Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

trojan.crypt.nkn Заразени работни файлове

16 декември 201411 г.

Здравейте, десктоп компютъра ми се зарази с този вирус "trojan.crypt.nkn"

Работните ми файлове намиращи се на "C" и "D" дяловете от вида на: .PDF; .doc; DWG; txt; xls; jpg; db; са заразени.

Заразените файлове изглеждата так: .doc.ptlejuj; .DWG.ptlejuj и т.н.

Сканирано е с: Panda for Desktop и Malwarebytes.

ОС Windows 7 Professional x64 с оригинален диск.

Има ли начин да ми се възвърнат изброените файлове?
Благодаря предварително.

................................................

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-12-2014 01
Ran by Polya (administrator) on RD-MC-02 on 16-12-2014 13:49:33
Running from D:\Desktop
Loaded Profile: Polya (Available profiles: Polya)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Panda Software International) C:\Program Files (x86)\Panda Software\AVTC\psksvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Software\AVTC\pavsrvx86.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Software\AVTC\AVENGINE.EXE
() C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Panda Security) C:\Program Files (x86)\Panda Software\AVTC\PSCtrlS.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Software\Panda Administrator 3\Pav_Agent\Pagent.exe
(Panda Security International) C:\Program Files (x86)\Panda Software\AVTC\WebProxy.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Software\Panda Administrator 3\Pav_Agent\Pagentwd.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Software\Panda Administrator 3\Scheduler\pavsched.exe
(Panda Software International) C:\Program Files (x86)\Panda Software\AVTC\pskmssvc.exe
(Panda Security S.L.) C:\Program Files (x86)\Panda Software\AVTC\PSIMSVC.EXE
(Panda Software International) C:\Program Files (x86)\Panda Software\AVTC\SrvLoad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvwmi64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Panda Security) C:\Program Files (x86)\Panda Software\AVTC\PSCtrlC.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Dassault Systèmes SolidWorks Corp.) C:\Program Files\SolidWorks Corp\SolidWorks\sldworks_fs.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Panda Controller Client] => C:\Program Files (x86)\Panda Software\AVTC\PSCtrlC.exe [153088 2011-10-19] (Panda Security)
HKU\S-1-5-21-1454870242-119165659-2757249019-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks 2014 Fast Start.lnk
ShortcutTarget: SolidWorks 2014 Fast Start.lnk -> C:\Windows\Installer\{4FFA60C4-9A8B-4C9E-8265-2241B266304C}\NewShortcut2_87EDF6C81D0A4B7B84F42FE0C6A9D608.exe (Flexera Software LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SolidWorks Background Downloader.lnk
ShortcutTarget: SolidWorks Background Downloader.lnk -> C:\Program Files (x86)\Common Files\SolidWorks Installation Manager\BackgroundDownloading\sldBgDwld.exe (Dassault Systèmes SolidWorks Corp.)
Startup: C:\Users\Polya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netfix.bat - Shortcut.lnk
ShortcutTarget: Netfix.bat - Shortcut.lnk -> D:\Programs\Netfix.bat ()
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1454870242-119165659-2757249019-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1454870242-119165659-2757249019-1000 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1454870242-119165659-2757249019-1000 -> 6039FB13D9CB4CC7AFEC9FF66A5CB88C URL = http://yandex.ru/yandsearch?win=127&clid=2052586&text={searchTerms}
SearchScopes: HKU\S-1-5-21-1454870242-119165659-2757249019-1000 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1454870242-119165659-2757249019-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?FORM=U220DF&PC=U220&q={searchTerms}&src=IE-SearchBox
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-1454870242-119165659-2757249019-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog9 01 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9 02 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9 03 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9 04 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9 05 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9 06 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9 17 C:\Program Files (x86)\Panda Software\AVTC\pavlsp.dll [176128] (Panda Software International)
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Winsock: Catalog9-x64 05 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Winsock: Catalog9-x64 06 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Winsock: Catalog9-x64 17 C:\Program Files (x86)\Panda Software\AVTC\pavlsp64.dll [214272] (Panda Software International)
Tcpip\..\Interfaces\{C69D4B60-4052-415F-9956-217C200C7BB1}: [NameServer] 192.168.1.45,192.168.1.46

FireFox:
========
FF ProfilePath: C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\searchplugins\yandex.ru-103851.xml
FF SearchPlugin: C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\searchplugins\yqs-barff-yandex.xml
FF Extension: Візуальныя закладкі - C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\Extensions\[email protected] [2014-07-30]
FF Extension: Кампанент "Элементы Яндекса" - C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\Extensions\[email protected] [2014-07-14]
FF Extension: rollApp File Opener - C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\Extensions\[email protected] [2014-02-13]
FF Extension: SuperMegaBest.com - C:\Users\Polya\AppData\Roaming\Mozilla\Firefox\Profiles\c5ao093p.default\Extensions\[email protected] [2013-11-28]
FF HKLM\...\Firefox\Extensions: [jid1-n5ARdBzHkUEdAA@jetpack] - C:\Users\Polya\AppData\Roaming\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack
FF Extension: SuperMegaBest.com - C:\Users\Polya\AppData\Roaming\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack [2014-11-24]
FF HKLM-x32\...\Firefox\Extensions: [jid1-n5ARdBzHkUEdAA@jetpack] - C:\Users\Polya\AppData\Roaming\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "about:blank"
CHR DefaultSearchKeyword: Default -> Google
CHR DefaultSearchURL: Default -> http://www.google.com/search?q={searchTerms}
CHR Profile: C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-19]
CHR Extension: (SuperMegaBest.com) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\aonedlchkbicmhepimiahfalheedjgbh [2014-12-16]
CHR Extension: (Google Drive) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-19]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-19]
CHR Extension: (YouTube) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-19]
CHR Extension: (Google Search) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-19]
CHR Extension: (Google Wallet) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-19]
CHR Extension: (Gmail) - C:\Users\Polya\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-19]
CHR HKLM-x32\...\Chrome\Extension: [aonedlchkbicmhepimiahfalheedjgbh] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2014-12-16] (Elex do Brasil Participações Ltda)
S4 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72304 2010-01-19] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [1248544 2013-06-21] (NVIDIA Corporation)
R2 Panda Software Controller; C:\Program Files (x86)\Panda Software\AVTC\PsCtrlS.exe [328704 2012-04-02] (Panda Security)
R2 PAVAGENTE; C:\Program Files (x86)\Panda Software\Panda Administrator 3\Pav_Agent\Pagent.exe [439616 2010-09-30] (Panda Security, S.L.)
R2 PavAtScheduler; C:\Program Files (x86)\Panda Software\Panda Administrator 3\Scheduler\pavsched.exe [255296 2010-09-30] (Panda Security, S.L.)
S3 PavReport; C:\Program Files (x86)\Panda Software\Panda Administrator 3\PavReport\PavReport.exe [767296 2011-02-21] (Panda Security, S.L.)
R2 PavSrv; C:\Program Files (x86)\Panda Software\AVTC\PavSrvX86.exe [184576 2012-05-07] (Panda Security, S.L.)
R2 PMShellSrv; C:\Program Files (x86)\Panda Software\AVTC\PSKMsSvc.exe [67120 2007-01-15] (Panda Software International)
R2 PsImSvc; C:\Program Files (x86)\Panda Software\AVTC\PsImSvc.exe [107328 2010-06-25] (Panda Security S.L.)
R2 PskSvc; C:\Program Files (x86)\Panda Software\AVTC\PskSvc.exe [27968 2010-08-16] (Panda Software International)
S3 SolidWorks Licensing Service; C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2013-11-25] (SolidWorks) [File not signed]
S2 DES2 Service; "C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [69896 2012-03-09] (Panda Security, S.L.)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-27] ()
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-07-15] (Disc Soft Ltd)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2013-07-16] ()
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2014-12-16] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2014-12-16] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2014-12-16] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [65704 2014-12-16] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [49320 2014-11-03] (Elex do Brasil Participações Ltda)
R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S0 688d7dc5c2ee541b; \SystemRoot\System32\Drivers\688d7dc5c2ee541b.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-16 13:49 - 2014-12-16 13:49 - 00000000 ____D () C:\FRST
2014-12-16 13:12 - 2014-12-16 13:12 - 00000000 ____D () C:\Windows\system32\log
2014-12-16 13:12 - 2014-12-16 13:12 - 00000000 ____D () C:\Users\Polya\AppData\Roaming\Elex-tech
2014-12-16 13:12 - 2014-12-16 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2014-12-16 13:12 - 2014-12-16 13:12 - 00000000 ____D () C:\Program Files (x86)\Elex-tech
2014-12-16 13:12 - 2014-12-16 11:02 - 00045224 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2014-12-16 13:12 - 2014-11-03 11:04 - 00049320 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2014-12-16 13:10 - 2014-12-16 13:10 - 00000000 ____D () C:\Users\Polya\AppData\Roaming\eCyber
2014-12-16 13:05 - 2014-12-16 13:05 - 00000000 __SHD () C:\Users\Polya\AppData\Local\EmieUserList
2014-12-16 13:05 - 2014-12-16 13:05 - 00000000 __SHD () C:\Users\Polya\AppData\Local\EmieSiteList
2014-12-16 13:05 - 2014-12-16 13:05 - 00000000 __SHD () C:\Users\Polya\AppData\Local\EmieBrowserModeList
2014-12-16 10:44 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-12-16 10:36 - 2014-12-16 10:36 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-12-16 10:34 - 2014-12-16 10:34 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-16 10:34 - 2014-12-16 10:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-16 10:34 - 2014-12-16 10:34 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-16 10:34 - 2014-12-16 10:34 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-16 10:34 - 2014-12-16 10:34 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-12-16 10:34 - 2014-12-16 10:34 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-12-16 10:34 - 2014-12-16 10:34 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-12-16 10:34 - 2014-12-16 10:34 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-12-16 10:34 - 2014-12-16 10:34 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-12-16 10:34 - 2014-12-16 10:34 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-12-16 10:34 - 2014-12-16 10:34 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-12-16 10:34 - 2014-12-16 10:34 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-12-16 10:34 - 2014-12-16 10:34 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-12-16 10:31 - 2014-12-16 10:31 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-12-16 10:31 - 2014-12-16 10:31 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-12-16 10:31 - 2014-12-16 10:31 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-12-16 10:31 - 2014-12-16 10:31 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-12-16 10:31 - 2014-12-16 10:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-12-16 10:31 - 2014-12-16 10:31 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-12-16 10:30 - 2014-12-16 10:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-12-16 10:30 - 2014-12-16 10:30 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-12-16 10:30 - 2014-12-16 10:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2014-12-16 10:30 - 2014-12-16 10:30 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2014-12-16 10:27 - 2014-12-16 10:44 - 00014751 _____ () C:\Windows\IE11_main.log
2014-12-15 16:16 - 2014-12-15 16:16 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\447D414F.sys
2014-12-15 16:09 - 2014-12-15 16:09 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\2E303C21.sys
2014-12-15 15:46 - 2014-12-15 15:46 - 00003012 _____ () C:\Windows\System32\Tasks\denhogm
2014-12-15 15:45 - 2014-12-16 08:36 - 00000000 ____D () C:\Users\Polya\AppData\Roaming\RD-MC-02
2014-12-05 15:59 - 2014-12-15 15:48 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center
2014-12-05 15:59 - 2014-12-05 15:59 - 00003118 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe
2014-12-05 15:59 - 2014-12-05 15:59 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe
2014-12-05 15:59 - 2014-12-05 15:59 - 00003090 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe
2014-12-05 15:59 - 2014-12-05 15:59 - 00003062 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe
2014-12-05 15:59 - 2014-12-05 15:59 - 00003060 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe
2014-12-05 15:59 - 2014-12-05 15:59 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf
2014-12-05 15:59 - 2014-12-05 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Mouse and Keyboard Center

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-16 13:46 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-16 13:46 - 2009-07-14 06:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-16 13:29 - 2013-07-15 12:39 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-16 13:12 - 2013-07-15 12:25 - 00132440 _____ () C:\Users\Polya\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-16 13:03 - 2014-08-19 14:33 - 00000998 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-16 13:03 - 2009-07-14 07:13 - 00782986 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-16 13:01 - 2013-07-15 12:22 - 01791022 _____ () C:\Windows\WindowsUpdate.log
2014-12-16 13:00 - 2013-12-17 10:42 - 00000000 ____D () C:\Users\Polya\AppData\Roaming\Skype
2014-12-16 12:59 - 2014-10-31 15:13 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-16 12:59 - 2013-07-15 12:23 - 00001413 _____ () C:\Users\Polya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-16 12:58 - 2013-10-30 08:13 - 00025879 _____ () C:\Windows\setupact.log
2014-12-16 12:58 - 2013-07-15 12:58 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-16 12:58 - 2010-11-21 05:47 - 00035292 _____ () C:\Windows\PFRO.log
2014-12-16 12:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-16 12:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-16 08:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\IME
2014-12-16 08:26 - 2014-10-31 15:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-16 08:26 - 2014-10-31 15:12 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-15 16:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Branding
2014-12-15 16:04 - 2013-11-25 11:02 - 00000000 ____D () C:\Users\Polya\AppData\Local\SolidWorks
2014-12-15 16:04 - 2013-07-15 12:22 - 00000000 ____D () C:\Users\Polya
2014-12-15 16:02 - 2013-11-25 11:03 - 00000000 ____D () C:\Users\Polya\AppData\Local\TempSWBackupDirectory
2014-12-15 16:02 - 2013-07-16 09:31 - 00000000 ____D () C:\Users\Polya\AppData\Local\cache
2014-12-15 15:51 - 2013-12-17 10:42 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-15 15:50 - 2013-07-15 18:15 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-12-15 15:50 - 2013-07-15 12:36 - 00000000 ____D () C:\Program Files (x86)\IZArc
2014-12-15 15:48 - 2013-07-15 12:57 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-12-15 15:47 - 2013-07-15 12:34 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-12-15 10:09 - 2014-07-22 14:51 - 00000000 ____D () C:\temp
2014-12-13 17:36 - 2013-07-16 10:30 - 00363456 ____H () C:\Users\Polya\AppData\Local\IconCache.db.ptlejuj
2014-12-10 16:23 - 2009-07-14 07:08 - 00032542 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-10 12:29 - 2013-07-15 12:39 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-10 12:29 - 2013-07-15 12:39 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-10 12:29 - 2013-07-15 12:39 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-06 10:45 - 2009-07-14 06:45 - 00445152 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-04 08:47 - 2013-12-17 10:42 - 00000000 ____D () C:\ProgramData\Skype
2014-11-25 08:36 - 2014-06-05 10:18 - 00000000 ____D () C:\supermegabest
2014-11-24 10:38 - 2014-06-05 10:21 - 00000000 ____D () C:\Users\Polya\AppData\Roaming\Yandex
2014-11-21 06:14 - 2014-10-31 15:12 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-21 06:14 - 2014-10-31 15:12 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-21 06:14 - 2014-10-31 15:12 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

Some content of TEMP:
====================
C:\Users\Polya\AppData\Local\Temp\Foxit Reader Updater.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe IS MISSING <==== ATTENTION!.
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-12-05 09:59

==================== End Of Log ============================

Addition.txt

Редактирано 16 декември 201411 г. от Pavlina Azmanova (преглед на промените)

16 декември 201411 г.

Здравейте,

За съжаление почти сигурно е, че можете да забравите за тези файлове. Новите варианти на повечето криптиращи вируси използват C&C server от където се тегли декриптиращия ключ и не го оставя на компютъра, както правеше досега и затова не може да се създаде инструмент, който да обърне процеса. Вариантите са три:

1. Плащате си на злосторниците (със съмнителен ефект, но понякога с успех).

2. Пробвате да възстановите файлове по начините описани тук: CTB Locker and Critroni Ransomware Information Guide and FAQ

3. Отписвате файловете си завинаги.

Операционната Система може да бъде почистена и без форматиране, но файловете няма как да бъдат декртиптирани независимо дали ще решите да използвате нашите инструменти и методи за почистване или ще форматирате. По втория начин ефекта ще е по-сигурна и чиста система, но пък преинсталацията е досаден момент, особено за хора неразполагащи с много свободно време за настройване и конфигурацията на всички програми от нулата.

В случая за този тип гадини превенцията е по-доброто решение. Стигне ли се до почистване вече е късно. Този тип вируси са по десктруктивни и от полиморфните бацили, които заразяват всички изпълними файлове. Тук целта е друга - извличане на лични настройки, акаунти, пароли (компрометиране на системата) и криптиране на всички важни документи в опит на изнудване на потребителите да си платят за да възстановят достъпа си до така важните файлове.

В момента с екипа подготвяме тема за запознаване на потребителите с основните детайли, които трябва да знаят за да се опазят от подобни зловредни програми. Процеса е бавен, защото използваме главно уикендите, а сега с всички тези празници просто времето съвсем отеснява.

Поздрави!

17 декември 201411 г.

Автор

Здравейте,

За съжаление почти сигурно е, че можете да забравите за тези файлове. Новите варианти на повечето криптиращи вируси използват C&C server от където се тегли декриптиращия ключ и не го оставя на компютъра, както правеше досега и затова не може да се създаде инструмент, който да обърне процеса. Вариантите са три:

1. Плащате си на злосторниците (със съмнителен ефект, но понякога с успех).

2. Пробвате да възстановите файлове по начините описани тук: CTB Locker and Critroni Ransomware Information Guide and FAQ

3. Отписвате файловете си завинаги.

Операционната Система може да бъде почистена и без форматиране, но файловете няма как да бъдат декртиптирани независимо дали ще решите да използвате нашите инструменти и методи за почистване или ще форматирате. По втория начин ефекта ще е по-сигурна и чиста система, но пък преинсталацията е досаден момент, особено за хора неразполагащи с много свободно време за настройване и конфигурацията на всички програми от нулата.

В случая за този тип гадини превенцията е по-доброто решение. Стигне ли се до почистване вече е късно. Този тип вируси са по десктруктивни и от полиморфните бацили, които заразяват всички изпълними файлове. Тук целта е друга - извличане на лични настройки, акаунти, пароли (компрометиране на системата) и криптиране на всички важни документи в опит на изнудване на потребителите да си платят за да възстановят достъпа си до така важните файлове.

В момента с екипа подготвяме тема за запознаване на потребителите с основните детайли, които трябва да знаят за да се опазят от подобни зловредни програми. Процеса е бавен, защото използваме главно уикендите, а сега с всички тези празници просто времето съвсем отеснява.

Поздрави!

Много Ви благодаря за бързият отговор. Ще пробваме Вашето предложение и ще споделим за крайният резултат.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.