVersionRunInternet Security => Value not found.HKCUSoftwareMicrosoftInternet ExplorerURLSearchHooks{96f454ea-9d38-474f-b504-56193e00c1a5} => Value not found.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} => Key deleted successfully.HKCRCLSID{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} => Key deleted successfully.HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser{96F454EA-9D38-474F-B504-56193E00C1A5} => Value not found.HKCRCLSID{96F454EA-9D38-474F-B504-56193E00C1A5} => Key not found.Firefox DefaultSearchEngine deleted successfully.Firefox SelectedSearchEngine deleted successfully.Firefox Keyword.URL deleted successfully.HKLMSoftwareWow6432NodeMozillaPlugins@FromDocToPDF_65.com/Plugin => Key not found.C:Program Files (x86)FromDocToPDF_65bar1.binNP65Stub.dll not found.C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultsearchpluginsask-web-search.xml => Moved successfully."C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultsearchpluginsutorrentcontrolv6-customized-web-search.xml" => not found.C:UsersKremena GeorgievaAppDataRoamingMozillaFirefoxProfilescucvn5gy.defaultExtensions65ffxtbr@FromDocToPDF_65.com not found.HKLMSoftwareWow6432NodeMozillaFirefoxExtensions65ffxtbr@FromDocToPDF_65.com => Value not found.C:Program Files (x86)FromDocToPDF_65bar1.bin not found.C:UsersKremena GeorgievaAppDataLocalGoogleChromeUser DataDefaultExtensionscflheckfmhopnialghigdlggahiomebp => Moved successfully.HKCUSOFTWAREGoogleChromeExtensionscflheckfmhopnialghigdlggahiomebp => Key not found.C:UsersKremena GeorgievaAppDataLocalCREcflheckfmhopnialghigdlggahiomebp.crx => Moved successfully.HKLMSOFTWAREWow6432NodeGoogleChromeExtensionscflheckfmhopnialghigdlggahiomebp => Key deleted successfully."C:UsersKremena GeorgievaAppDataLocalCREcflheckfmhopnialghigdlggahiomebp.crx" => File/Directory not found.FromDocToPDF_65Service => Service not found.SpyHunter 4 Service => Service not found.C:Program FilesEnigma Software Group => Moved successfully.EsgScanner => Service not found."C:WindowsSystem32DRIVERSEsgScanner.sys" => File/Directory not found.C:UsersKremena GeorgievaAppDataRoamingUxmi => Moved successfully.C:UsersKremena GeorgievaAppDataRoamingIwbeis => Moved successfully.C:$Recycle.BinS-1-5-21-1639035527-594000354-161818179-1000$b3625afb9fe626920b66025267b1f4f9 => Moved successfully.

=========  netsh winsock reset catalot =========

Sucessfully reset the Winsock Catalog.You must restart the computer in order to complete the reset.

========= End of CMD: =========

=========  ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========  bcdedit /enum all /v =========

Windows Boot Manager--------------------identifier   {9dea862c-5cdd-4e70-acc1-f32b344d4795}device   partition=DeviceHarddiskVolume1description Windows Boot Managerlocale   en-USinherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}default {5e8c07c4-d564-11e0-8e72-fa5bfc1b37fb}resumeobject   {5e8c07c3-d564-11e0-8e72-fa5bfc1b37fb}displayorder   {5e8c07c4-d564-11e0-8e72-fa5bfc1b37fb}toolsdisplayorder {b2721d73-1db4-4c62-bf78-c548a880142d}timeout 30

Windows Boot Loader-------------------identifier   {5e8c07c4-d564-11e0-8e72-fa5bfc1b37fb}device   partition=C:path   Windowssystem32winload.exedescription Windows 7locale   en-USinherit {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}recoverysequence   {5e8c07c5-d564-11e0-8e72-fa5bfc1b37fb}recoveryenabled Yesosdevice   partition=C:systemroot   Windowsresumeobject   {5e8c07c3-d564-11e0-8e72-fa5bfc1b37fb}nx   OptIn

Windows Boot Loader-------------------identifier   {5e8c07c5-d564-11e0-8e72-fa5bfc1b37fb}

Resume from Hibernate---------------------identifier   {5e8c07c3-d564-11e0-8e72-fa5bfc1b37fb}device   partition=C:path   Windowssystem32winresume.exedescription Windows Resume Applicationlocale   en-USinherit {1afa9c49-16ab-4a5c-901b-212802da9460}filedevice   partition=C:filepath   hiberfil.sysdebugoptionenabled   No

Windows Memory Tester---------------------identifier   {b2721d73-1db4-4c62-bf78-c548a880142d}device   partition=DeviceHarddiskVolume1path   bootmemtest.exedescription Windows Memory Diagnosticlocale   en-USinherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}badmemoryaccess Yes

EMS Settings------------identifier   {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}bootems Yes

Debugger Settings-----------------identifier   {4636856e-540f-4170-a130-a84776f4c654}debugtype Serialdebugport 1baudrate   115200

RAM Defects-----------identifier   {5189b25c-5558-4bf2-bca4-289b11bd29e2}

Global Settings---------------identifier   {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}inherit {4636856e-540f-4170-a130-a84776f4c654}   {0ce4991b-e6b3-4b16-b23c-5e0d9250e5d9}   {5189b25c-5558-4bf2-bca4-289b11bd29e2}

Boot Loader Settings--------------------identifier   {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}   {7ff607e0-4395-11db-b0de-0800200c9a66}

Hypervisor Settings-------------------identifier   {7ff607e0-4395-11db-b0de-0800200c9a66}hypervisordebugtype Serialhypervisordebugport 1hypervisorbaudrate   115200

Resume Loader Settings----------------------identifier   {1afa9c49-16ab-4a5c-901b-212802da9460}inherit {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}

Device options--------------identifier   {5e8c07c6-d564-11e0-8e72-fa5bfc1b37fb}description Ramdisk Optionsramdisksdidevice   unknownramdisksdipath   Recovery5e8c07c5-d564-11e0-8e72-fa5bfc1b37fbboot.sdi

========= End of CMD: =========

==== End of Fixlog ====

 

ще наблюдавам системата и дано всичко е наред

 

 

edit 

оказа се че съм прикачил стар лог за malware bytes, но го оправих

Fixlog.txt

mbam-log-2014-05-09 (15-07-43).xml

Редактирано 9 май 201412 г. от ovdesko (преглед на промените)

Това е погрешно...щом сте пуснали тема тук е редно да прекратите всяка самонициатива от своя страна.

Да не говорим, че използвате много архаична версия на MBAM:

 

 

СТЪПКА 1

 

 

Моля изтеглете Malwarebytes Anti-Malware и я запазете на вашия десктоп.

• [*]Стартирайте файла

mbam-setup-consumer-2.0.2.1010.exe и следвайте указанията за да инсталирате програмата. [*]След като инсталацията приключи се уверете че сте сложили отметка пред:

• [*]

Launch Malwarebytes Anti-Malware [*]Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.

[*]Натиснете бутона Finish. [*]Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits". [*]Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now. [*]Ще започне проверка за зловреден софтуер. [*]При някои инфекции можете да видите съобщението:

• [*]

"Could not load DDA driver"

[*]Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт. [*]Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции. [*]След като проверката приключи натиснете бутона Apply Actions. [*]Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes. [*]След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж. [*]Отидете то табът History > Application Logs. [*]Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard" [*]Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

СТЪПКА 2

 

 

1.Изтеглете Hitman Pro.

 

• [*]За

32-битова система - . [*]За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).
4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

 

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

 

 

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:ProgramdataHitmanProLogs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

 

 

Поздрави!

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 9.5.2014 г.Scan Time: 16:31:32 ч.Logfile: mbam log.txtAdministrator: YesVersion: 2.00.2.1010Malware Database: v2014.05.09.07Rootkit Database: v2014.03.27.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: Kremena GeorgievaScan Type: Threat ScanResult: CompletedObjects Scanned: 321068Time Elapsed: 22 min, 20 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end)

HitmanPro_20140509_1704.zip

Здравейте,

 

Може ли да публикувате лог файла в txt формат, а не в xml?

 

отворете C:ProgramdataHitmanProLogs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

 

Иначе и двата лога са чисти...след HitmanPro имаме само няколко потенциално нежелани приложения за премахване. Логовете от MBAM са чисти и двата. Ако MBAM е премахнала нещо до момента може би трябва да публикувате по-предния лог за да видя какво точно.

 

Как са нещата в момента. Eset обажда ли се още, защото си мисля, че с FRST му резнахме крилцата...

 

Поздрави!

БАМ

Здравейте,

 

Може ли да публикувате лог файла в txt формат, а не в xml?

 

 

Иначе и двата лога са чисти...след HitmanPro имаме само няколко потенциално нежелани приложения за премахване. Логовете от MBAM са чисти и двата. Ако MBAM е премахнала нещо до момента може би трябва да публикувате по-предния лог за да видя какво точно.

 

Как са нещата в момента. Eset обажда ли се още, защото си мисля, че с FRST му резнахме крилцата...

 

Поздрави!

Всичко изглежда нормално, но компютъра си го взеха. Ще видя в понеделник отдалечено да вляза и да взема необходимите логове, но мисля че всичко е изчистено. Ще пиша в понеделник допълнително.

Ok, дръжте ме в течение за да мога да маркирам темата като Решена. Вчера нямаше как да пише повече, защото бях на работа, но и аз мисля, че приключихме. Нещата в HitmanPro са безобидни така или иначе (Conduit toolbar) и т.н. Хубаво е да се премахне, но и да не се, не е толкова важно. Важното е, че изчистихме Zbot-a.

 

PS: Направо я маркирам като РЕШЕН-а, защото съм убеден, че е такава.

 

Поздрави!