Премини към съдържанието
От 1-ви септември 2021 г., вход във форумите ще е възможен само с имейл адрес вместо потребителско име. Ако не помните имейла с който сте се регистрирали, вижте го в настройките на профила си. ×
  • Добре дошли!

    Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

    Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

     

Зловреден софт или вирус се е настанил в компютъра ми


Препоръчан отговор


Здравейте,

 

Някакъв зловреден софтуеър или вирус се е настанил в компютъра ми. Mozila забива постоянно, изкачат всякакви рекламни банери. Влизам на дадена уеб страница и автоматично след няколко секунди ме препраща към друга, която не желая да виждам, като цяло компютърът ми е бавен и се налага рестарт по няколко пъти на ден.

 

И друг път съм се сблъсквала с подобно нещо и успях да се справя с Malware, но този път нищо не открива.

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2014
Ran by User (administrator) on USER-PC on 12-11-2014 14:22:09
Running from C:\Users\User\Desktop
Loaded Profiles: User & UpdatusUser (Available profiles: User & UpdatusUser)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(BitTorrent Inc.) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google) C:\Users\User\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe
(IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
(IObit) C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13353064 2014-04-18] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277992 2014-04-18] (Realtek Semiconductor)
HKLM\...\Run: [ASUSQuickGesture(x86)] => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe [20352 2012-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [ASUSTPLoader(x64)] => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe [169856 2012-09-11] (AsusTek)
HKLM\...\Run: [ASUSQuickGesture(x64)] => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe [22400 2012-09-11] (ASUSTeK Computer Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [switchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2691480 2014-03-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iObit Malware Fighter] => C:\Program Files (x86)\IObit\IObit Malware Fighter\IMF.exe [4474832 2012-12-25] (IObit)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [1385808 2014-10-27] (BitTorrent Inc.)
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\...\Run: [Google Update] => C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-08-27] (Google Inc.)
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22869088 2014-10-21] (Google)
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\...\Run: [speech Recognition] => C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\...\MountPoints2: {c4890cf8-ca4c-11e3-8961-10bf481afebf} - H:\SETUP.EXE
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [260928 2012-03-05] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [215360 2012-03-05] (NVIDIA Corporation)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/en-us/?pc=UP97&ocid=UP97DHP
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCD104C535FA2CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = bg-BG
URLSearchHook: HKLM-x32 - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: ASUS Browser Extension x64 -> {78234974-0C4B-4111-BDEB-D9A104418772} -> C:\Program Files (x86)\ASUS\ASUS Smart Gesture\install\x64\BrowserExtension64.dll (ASUSTeK Computer Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: ASUS Browser Extension x86 -> {78234974-0C4B-4111-BDEB-D9A104418771} -> C:\Program Files (x86)\ASUS\ASUS Smart Gesture\install\x86\BrowserExtension.dll (ASUSTeK Computer Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Filter: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter-x32: application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter-x32: application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Filter-x32: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.1: default-search.net
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxp://google.com/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKU\S-1-5-21-2812945593-2017259352-232896672-1000: @citrixonline.com/appdetectorplugin -> C:\Users\User\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKU\S-1-5-21-2812945593-2017259352-232896672-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\User\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-2812945593-2017259352-232896672-1000: @talk.google.com/O1DPlugin -> C:\Users\User\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-2812945593-2017259352-232896672-1000: @tools.google.com/Google Update;version=3 -> C:\Users\User\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2812945593-2017259352-232896672-1000: @tools.google.com/Google Update;version=9 -> C:\Users\User\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\User\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\User\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\searchplugins\bingp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\ddg.xml
FF Extension: Xpert-Web - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\Extensions\{58e3c1c9-2dc1-4762-bd45-1df9da9d0820} [2014-11-06]
FF Extension: MeasureIt - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\Extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}.xpi [2014-05-05]
FF Extension: S3 Firefox Organizer(S3Fox) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\Extensions\{7CEA821D-3DAB-4238-B424-BF7324531750}.xpi [2014-09-03]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-11-10]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-11]
CHR Extension: (Bing) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2014-11-11]
CHR Extension: (FullScreen for GoogleMaps) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\kapgobifldgnkpcgoejmkfoemkajilcj [2014-11-04]
CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-11-11]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-11]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 IMFservice; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [821592 2012-01-09] (IObit)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinHttpAutoProxySvc; winhttp.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ATP; C:\Windows\System32\DRIVERS\AsusTP.sys [56704 2012-09-11] (ASUS Corporation)
R3 FileMonitor; C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [21384 2012-01-05] (IObit)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-11] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 RegFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [33224 2012-07-05] (IObit.com)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8873688 2014-04-18] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [32496 2014-04-18] (Synaptics Incorporated)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-11-04] (Duplex Secure Ltd.)
R3 UrlFilter; C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [21904 2012-07-05] (IObit.com)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-12 14:22 - 2014-11-12 14:22 - 00019244 _____ () C:\Users\User\Desktop\FRST.txt
2014-11-12 14:21 - 2014-11-12 14:22 - 00000000 ____D () C:\FRST
2014-11-12 14:19 - 2014-11-12 14:19 - 02116096 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2014-11-12 13:27 - 2014-11-12 13:27 - 00001255 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-11-12 13:27 - 2014-11-12 13:27 - 00001237 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-11-12 13:27 - 2014-11-12 13:27 - 00001173 _____ () C:\Users\Public\Desktop\IObit Malware Fighter.lnk
2014-11-12 13:27 - 2014-11-12 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Malware Fighter
2014-11-11 17:46 - 2014-11-11 17:46 - 32832772 _____ () C:\Users\User\Desktop\veterans-day-2.psd
2014-11-11 17:33 - 2014-11-11 17:33 - 32885687 _____ () C:\Users\User\Desktop\veterans-day.psd
2014-11-11 11:27 - 2014-11-11 23:48 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-11 11:26 - 2014-11-11 20:51 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-11 11:26 - 2014-11-11 20:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-11 11:26 - 2014-11-11 20:51 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-10 22:44 - 2014-11-10 22:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 22:05 - 2014-11-10 22:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-10 21:58 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-10 21:58 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-10 21:58 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-10 21:56 - 2014-11-12 13:26 - 00000000 ____D () C:\New folder
2014-11-06 15:56 - 2014-11-06 15:56 - 11753975 _____ () C:\Users\User\Desktop\print.zip
2014-11-05 12:06 - 2014-11-06 16:23 - 00000000 ____D () C:\Users\User\AppData\Roaming\FileZilla
2014-11-05 12:06 - 2014-11-05 12:06 - 06126536 _____ (Tim Kosse) C:\Users\User\Downloads\FileZilla_3.9.0.6_win32-setup [1].exe
2014-11-05 12:06 - 2014-11-05 12:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-11-05 12:06 - 2014-11-05 12:06 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2014-11-04 17:54 - 2014-11-04 17:54 - 00000000 ____D () C:\ProgramData\4b16a7471b2d5297
2014-11-04 16:24 - 2014-11-04 16:24 - 00000000 ____D () C:\Users\User\Documents\Optimizer Pro
2014-11-04 16:18 - 2014-11-04 16:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\Opera Software
2014-11-04 16:18 - 2014-11-04 16:18 - 00000000 ____D () C:\Users\User\AppData\Local\Opera Software
2014-11-04 16:17 - 2014-11-04 18:04 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-11-04 16:17 - 2014-11-04 16:17 - 00003816 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1415110669
2014-11-04 16:17 - 2014-11-04 16:17 - 00001135 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk.1415113285.old
2014-11-04 16:16 - 2014-11-04 16:18 - 00000000 ____D () C:\Users\User\AppData\Roaming\RHEng
2014-11-04 16:16 - 2014-11-04 16:16 - 00000000 ____D () C:\Users\User\AppData\Roaming\WebExtend
2014-11-03 21:03 - 2014-11-03 21:03 - 00000000 ____D () C:\Users\Default\AppData\Local\Google
2014-11-03 21:03 - 2014-11-03 21:03 - 00000000 ____D () C:\Users\Default User\AppData\Local\Google
2014-10-28 16:12 - 2014-10-28 16:12 - 02809011 _____ () C:\Users\User\Desktop\Cool gumbi psd.psd
2014-10-28 15:58 - 2014-10-28 16:36 - 01340845 _____ () C:\Users\User\Desktop\buynow-Button.psd
2014-10-22 09:52 - 2014-10-22 09:52 - 00008224 _____ () C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2014-10-17 15:16 - 2014-10-18 21:17 - 00000000 ____D () C:\Users\User\Desktop\New folder (3)
2014-10-17 14:51 - 2014-10-20 17:44 - 00000000 ____D () C:\Users\User\Desktop\testimonials
2014-10-15 10:47 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 10:47 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-15 10:47 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-15 10:47 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-15 10:47 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-15 10:47 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-15 10:47 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-15 10:47 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-15 10:47 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-15 10:47 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-15 10:47 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-15 10:47 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-15 10:47 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-15 10:47 - 2014-07-07 04:07 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-15 10:47 - 2014-07-07 04:06 - 04120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-10-15 10:47 - 2014-07-07 04:06 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2014-10-15 10:47 - 2014-07-07 04:06 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-10-15 10:47 - 2014-07-07 03:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2014-10-15 10:47 - 2014-07-07 03:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2014-10-15 10:47 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 10:47 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 10:47 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 10:47 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 10:47 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 10:47 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-15 10:46 - 2014-10-10 04:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 10:46 - 2014-10-10 04:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 10:46 - 2014-10-10 04:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 10:46 - 2014-10-07 04:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 10:46 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 10:46 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 10:46 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 10:46 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 10:46 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 10:46 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 10:46 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 10:46 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 10:46 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 10:46 - 2014-09-19 03:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 10:46 - 2014-09-19 03:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 10:46 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 10:46 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 10:46 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 10:46 - 2014-09-19 03:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 10:46 - 2014-09-19 03:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 10:46 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 10:46 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 10:46 - 2014-09-19 03:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 10:46 - 2014-09-19 03:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 10:46 - 2014-09-19 03:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 10:46 - 2014-09-19 03:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 10:46 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 10:46 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 10:46 - 2014-09-19 03:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 10:46 - 2014-09-19 03:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 10:46 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 10:46 - 2014-09-19 03:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 10:46 - 2014-09-19 03:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 10:46 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 10:46 - 2014-09-19 03:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 10:46 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 10:46 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 10:46 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 10:46 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 10:46 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 10:46 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 10:46 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 10:46 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 10:46 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 10:46 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 10:46 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 10:46 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 10:46 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 10:46 - 2014-09-19 02:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 10:46 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 10:46 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 10:46 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 10:46 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 10:46 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 10:46 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 10:46 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 10:46 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 10:46 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 10:46 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 10:46 - 2014-08-19 05:11 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2014-10-15 10:46 - 2014-08-19 05:10 - 00616352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2014-10-15 10:46 - 2014-08-19 05:08 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2014-10-15 10:46 - 2014-08-19 05:08 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2014-10-15 10:46 - 2014-08-19 05:08 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2014-10-15 10:46 - 2014-08-19 05:07 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2014-10-15 10:46 - 2014-08-19 05:07 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2014-10-15 10:46 - 2014-08-19 05:07 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2014-10-15 10:46 - 2014-08-19 05:07 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2014-10-15 10:46 - 2014-08-19 05:07 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2014-10-15 10:46 - 2014-08-19 04:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2014-10-15 10:46 - 2014-08-19 04:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2014-10-15 10:46 - 2014-08-19 04:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-10-15 10:46 - 2014-07-07 04:07 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-10-15 10:46 - 2014-07-07 04:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 05551032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-10-15 10:46 - 2014-07-07 04:06 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-10-15 10:46 - 2014-07-07 04:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-10-15 10:46 - 2014-07-07 04:06 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-10-15 10:46 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-10-15 10:46 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-10-15 10:46 - 2014-07-07 04:05 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-15 10:46 - 2014-07-07 04:05 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-10-15 10:46 - 2014-07-07 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-10-15 10:46 - 2014-07-07 03:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2014-10-15 10:46 - 2014-07-07 03:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2014-10-15 10:46 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2014-10-15 10:46 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2014-10-15 10:46 - 2014-07-07 03:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-10-15 10:46 - 2014-07-07 03:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-10-15 10:46 - 2014-07-07 03:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-10-15 10:46 - 2014-07-07 03:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-10-15 10:46 - 2014-07-07 03:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-10-15 10:46 - 2014-07-07 03:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-10-15 10:46 - 2014-06-28 02:21 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2014-10-15 10:46 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2014-10-15 10:46 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-10-15 10:45 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 10:45 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 10:44 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 10:44 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 10:44 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 10:44 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-15 10:44 - 2014-07-17 04:07 - 01113088 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 10:44 - 2014-07-17 04:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 10:44 - 2014-07-17 04:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 10:44 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 10:44 - 2014-07-17 03:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 10:44 - 2014-07-17 03:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 10:44 - 2014-07-17 03:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 10:44 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 10:44 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 10:44 - 2014-07-17 03:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 10:44 - 2014-07-17 03:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-12 14:21 - 2014-05-04 19:22 - 00000000 ____D () C:\Users\User\AppData\Roaming\uTorrent
2014-11-12 14:11 - 2014-08-27 20:00 - 00001004 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2812945593-2017259352-232896672-1000UA.job
2014-11-12 14:09 - 2014-04-23 14:47 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-11-12 14:02 - 2014-04-23 14:51 - 00000998 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-12 13:53 - 2014-04-18 13:23 - 01830664 _____ () C:\Windows\WindowsUpdate.log
2014-11-12 13:47 - 2014-09-02 18:06 - 00000536 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2812945593-2017259352-232896672-1000.job
2014-11-12 13:44 - 2014-04-18 21:26 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-12 13:41 - 2009-07-14 06:45 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-12 13:41 - 2009-07-14 06:45 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-12 13:27 - 2014-04-18 20:30 - 00000000 ____D () C:\Users\User\AppData\Roaming\IObit
2014-11-12 13:27 - 2014-04-18 20:30 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-11-12 05:49 - 2014-04-22 21:04 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe
2014-11-11 23:49 - 2014-09-11 12:07 - 00000000 ___RD () C:\Users\User\Google Drive
2014-11-11 23:49 - 2014-06-05 22:35 - 00000000 ___RD () C:\Users\User\Dropbox
2014-11-11 23:49 - 2014-06-05 22:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-11-11 23:47 - 2014-04-23 14:51 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-11 23:47 - 2010-11-21 05:47 - 00214716 _____ () C:\Windows\PFRO.log
2014-11-11 23:47 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-11 23:47 - 2009-07-14 06:51 - 00038604 _____ () C:\Windows\setupact.log
2014-11-11 23:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Registration
2014-11-11 18:36 - 2014-05-02 13:01 - 00000132 _____ () C:\Users\User\AppData\Roaming\Adobe PNG Format CC Prefs
2014-11-11 18:32 - 2014-09-11 10:53 - 00000000 ___RD () C:\Users\User\Google Диск
2014-11-11 17:11 - 2014-08-27 20:00 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2812945593-2017259352-232896672-1000Core.job
2014-11-11 15:13 - 2014-09-03 09:51 - 00000000 ____D () C:\Program Files (x86)\SoftwareUpdater
2014-11-11 15:13 - 2014-09-03 09:51 - 00000000 ____D () C:\Program Files (x86)\Settings Manager
2014-11-11 15:13 - 2014-04-19 08:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-11 12:04 - 2014-07-23 16:14 - 00000000 ____D () C:\Users\User\Desktop\dobavki
2014-11-11 11:45 - 2014-09-03 09:52 - 00000000 ____D () C:\Users\User\AppData\Roaming\FirefoxToolbar
2014-11-10 22:08 - 2014-09-02 18:06 - 00000000 ____D () C:\Users\User\AppData\Local\Citrix
2014-11-09 18:58 - 2014-06-06 22:11 - 00000000 ____D () C:\The KMPlayer
2014-11-07 14:37 - 2009-07-14 07:13 - 00785366 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-05 22:23 - 2014-09-26 14:58 - 00000000 ____D () C:\Users\User\Desktop\pics
2014-11-05 12:06 - 2014-09-03 09:53 - 00004022 _____ () C:\Windows\System32\Tasks\LaunchSignup
2014-11-04 18:05 - 2014-04-22 20:10 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-11-04 17:01 - 2014-04-18 13:30 - 00001413 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-04 16:17 - 2014-04-22 20:11 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2014-11-04 14:46 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-11-03 21:04 - 2014-09-11 10:51 - 00002042 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-11-03 21:04 - 2014-09-11 10:51 - 00002040 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-11-03 21:04 - 2014-09-11 10:51 - 00002030 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-11-03 21:04 - 2014-09-11 10:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-11-02 10:09 - 2009-07-14 06:45 - 07216864 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-31 16:10 - 2014-04-19 08:32 - 00232320 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-30 13:25 - 2010-11-21 05:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 20:12 - 2014-04-19 08:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Mozilla
2014-10-28 21:04 - 2014-04-23 14:51 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-28 11:40 - 2014-10-02 20:51 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-10-28 11:39 - 2014-04-23 14:47 - 00000000 ____D () C:\ProgramData\Skype
2014-10-26 05:13 - 2014-09-02 18:06 - 00003562 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-2812945593-2017259352-232896672-1000
2014-10-25 21:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-10-25 20:57 - 2014-04-23 14:51 - 00003994 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-25 20:57 - 2014-04-23 14:51 - 00003742 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-25 08:42 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-25 08:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-10-16 05:08 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-10-16 04:54 - 2014-04-22 20:57 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 04:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-10-16 04:54 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-10-16 04:36 - 2014-04-23 14:56 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 04:31 - 2014-04-22 20:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 04:26 - 2014-04-18 13:29 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 16:06 - 2014-08-27 20:00 - 00003976 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2812945593-2017259352-232896672-1000UA
2014-10-15 16:06 - 2014-08-27 20:00 - 00003580 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2812945593-2017259352-232896672-1000Core

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\227384-659589-acrobat-distiller.exe
C:\Users\User\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcshryk.dll
C:\Users\User\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\User\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\User\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\User\AppData\Local\Temp\optprosetup.exe
C:\Users\User\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\User\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\User\AppData\Local\Temp\SimBundD.exe
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-05 11:29

==================== End Of Log ============================

Addition.txt

Addition.txt

Addition.txt

Линк към коментара
Сподели в други сайтове

Здравейте,

 

Да, видях къде е проблема и ще напипа скрипт, но малко по-късно, защото в момента съм на работа. Може би около 18.00 часа.

 

Поздрави и приятен ден! :)

Линк към коментара
Сподели в други сайтове

Здравейте,

 

Извинявам се за закъснението, но имахме непредвидени обстоятелства.

 

Изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

Пишете дали проблема остава.

 

Поздрави!

Линк към коментара
Сподели в други сайтове

Здравейте,

 

Всичко е наред сега, няма никакъв проблем. Много ви благодаря :) Прекрсано наистина, благодатя още веднъж :)

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2014
Ran by User at 2014-11-12 21:41:33 Run:1
Running from C:\Users\User\Desktop\FRST
Loaded Profiles: User & UpdatusUser (Available profiles: User & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF SearchEngineOrder.1: default-search.net
FF Extension: Xpert-Web - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\Extensions\{58e3c1c9-2dc1-4762-bd45-1df9da9d0820} [2014-11-06]
2014-11-04 17:54 - 2014-11-04 17:54 - 00000000 ____D () C:\ProgramData\4b16a7471b2d5297
2014-11-04 16:24 - 2014-11-04 16:24 - 00000000 ____D () C:\Users\User\Documents\Optimizer Pro
C:\Users\User\AppData\Local\Temp\optprosetup.exe
Task: {0C30D51D-230A-4D69-A052-2BA4CFEE3288} - \ShopperPro No Task File <==== ATTENTION
Task: {4C9D0137-0EA7-4AAE-BCAC-157D31B57A53} - \SPDriver No Task File <==== ATTENTION
Task: {A06F75A1-A0BC-47D6-B79C-5C1FC2F00AB6} - \ShopperProJSUpd No Task File <==== ATTENTION
Task: {F032E7F3-70CE-440A-9B8D-2EAA43BB5107} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
end
*****************

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\Extensions\{58e3c1c9-2dc1-4762-bd45-1df9da9d0820} => Moved successfully.
C:\ProgramData\4b16a7471b2d5297 => Moved successfully.
C:\Users\User\Documents\Optimizer Pro => Moved successfully.
C:\Users\User\AppData\Local\Temp\optprosetup.exe => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0C30D51D-230A-4D69-A052-2BA4CFEE3288}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C30D51D-230A-4D69-A052-2BA4CFEE3288}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ShopperPro" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4C9D0137-0EA7-4AAE-BCAC-157D31B57A53}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C9D0137-0EA7-4AAE-BCAC-157D31B57A53}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SPDriver" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A06F75A1-A0BC-47D6-B79C-5C1FC2F00AB6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A06F75A1-A0BC-47D6-B79C-5C1FC2F00AB6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ShopperProJSUpd" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F032E7F3-70CE-440A-9B8D-2EAA43BB5107}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F032E7F3-70CE-440A-9B8D-2EAA43BB5107}" => Key deleted successfully.
C:\Windows\System32\Tasks\LaunchSignup => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchSignup" => Key deleted successfully.
C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully.

==== End of Fixlog ====


Линк към коментара
Сподели в други сайтове

Супер,

 

Само че не сме приключили. :)

 

Изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

След това ако имате запаметени пароли и любими страници (favorites/bookmarks) и някакви лични настройки ги експортнете.

 

Деинсталирайте след това Google Chrome и Google Update Helper от Контролния панел. След това инсталирайте последната стабилна версия на браузъра => Google Chrome 38.0.2125.122 Stable

 

Причините за тези стъпки е, че има нов адуер, който обновява браузъра до последната версия за разработчици, защото в нея всички защитни механизми са изключени и гадината може да си добавя добавки с нисък рейтинг без те да бъдат блокирани от браузъра. Стабилната версия няма да позволи на такива добавки да се инсталират. Просто това се изисква след почистването на системата при тази нова гад, колкото и да е неприятно иначе лошите добавки ще се генерират отново. :)

 

След това пишете как е положението за да ви дам финални съвети. :)

 

 

Поздрави!

Линк към коментара
Сподели в други сайтове

Аа ето лог файла :

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2014
Ran by User at 2014-11-13 12:03:37 Run:2
Running from C:\Users\User\Desktop\FRST
Loaded Profiles: User & UpdatusUser (Available profiles: User & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
end
*****************

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}\\SystemComponent => value deleted successfully.

==== End of Fixlog ====


Деинсталирах Chrome и Google Update Helper. След това го инсталирах отново от файла, който вие сте постнали.

 

Всичко е нормално, няма признаци за нещо нередно ...

Линк към коментара
Сподели в други сайтове

Супер! И преди да приключим нека да проверим за остатъци:

 

 

 

СТЪПКА 1

  • Изтеглете и стартирайтe 6sv1DN9.jpgAdwCleaner.exe.
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[s0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието му в следващия си коментар.


     
    СТЪПКА 2
     

     
    Моля изтеглете icon1351185104.png Junkware Removal Tool на вашия десктоп.
  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.


     
    СТЪПКА 3


     
    Моля изтеглете Malwarebytes Anti-Malware 2.0.3.1025 Final и я запазете на вашия десктоп.
  • Стартирайте файла mbam-setup-2.0.3.1025.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.
  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.


     
    СТЪПКА 4
     

     
    1.Изтеглете Hitman Pro.
    За 32-битова система - dEMD6.gif.
    За 64-битова система - Download-button3.gif


    2.Стартирайте програмата.

    3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

    4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

    5.Натиснете бутона „Напред“.

    6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

    7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

    8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

    9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
     
    Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
     
    6-scanfin-choose.jpg
     
    Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:ProgramdataHitmanProLogs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

 

Поздрави!

Линк към коментара
Сподели в други сайтове

Здравейте изпращам последователно

 

Стъпка 1

 

 

# AdwCleaner v4.101 - Report created 14/11/2014 at 19:06:55
# Updated 09/11/2014 by Xplode
# Database : 2014-11-13.1 [Live]
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : User - USER-PC
# Running from : C:\adwcleaner_4.101.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\Settings Manager
Folder Deleted : C:\Program Files (x86)\SiteLookup
Folder Deleted : C:\Program Files (x86)\SoftwareUpdater
Folder Deleted : C:\Users\User\AppData\Local\CrashRpt
Folder Deleted : C:\Users\User\AppData\Roaming\FirefoxToolbar
Folder Deleted : C:\Users\User\AppData\Roaming\WebExtend
Folder Deleted : C:\Users\User\AppData\Roaming\RHEng
Folder Deleted : C:\Users\User\Documents\PC Speed Maximizer
File Deleted : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\searchplugins\bingp.xml

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Key Deleted : HKCU\Software\Classes\pokki
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ShopperPro.DLL
Key Deleted : HKLM\SOFTWARE\Classes\driverscanner
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}
Key Deleted : HKCU\Software\Goobzo
Key Deleted : HKCU\Software\Linkey
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\Software\Sense
Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\dt soft\daemon tools toolbar
Key Deleted : HKLM\SOFTWARE\Sense
Key Deleted : HKLM\SOFTWARE\ShopperPro
Key Deleted : HKLM\SOFTWARE\Uniblue
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\firefox.en.softonic.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17420


-\\ Mozilla Firefox v33.1 (x86 en-US)

[u1ul7cqm.default-1398937453451\prefs.js] - Line Deleted : user_pref("extensions.a2eb528f3950d48a3be4b5d7de6c8331ea41e199b6ca44d23ab8773f2d1973314com35510.35510.internaldb.Resources_meta.value", "%7B%22handlebars.js%22%3A%7B%22id%22%3A183015%2C%22ver%22%3A2%2[...]

-\\ Google Chrome v38.0.2125.122


-\\ Opera v25.0.1614.68


*************************

AdwCleaner[R0].txt - [3176 octets] - [14/11/2014 18:59:30]
AdwCleaner[R1].txt - [3236 octets] - [14/11/2014 19:05:14]
AdwCleaner[s0].txt - [2983 octets] - [14/11/2014 19:06:55]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [3043 octets] ##########

Линк към коментара
Сподели в други сайтове

Имам проблем със стъпка 2. Не ми експортва лог файл  с името JRT.txt. Нямам такъв файл, правя всичко както е описано, но няма такъв файл ...

Линк към коментара
Сподели в други сайтове

Стъпка 3

 

Сканирах с Malwares, но не открива нищо върху, което да приложа Apply Actions, дори го няма като активен бутон, предполагам защото не открива нищо.

 

 

Стъпка 4

 

HitmanPro 3.7.9.232
www.hitmanpro.com

   Computer name . . . . : USER-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : User-PC\User
   UAC . . . . . . . . . : Disabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2014-11-15 22:41:06
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 5m 16s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 1
   Traces  . . . . . . . : 97

   Objects scanned . . . : 1 469 589
   Files scanned . . . . : 29 267
   Remnants scanned  . . : 312 208 files / 1 128 114 keys

Miniport ____________________________________________________________________

   Primary
      DriverObject . . . : FFFFFA8006082B80
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo  . . . . . : 0000000000000000 +0
      IRP_MJ_SCSI  . . . : FFFFFA80051992C0 +0
   Solution
      DriverObject . . . : FFFFFA8006082B80
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo  . . . . . : 0000000000000000 +0
      IRP_MJ_SCSI  . . . : FFFFF88000E074D8 \SystemRoot\system32\drivers\ataport.SYS+29912

Malware _____________________________________________________________________

   C:\Users\User\AppData\Local\Installer\Install_11035\ytaia.exe
      Size . . . . . . . : 811 920 bytes
      Age  . . . . . . . : 198.5 days (2014-05-01 11:42:27)
      Entropy  . . . . . : 6.6
      SHA-256  . . . . . : EAA42D74A6226C118160049537F1CA7F3A174AF8F9513FA281C064CDDFC1D90A
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
    > Bitdefender  . . . : Adware.Downloader.AB
      Fuzzy  . . . . . . : 99.0


Suspicious files ____________________________________________________________

   C:\Users\User\Desktop\FRST\FRST64.exe
      Size . . . . . . . : 2 116 096 bytes
      Age  . . . . . . . : 3.3 days (2014-11-12 14:19:49)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 5688C72E8362E4813E3970E44D64B00A540BED1A12B7615E2EE9B3C0206D0BB2
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe

   C:\Users\User\Downloads\Nero Burning ROM 2014 15.0.04600\Crack\AdvrCntr6.dll
      Size . . . . . . . : 8 869 712 bytes
      Age  . . . . . . . : 184.0 days (2014-05-15 22:25:53)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : 15ABCFCF3D506F99743743B9FA65F35DE94EF51D468965841DE877FEA5AB9B3E
      Product  . . . . . : AdvrCntr Module
      Publisher  . . . . : Nero AG
      Description  . . . : AdvrCntr Module
      Version  . . . . . : 11.0.4.1
      Copyright  . . . . : Copyright 2013 Nero AG and its licensors
      RSA Key Size . . . : 2048
      LanguageID . . . . : 0
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 22.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.


Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411821192} (SaveSense)
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\Sense-bg.exe (SaveSense)
   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411821192} (SaveSense)
   HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622\ (Linkey)
   HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622\ (Linkey)
   HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622\ (Linkey)
   HKU\.DEFAULT\Software\AppDataLow\Software\Sense\ (SaveSense)
   HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\ (FLV Player)
   HKU\S-1-5-18\Software\AppDataLow\Software\Sense\ (SaveSense)
   HKU\S-1-5-18\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\ (FLV Player)
   HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{54739D49-AC03-4C57-9264-C5195596B3A1} (Linkey)
   HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} (ShopperPro)
   HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} (ShopperPro)

Cookies _____________________________________________________________________

   C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\EGWA7YG1.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\IB275G1V.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\JEI59EMV.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\JLK6B2GW.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\P5KB7ETO.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\V1ECEU5L.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\YDRUZZ1N.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\ZHVY00R7.txt
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:2o7.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ad.360yield.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ad.mlnadvertising.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ad.propellerads.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ad.sbb.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.3bay.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.ad4game.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.adk2.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.betweendigital.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.bg-mamma.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.carpetmax.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.chargeads.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.creative-serving.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.delfin.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.domainbg.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.fhl.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.gamesbannernet.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.indexinfo.org
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.inews.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.kaldata.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.mediade.sk
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.p161.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.pimdesign.org
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.pio.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.playboy.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.pubmatic.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.stickyadstv.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.undertone.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.yahoo.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:adserver.abv.bg
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:adtech.de
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:adtechus.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:advertising.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:at.atwola.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:atdmt.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:bs.serving-sys.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:burstnet.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:casalemedia.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:clickbank.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:collective-media.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:diff3.smartadserver.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:dmtracker.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:doubleclick.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:fastclick.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:googleadservices.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:in.getclicky.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:kontera.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:livejasmin.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:media6degrees.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:mediaplex.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:myroitracking.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:pd0.imp.revsci.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:philips.112.2o7.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:porn-xnick.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:questionmarket.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:realmedia.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:revsci.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ru4.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:serving-sys.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:smartadserver.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:specificclick.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:statcounter.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:stats.complex.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:stats.paypal.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:statse.webtrendslive.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:track.adform.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:track.hubrus.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:tribalfusion.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:uk.at.atwola.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:www.googleadservices.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:yadro.ru
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:zedo.com
Линк към коментара
Сподели в други сайтове

Идеално...и последната стъпка:

 

Изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

Повторете проверката с HitmanPro и публикувайте новия лог файл и след това ще ви дам съвети как да премахнете използваните от нас програми. :)

 

 

Поздрави!

Линк към коментара
Сподели в други сайтове

Здравейте,

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-11-2014
Ran by User at 2014-11-18 12:45:29 Run:3
Running from C:\Users\User\Desktop\FRST
Loaded Profiles: User & UpdatusUser (Available profiles: User & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
C:\Users\User\AppData\Local\Installer\Install_11035\ytaia.exe
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411821192}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\Sense-bg.exe
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411821192}
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\Software\Sense
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
DeleteKey: HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
DeleteKey: HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Unlock: HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Internet Explorer\Approved Extensions
Reg: reg delete "HKU\S-1-5-21-3139533511-3349264603-4081201394-1001\Software\Microsoft\Internet Explorer\Approved Extensions" /v {54739D49-AC03-4C57-9264-C5195596B3A1} /f
end
*****************

"C:\Users\User\AppData\Local\Installer\Install_11035\ytaia.exe" => File/Directory not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411821192} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\Sense-bg.exe => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110411821192} => Key not found.
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622 => Key not found.
HKU\.DEFAULT\Software\AppDataLow\Software\Sense => Key not found.
HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} => Key not found.
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} => Key not found.
HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} => Key not found.
"HKU\S-1-5-21-2812945593-2017259352-232896672-1000\Software\Microsoft\Internet Explorer\Approved Extensions" => Key unlocked successfully.

========= reg delete "HKU\S-1-5-21-3139533511-3349264603-4081201394-1001\Software\Microsoft\Internet Explorer\Approved Extensions" /v {54739D49-AC03-4C57-9264-C5195596B3A1} /f =========



========= End of Reg: =========


==== End of Fixlog ====


Файла от HitmanPro

 

HitmanPro 3.7.9.232
www.hitmanpro.com

   Computer name . . . . : USER-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : User-PC\User
   UAC . . . . . . . . . : Disabled
   License . . . . . . . : Trial (27 days left)

   Scan date . . . . . . : 2014-11-18 12:46:45
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 5m 10s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 33

   Objects scanned . . . : 1 470 807
   Files scanned . . . . : 29 309
   Remnants scanned  . . : 312 261 files / 1 129 237 keys

Miniport ____________________________________________________________________

   Primary
      DriverObject . . . : FFFFFA800607A440
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo  . . . . . : 0000000000000000 +0
      IRP_MJ_SCSI  . . . : FFFFFA80051972C0 +0
   Solution
      DriverObject . . . : FFFFFA800607A440
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo  . . . . . : 0000000000000000 +0
      IRP_MJ_SCSI  . . . : FFFFF88000E074D8 \SystemRoot\system32\drivers\ataport.SYS+29912

Suspicious files ____________________________________________________________

   C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2 116 096 bytes
      Age  . . . . . . . : 5.9 days (2014-11-12 14:19:49)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 5688C72E8362E4813E3970E44D64B00A540BED1A12B7615E2EE9B3C0206D0BB2
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe
          0.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\FRST64.exe

   C:\Users\User\Desktop\FRST\FRST64.exe
      Size . . . . . . . : 2 117 120 bytes
      Age  . . . . . . . : 0.0 days (2014-11-18 12:45:14)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 7D55B30D8568092310909B5B8E0630C67AB498D4A9ABA88B730301C0E91F39D4
      Needs elevation  . : Yes
      Source URL . . . . : hxxp://download.bleepingcomputer.com/dl/f6e9fdb1e0056697fcfa96a9064860d9/546b233b/windows/security/security-utilities/f/farbar-recovery-scan-tool/64/FRST64.exe
      Fuzzy  . . . . . . : 27.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         The file is downloaded from the Internet to this computer.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -4.9s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\sessionstore-backups\previous.js
         -4.6s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\localstore.rdf
         -0.8s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{CDB44728-0174-46FE-B448-CF7A1D9AC4F6}
         -0.2s C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\MUE12VSA.txt
         -0.2s C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QSI1DM6I\82[1].htm
         -0.2s C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\E9ITUHCX.txt
          0.0s C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QSI1DM6I\FRST64[1].exe
          0.0s C:\Users\User\Desktop\FRST\FRST64.exe
          5.0s C:\Users\User\Desktop\FRST\FRST-OlderVersion\
          8.1s C:\Windows\Prefetch\FRST64.EXE-4EB30D76.pf
          8.5s C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QZ1QRCM1\up64[1]
         29.8s C:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf
         32.4s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\webapps\webapps.json
         32.8s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite-wal
         32.8s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite-shm
         32.8s C:\Users\User\AppData\Local\Temp\etilqs_JAU9NlvJxhfKpJF
         32.8s C:\Users\User\AppData\Local\Temp\etilqs_bF47OzxLEpRUoCO
         33.0s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\sessionCheckpoints.json
         33.0s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\webappsstore.sqlite-wal
         33.0s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\webappsstore.sqlite-shm
         34.1s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\directoryLinks.json
         34.3s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\pluginreg.dat
         36.1s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\sessionstore-backups\recovery.bak
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-badbinurl-shavar.cache
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-badbinurl-shavar.pset
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-badbinurl-shavar.sbstore
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-downloadwhite-digest256.cache
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-downloadwhite-digest256.pset
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-downloadwhite-digest256.sbstore
         38.2s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-malware-shavar.cache
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-malware-shavar.pset
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-malware-shavar.sbstore
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-phish-shavar.cache
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-phish-shavar.pset
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\goog-phish-shavar.sbstore
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\test-malware-simple.cache
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\test-malware-simple.pset
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\test-malware-simple.sbstore
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\test-phish-simple.cache
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\test-phish-simple.pset
         38.3s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\safebrowsing\test-phish-simple.sbstore
         42.5s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cache2\entries\1993852583A3F5812353C22CE034AF671112E26A
         42.6s C:\Users\User\AppData\Local\Temp\plugtmp-57\
         43.0s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cache2\entries\00BDB9E3AC703ACDAC6BF159B8CABCEA7B3281BB
         43.0s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cache2\entries\65BD66CE187A1F6442047048595AC1D91FAFC9B6
         43.0s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cache2\entries\BCD4487893BED0B7CB55DC6BF00A354496F0D2A6
         43.2s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\healthreport.sqlite-wal
         43.2s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\healthreport.sqlite-shm
         70.7s C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cache2\entries\27AD20034385946AEA423DCA9B19E7F24C430BAF
         81.2s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\sessionstore-backups\recovery.js
         89.0s C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\crashes\store.json.mozlz4
         92.1s C:\Windows\System32\drivers\hitmanpro37.sys

   C:\Users\User\Downloads\Nero Burning ROM 2014 15.0.04600\Crack\AdvrCntr6.dll
      Size . . . . . . . : 8 869 712 bytes
      Age  . . . . . . . : 186.6 days (2014-05-15 22:25:53)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : 15ABCFCF3D506F99743743B9FA65F35DE94EF51D468965841DE877FEA5AB9B3E
      Product  . . . . . : AdvrCntr Module
      Publisher  . . . . : Nero AG
      Description  . . . : AdvrCntr Module
      Version  . . . . . : 11.0.4.1
      Copyright  . . . . : Copyright 2013 Nero AG and its licensors
      RSA Key Size . . . : 2048
      LanguageID . . . . : 0
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 22.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.


Potential Unwanted Programs _________________________________________________

   ask.com
   C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web Data


Cookies _____________________________________________________________________

   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\667DNXXF.txt
   C:\Users\User\AppData\Roaming\Microsoft\Windows\Cookies\LVUX9Y7Z.txt
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ad.360yield.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ad.mlnadvertising.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.bg-mamma.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.creative-serving.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.kaldata.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.mediade.sk
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.pubmatic.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ads.stickyadstv.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:adtech.de
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:adtechus.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:advertising.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:at.atwola.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:burstnet.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:casalemedia.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:diff3.smartadserver.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:doubleclick.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:googleadservices.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:media6degrees.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:mediaplex.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:revsci.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:ru4.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:smartadserver.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:stats.paypal.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:track.adform.net
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:www.googleadservices.com
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:yadro.ru
   C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\u1ul7cqm.default-1398937453451\cookies.sqlite:zedo.com
 
Линк към коментара
Сподели в други сайтове

Супер, радвам се! :)

 

Няколко финални препоръки:

 

1. Проверете за стари приложения с помощта на PatchMyPC.

 

2. Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run

Инструмента ще се самоизтрие след като приключи своята задача! Ако все пак папката C:\FRST\Quarantine не се е изтрила, то изтрийте я ръчно и после изпразнете кошчето. :)

 

3. За подобряване на производителността (ако системата ви се вижда мудна) вижте следните няколко теми:

 

Оптимизиране на Windows с цел по-добра производителност

Ръководство за поддръжка на Windows (XP, Vista и 7) [Revision 2.0]

Какво да направя, ако компютърът ми работи бавно

Профилактика на компютъра,как?

 

Направете и една дефрагментация с MyDefrag за повишаване на производителноста при дисковите операции: (ще се отрази благоприятно и при често използваните програми):

 

Изтеглете MyDefrag и я инсталирайте.

 

Изтеглете следния архив и го разархивирайте в C:\Program Files\MyDefrag v4.3.1\Scripts

 

Стартирайте MyDefrag.exe и изберете System Disk Level V и посочете системния дял C: и натиснете Run

 

KcdlAEi.jpg

 

Може да отнеме доста време, защото за основа на скрипта са използвани скриптовете на Jaspion и на някои други потребители + мои лични настройки и модификации.

Скрипта ще направи приоритизация на често използваните програми и файлове.

След като приключи ще изпише Finished и можете да затворите програмата от X-са.

 

Рестартирайте системата.

 

Проверете системата си актуални драйвери от сайтовете на производителите на компонентите ако ви се занимава и направете пълна проверка за гадини с наличната ви антивирусна програма.

 

Поздрави и усмихната седмица! Ще маркирам случая като РЕШЕН! :bye1:

Линк към коментара
Сподели в други сайтове

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

  • Разглеждащи това в момента   0 потребители

    Няма регистрирани потребители разглеждащи тази страница.

  • Подобни теми

    • от CaptainJord
      Здравейте, от известно време системата ми не работи както обикновенно. Много често процесора е към 100%, както и другите статистики. Също така, докато съм пуснал някоя игра получавам рязки спадове на FPS, което не е нормално за компютъра ми. Имам стабилна конфигурация GTX 1050 TI 4gb I5 6600k. Теглих какви ли не програми за сканиране на malware - намираха доста зловредни файлове, но уж ги чистят, а пак продължава проблема...
       

       
      Addition.txt FRST.txt

    • от FrankyF
      Здравейте, на скоро ми излезе един попъп :

      И понеже нямах антивирусна преди това исках да направя профилактична проверка.
      Прикачвам FRST & Adition.
      Adition - https://dox.abv.bg/download?id=ec814d8d64# - Линк за сваляне
      ckfiles - https://dox.abv.bg/download?id=e280a29d87# - Линк за сваляне
      FRST - https://dox.abv.bg/download?id=bb2866b435# - Линк за сваляне
      Днес като стартирах PC  видях за около части от секундата 4 терминала които се отвориха и затвориха.
       
      Благодаря предварително.
      Поздрави
    • от blazarow09
      От скоро ползвам машината и след като я закупих(нова) Windows defender беше спрян по подразбиране и на негово място имаше Norton Security, като аз прецених да го оставя, въпреки, че винаги съм ползвал Windows Defender. Преди седмица-две, след сканиране на системата ми излязоха няколко зловредни файла и антивирусната започна да спрами за някакви BitCoin Miners, аз мислех, че съм ги зачистил, но явно все още има останали зловредни файлове и днес ми се наложи да отворя Device Manager-a, като получих това съобщение.
       
      Не усещам разлика в performance-a на самата машина, но искам да съм сигурен, че всичко е наред и няма файлове, които могат да ми навредят за в бъдеще.

      Прикачвам логовете от Farbar и се надявам да ми помогнете. Благодаря предварително!
      Addition.txt FRST.txt
    • от Yanichka
      Здравейте. Имам проблеми с лаптопа ми от известно време - много е бавен, пренатоварва се и CPU-то работи на по-малко от  50%.. Бях посъветвана първо да проверя за вируси и нежелани софтуери, преди да предприема други мерки. Лаптопът е DELL Latitude E5540, Intel inside core i7 vPro. Да кажем, че  е средно на около 6 годинки :)) Коя антивирусна програма бихте ми препоръчали? Ако имате нужда от още информация за лаптопа, само пишете ;))  Благодаря предварително
  • Дарение

×
×
  • Добави ново...

Информация

Поставихме бисквитки на устройството ви за най-добро потребителско изживяване. Можете да промените настройките си за бисквитки, или в противен случай приемаме, че сте съгласни с нашите Условия за ползване