Премини към съдържанието

Препоръчан отговор


омпютърът ми върви  добре, но имам един проблем.Когато някой ми звънне по скайп или аз звънна по скайпа на някой, Компютъра ми забива смисъл ако е пусната музика тя си върви нормално , той забива и монитора ми се гаси. По някой път се оправя рядко и незнам от какво е и как да го оправя , моля ако някой знае да помогне ще съм благодарен :) :)      

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Следвай стъпките от тази тема; 

 

Системата ми е инфектирана - Какво да правя сега?

Сподели този отговор


Линк към този отговор
Сподели в други сайтове
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-12-2014
Ran by Radi (administrator) on RADI-PC on 19-12-2014 20:53:43
Running from E:\Greek
Loaded Profile: Radi (Available profiles: Radi)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Български (България)
Internet Explorer Version 11
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(EFD Software) C:\Program Files (x86)\HD Tune Pro\HDTunePro.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-09-15] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\...\Policies\Explorer: [NoFolderOptions] 1
HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\...\MountPoints2: {4487c9ee-212d-11e4-ba98-94de808d81b1} - F:\setup.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hp&ts=1407832072&from=smt&uid=WDCXWD10EZEX-22BN5A0_WD-WCC3F422854028540
HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1407832072&from=smt&uid=WDCXWD10EZEX-22BN5A0_WD-WCC3F422854028540
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKU\S-1-5-21-3713473699-1209246516-1782926497-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1407832072&from=smt&uid=WDCXWD10EZEX-22BN5A0_WD-WCC3F422854028540&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3713473699-1209246516-1782926497-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1407832072&from=smt&uid=WDCXWD10EZEX-22BN5A0_WD-WCC3F422854028540&q={searchTerms}
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> c:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> c:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 77.76.146.254 77.76.146.242
 
FireFox:
========
FF ProfilePath: C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default
FF NewTab: chrome://quick_start/content/index.html
FF Homepage: wwww.google.bg
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll No File
FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> c:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> c:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-3713473699-1209246516-1782926497-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Radi\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default\user.js
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml
FF Extension: Avira Browser Safety - C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default\Extensions\abs@avira.com [2014-11-10]
FF Extension: checkCompatibility - C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default\Extensions\check-compatibility@dactyl.googlecode.com.xpi [2014-08-05]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF Extension: No Name - C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default\extensions\ascsurfingprotection@iobit.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\IObit Apps Toolbar\FF [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://isearch.avg.com/?cid={371CD185-1098-405C-A887-68800FA73379}&mid=2deccce88d7347d08f2fd15696539cfa-47756f9e090d07e80bca7818d5ccd485acc99d5b&lang=en&ds=is015&pr=sa&d=2012-12-27 08:23:28&v=13.2.0.4&sap=hp
CHR StartupUrls: Default -> "hxxp://isearch.avg.com/?cid={371CD185-1098-405C-A887-68800FA73379}&mid=2deccce88d7347d08f2fd15696539cfa-47756f9e090d07e80bca7818d5ccd485acc99d5b&lang=en&ds=is015&pr=sa&d=2012-12-27 08:23:28&v=13.2.0.4&sap=hp"
CHR Profile: C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Документи) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-12]
CHR Extension: (Google Диск) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-12]
CHR Extension: (YouTube) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-12]
CHR Extension: (Adblock Plus) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-08-28]
CHR Extension: (Google Търсене) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-12]
CHR Extension: (Avira Browser Safety) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-10]
CHR Extension: (Hangouts) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2014-08-30]
CHR Extension: (Google Wallet) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-12]
CHR Extension: (Gmail) - C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-12]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-08-13] ()
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [293088 2014-09-16] (Advanced Micro Devices)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22680 2012-10-25] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-08-12] (Disc Soft Ltd)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-12-19 20:53 - 2014-12-19 20:53 - 00000000 ____D () C:\FRST
2014-12-19 20:25 - 2014-12-19 20:25 - 00001037 _____ () C:\Users\Radi\Desktop\HD Tune Pro.lnk
2014-12-19 20:25 - 2014-12-19 20:25 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\HD Tune Pro
2014-12-19 20:25 - 2014-12-19 20:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro
2014-12-19 20:25 - 2014-12-19 20:25 - 00000000 ____D () C:\Program Files (x86)\HD Tune Pro
2014-12-19 16:40 - 2014-12-19 16:40 - 00000796 _____ () C:\Users\Public\Desktop\Speccy.lnk
2014-12-19 16:40 - 2014-12-19 16:40 - 00000000 ____D () C:\Program Files\Speccy
2014-12-18 19:35 - 2014-12-18 19:35 - 00001144 _____ () C:\Windows\PFRO.log
2014-12-18 17:19 - 2014-12-19 16:34 - 00000280 _____ () C:\Windows\setupact.log
2014-12-18 17:19 - 2014-12-18 17:19 - 00268392 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-18 17:19 - 2014-12-18 17:19 - 00000000 _____ () C:\Windows\setuperr.log
2014-12-17 22:10 - 2014-12-13 07:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-17 22:10 - 2014-12-13 05:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-15 22:49 - 2014-12-15 22:49 - 00058016 _____ () C:\Users\Radi\AppData\Local\GDIPFONTCACHEV1.DAT
2014-12-14 20:56 - 2014-12-14 20:56 - 00002697 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-12-14 20:56 - 2014-12-14 20:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-12-14 12:35 - 2014-12-14 14:46 - 00000000 ____D () C:\Users\Radi\AppData\Local\PrivaZer
2014-12-14 12:35 - 2014-12-14 12:35 - 00001901 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrivaZer.lnk
2014-12-14 12:35 - 2014-12-14 12:35 - 00001889 _____ () C:\Users\Public\Desktop\PrivaZer.lnk
2014-12-14 12:35 - 2014-12-14 12:35 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PrivaZer
2014-12-14 12:35 - 2014-12-14 12:35 - 00000000 ____D () C:\ProgramData\privazer
2014-12-14 12:35 - 2014-12-14 12:35 - 00000000 ____D () C:\Program Files (x86)\PrivaZer
2014-12-11 07:18 - 2014-12-11 07:18 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-12-11 03:01 - 2014-10-18 04:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-11 03:01 - 2014-10-18 03:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-10 12:54 - 2014-11-27 03:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 12:54 - 2014-11-27 03:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 12:54 - 2014-11-22 05:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 12:54 - 2014-11-22 05:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 12:54 - 2014-11-22 05:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 12:54 - 2014-11-22 04:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 12:54 - 2014-11-22 04:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 12:54 - 2014-11-22 04:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 12:54 - 2014-11-22 04:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 12:54 - 2014-11-22 04:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 12:54 - 2014-11-22 04:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 12:54 - 2014-11-22 04:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 12:54 - 2014-11-22 04:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 12:54 - 2014-11-22 04:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 12:54 - 2014-11-22 04:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 12:54 - 2014-11-22 04:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 12:54 - 2014-11-22 04:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 12:54 - 2014-11-22 04:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 12:54 - 2014-11-22 04:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 12:54 - 2014-11-22 04:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 12:54 - 2014-11-22 04:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 12:54 - 2014-11-22 04:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 12:54 - 2014-11-22 04:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 12:54 - 2014-11-22 04:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 12:54 - 2014-11-22 04:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 12:54 - 2014-11-22 04:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 12:54 - 2014-11-22 04:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 12:54 - 2014-11-22 04:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 12:54 - 2014-11-22 04:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 12:54 - 2014-11-22 03:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 12:54 - 2014-11-22 03:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 12:54 - 2014-11-22 03:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 12:54 - 2014-11-22 03:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 12:54 - 2014-11-22 03:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 12:54 - 2014-11-22 03:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 12:54 - 2014-11-22 03:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 12:54 - 2014-11-22 03:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 12:54 - 2014-11-22 03:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 12:54 - 2014-11-22 03:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 12:54 - 2014-11-22 03:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 12:54 - 2014-11-22 03:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 12:54 - 2014-11-22 03:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 12:54 - 2014-11-22 03:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 12:54 - 2014-11-22 03:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 12:54 - 2014-11-22 03:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-10 12:54 - 2014-11-22 03:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 12:54 - 2014-11-22 03:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 12:54 - 2014-11-22 03:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 12:54 - 2014-11-22 03:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 12:54 - 2014-11-22 03:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 12:54 - 2014-11-22 03:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 12:54 - 2014-11-22 03:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 12:54 - 2014-11-22 02:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 12:54 - 2014-11-22 02:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 12:54 - 2014-11-11 05:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 12:54 - 2014-11-11 04:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 12:54 - 2014-11-11 03:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-10 12:53 - 2014-11-08 05:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-10 12:53 - 2014-11-08 04:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-10 12:53 - 2014-10-30 04:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-10 12:53 - 2014-10-30 03:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-10 12:53 - 2014-10-03 04:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-10 12:53 - 2014-10-03 04:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 12:53 - 2014-10-03 04:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-10 12:53 - 2014-10-03 04:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-10 12:53 - 2014-10-03 04:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 12:53 - 2014-10-03 03:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-10 12:53 - 2014-10-03 03:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-10 12:53 - 2014-10-03 03:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-10 12:53 - 2014-10-03 03:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-10 12:53 - 2014-10-03 03:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-08 19:35 - 2014-12-08 19:35 - 00635204 ____N () C:\Windows\Minidump\120814-20030-01.dmp
2014-12-08 19:23 - 2014-12-08 19:23 - 00002560 _____ () C:\Windows\SysWOW64\SecuredImage32.dll
2014-12-08 19:18 - 2014-12-08 19:18 - 00000824 _____ () C:\Users\Public\Desktop\Flex Anticheat Counter-Strike 1.6 Sector Edition.lnk
2014-12-06 12:58 - 2014-12-06 12:58 - 00067833 _____ () C:\Users\Radi\Desktop\Без заглавие (2).wma
2014-11-23 22:46 - 2014-11-23 22:46 - 00003704 _____ () C:\Windows\System32\Tasks\Java Update Scheduler
2014-11-23 22:35 - 2014-11-23 22:35 - 00000000 ____D () C:\Users\Radi\AppData\Local\qb9267D9.C4
2014-11-23 22:30 - 2014-11-23 22:30 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\AVG
2014-11-23 22:30 - 2014-11-23 22:30 - 00000000 ____D () C:\Users\Radi\AppData\Local\AVG
2014-11-23 22:29 - 2014-11-23 22:46 - 00000000 __SHD () C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
2014-11-23 22:29 - 2014-11-23 22:31 - 00000000 ____D () C:\ProgramData\AVG
2014-11-21 22:01 - 2014-11-21 22:01 - 00000000 __SHD () C:\Users\Radi\AppData\Local\EmieBrowserModeList
2014-11-19 13:16 - 2014-11-11 05:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 13:16 - 2014-11-11 05:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 13:16 - 2014-11-11 04:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 13:16 - 2014-11-11 04:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-12-19 20:50 - 2014-11-06 20:59 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\Skype
2014-12-19 20:40 - 2014-08-02 19:28 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-19 20:17 - 2014-08-12 11:17 - 00000998 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-19 18:17 - 2014-08-12 11:17 - 00000994 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-19 16:41 - 2009-07-14 06:45 - 00026768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-19 16:41 - 2009-07-14 06:45 - 00026768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-19 16:40 - 2009-07-14 07:13 - 00781790 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-19 16:37 - 2014-08-02 18:52 - 01872045 _____ () C:\Windows\WindowsUpdate.log
2014-12-19 16:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-18 13:32 - 2014-08-02 19:41 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\uTorrent
2014-12-14 20:57 - 2014-08-03 11:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-14 20:56 - 2014-08-02 19:27 - 00000000 ____D () C:\ProgramData\Skype
2014-12-14 12:55 - 2014-08-02 17:20 - 00001102 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-12-14 12:55 - 2014-08-02 17:20 - 00001090 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-12-14 11:06 - 2014-08-02 19:28 - 00000000 ____D () C:\The KMPlayer
2014-12-13 23:19 - 2014-08-02 19:35 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-12-13 03:02 - 2014-08-12 11:18 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-11 21:16 - 2014-08-02 15:23 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-12-11 14:40 - 2014-08-02 19:28 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-11 14:40 - 2014-08-02 19:28 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-11 14:40 - 2014-08-02 19:28 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-11 08:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-12-11 03:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\bg-BG
2014-12-11 03:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\bg-BG
2014-12-11 03:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-11 03:03 - 2014-08-03 11:53 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 03:02 - 2014-08-03 11:53 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-08 19:37 - 2014-08-02 15:30 - 00000000 ____D () C:\ProgramData\ProductData
2014-12-08 19:36 - 2014-08-02 18:01 - 00000000 ____D () C:\Windows\Minidump
2014-12-04 18:49 - 2014-11-01 23:37 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HLDS
2014-12-04 18:49 - 2014-11-01 23:37 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Half-Life
2014-12-04 18:49 - 2014-08-02 19:20 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-12-04 13:42 - 2014-08-02 14:57 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-11-25 16:49 - 2014-08-02 18:52 - 00000000 ____D () C:\Users\Radi\AppData\Local\VirtualStore
2014-11-24 14:04 - 2010-11-21 05:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-23 22:37 - 2014-09-27 16:09 - 00000697 _____ () C:\Users\Radi\Desktop\Нов текстов документ.txt
2014-11-23 22:27 - 2014-08-02 18:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-11-23 21:51 - 2014-08-12 10:26 - 00000000 ____D () C:\Users\Radi\AppData\Roaming\DAEMON Tools Lite
2014-11-21 16:44 - 2014-08-12 10:28 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
 
Some content of TEMP:
====================
C:\Users\Radi\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Radi\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Radi\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Radi\AppData\Local\Temp\SDShelEx-x64.dll
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-12-18 22:54
 
==================== End Of Log ============================

ПИШЕ ЧЕ ФАЙЛА Е 2.19МБ И НЕ МОЖЕ...




 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-12-2014
Ran by Radi at 2014-12-19 20:54:17
Running from E:\Greek
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
µTorrent (HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\...\uTorrent) (Version: 3.4.2.35702 - BitTorrent Inc.)
ACP Application (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{C2956908-53A3-88FC-B795-B16508296FC4}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Counter-Strike 1.6 Version 29, Exe build: 3647 (HKLM-x32\...\{4FF4016F-793C-4AFC-AE78-E2E8E70F36DB}_is1) (Version:  - CS.SECTOR.BG)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Easy Tune 6 B12.1102.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.1102.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version:  - EFD Software)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
ON_OFF Charge B12.1025.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
PrivaZer (HKLM-x32\...\PrivaZer) (Version: 2.23.0.0 - Goversoft LLC)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.49.927.2011 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6519 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.27 - Piriform)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
The KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 3.9.0.125 - PandoraTV)
uGet, версия 2.0.9 (HKLM-x32\...\uGet_VGI_is1) (Version: 2.0.9 - Vladimir Ivanov)
Unity Web Player (HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows 7 Manager (HKLM\...\{5786DC69-5C32-44DC-AA3F-68D88A6044D5}) (Version: 4.2.2 - Yamicsoft)
WinRAR 5.10 (64-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
CustomCLSID: HKU\S-1-5-21-3713473699-1209246516-1782926497-1000_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
 
==================== Restore Points  =========================
 
09-12-2014 07:46:40 Windows Update
11-12-2014 03:00:41 Windows Update
13-12-2014 03:00:26 Windows Update
14-12-2014 08:22:06 Removed Click to Call with Skype
14-12-2014 08:22:52 Removed Skype™ 7.0
14-12-2014 20:54:20 Removed Skype™ 5.9
16-12-2014 07:59:13 Windows Update
18-12-2014 03:00:32 Windows Update
18-12-2014 19:06:38 Архивиране в Windows
18-12-2014 19:19:22 AVG PC TuneUp 2014 е премахнат
18-12-2014 19:27:49 AVG PC TuneUp 2014 (en-GB) е премахнат
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {263F0F69-C747-474E-81EF-25B36952CAD1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-11] (Adobe Systems Incorporated)
Task: {8857EA50-B8B8-43BA-96F9-78314EF1758F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-12] (Google Inc.)
Task: {BD8F66CD-7B17-4CE9-898E-79B6B3755B60} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
Task: {EDE4CBC9-549D-43FD-AB8D-FF70BE244E63} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-12] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2010-07-15 06:44 - 2010-07-15 06:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2014-12-14 12:35 - 2014-12-14 12:35 - 03525431 _____ () C:\Program Files (x86)\PrivaZer\PrivaMenu5.dll
2014-08-13 01:20 - 2014-08-13 01:40 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-12-13 03:02 - 2014-12-06 03:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll
2014-12-13 03:02 - 2014-12-06 03:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll
2014-12-13 03:02 - 2014-12-06 03:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll
2014-12-13 03:02 - 2014-12-06 03:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll
2014-08-02 19:16 - 2012-06-25 09:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
2014-12-13 03:02 - 2014-12-06 03:50 - 14913352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (whitelisted) =============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
(Currently there is no automatic fix for this section.)
 
 
========================= Accounts: ==========================
 
Administrator (S-1-5-21-3713473699-1209246516-1782926497-500 - Administrator - Disabled)
Guest (S-1-5-21-3713473699-1209246516-1782926497-501 - Limited - Disabled)
Radi (S-1-5-21-3713473699-1209246516-1782926497-1000 - Administrator - Enabled) => C:\Users\Radi
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (12/19/2014 04:40:14 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (12/19/2014 04:40:14 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (12/19/2014 04:35:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (12/18/2014 07:39:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (12/18/2014 07:39:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (12/18/2014 07:37:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (12/18/2014 07:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (12/18/2014 07:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
Error: (12/18/2014 07:03:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (12/18/2014 06:56:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: Unable to read the performance counter strings defined for the 002 language ID. The first DWORD in the Data section contains the Win32 error code.
 
 
System errors:
=============
Error: (12/19/2014 04:34:05 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 14:06:24 ч. on ‎19.‎12.‎2014 ‎г. was unexpected.
 
Error: (12/18/2014 07:35:33 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 19:34:34 ч. on ‎18.‎12.‎2014 ‎г. was unexpected.
 
Error: (12/18/2014 07:01:39 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 19:00:46 ч. on ‎18.‎12.‎2014 ‎г. was unexpected.
 
Error: (12/18/2014 06:51:53 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 18:51:06 ч. on ‎18.‎12.‎2014 ‎г. was unexpected.
 
Error: (12/18/2014 05:19:22 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 13:33:36 ч. on ‎18.‎12.‎2014 ‎г. was unexpected.
 
Error: (12/17/2014 05:27:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга WinDefend.
 
Error: (12/17/2014 05:27:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Изтекъл период на изчакване (30000 милисекунди) при изчакване на отговор за транзакция от услуга Netman.
 
Error: (12/15/2014 07:01:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга Услуга на Google Актуализация (gupdate) не може да бъде стартирана поради следната грешка: 
%%109
 
Error: (12/15/2014 07:01:18 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 109gupdate/comsvc{4EB61BAC-A3B6-4760-9581-655041EF4D69}
 
 
Microsoft Office Sessions:
=========================
Error: (12/19/2014 04:40:14 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 0028020000002D010000
 
Error: (12/19/2014 04:40:14 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 002120200000000000000AF000000
 
Error: (12/19/2014 04:35:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (12/18/2014 07:39:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 0028020000002D010000
 
Error: (12/18/2014 07:39:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 002120200000000000000AF000000
 
Error: (12/18/2014 07:37:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (12/18/2014 07:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 0028020000002D010000
 
Error: (12/18/2014 07:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 002120200000000000000AF000000
 
Error: (12/18/2014 07:03:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (12/18/2014 06:56:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3006) (User: NT AUTHORITY)
Description: 0028020000002D010000

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Няма нужда да отваряте по 100 теми. Екипа не е на работа тук и пише, когато може! Макар да имате адуер в система, който ще почистим, проблема ми не мисля, че е за нашия раздел. По-скоро сте за хардуерния раздел. Може да е и омазан драйвер на звуковата карта и т.н.

 

 

СТЪПКА 1

  • Изтеглете и стартирайтe 6sv1DN9.jpgAdwCleaner.exe.
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[s0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието му в следващия си коментар.


     
    СТЪПКА 2
     

     
    Моля изтеглете icon1351185104.png Junkware Removal Tool на вашия десктоп.
  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.


     
    СТЪПКА 3


     
    Моля изтеглете Malwarebytes Anti-Malware 2.0.3.1025 Final и я запазете на вашия десктоп.
  • Стартирайте файла mbam-setup-2.0.3.1025.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.
  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.


     
    СТЪПКА 4
     

     
    1.Изтеглете Hitman Pro.
    За 32-битова система - dEMD6.gif.
    За 64-битова система - Download-button3.gif


    2.Стартирайте програмата.

    3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

    4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

    5.Натиснете бутона „Напред“.

    6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

    7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

    8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

    9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
     
    Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
     
    6-scanfin-choose.jpg
     
    Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

  • Харесва ми 1

Сподели този отговор


Линк към този отговор
Сподели в други сайтове
Malwarebytes Anti-Malware
www.malwarebytes.org
 
 
Protection, 21.12.2014 г. 17:47:32 ч., SYSTEM, RADI-PC, Protection, Malware Protection, Starting, 
Protection, 21.12.2014 г. 17:47:32 ч., SYSTEM, RADI-PC, Protection, Malware Protection, Started, 
Protection, 21.12.2014 г. 17:47:32 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Starting, 
Protection, 21.12.2014 г. 17:47:32 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Started, 
Update, 21.12.2014 г. 17:47:38 ч., SYSTEM, RADI-PC, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, 
Update, 21.12.2014 г. 17:47:38 ч., SYSTEM, RADI-PC, Manual, Rootkit Database, 2014.9.18.1, 2014.12.14.1, 
Update, 21.12.2014 г. 17:47:43 ч., SYSTEM, RADI-PC, Manual, Malware Database, 2014.9.19.5, 2014.12.21.3, 
Update, 21.12.2014 г. 17:47:49 ч., SYSTEM, RADI-PC, Manual, program, 2.0.3.1025, 2.0.4.1028, 
Protection, 21.12.2014 г. 17:47:54 ч., SYSTEM, RADI-PC, Protection, Refresh, Starting, 
Protection, 21.12.2014 г. 17:47:54 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Stopping, 
Protection, 21.12.2014 г. 17:47:54 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Stopped, 
Protection, 21.12.2014 г. 17:47:57 ч., SYSTEM, RADI-PC, Protection, Refresh, Success, 
Protection, 21.12.2014 г. 17:47:57 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Starting, 
Protection, 21.12.2014 г. 17:47:57 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Started, 
Update, 21.12.2014 г. 17:48:18 ч., SYSTEM, RADI-PC, Manual, program, 2.0.3.1025, 2.0.4.1028, 
Scan, 21.12.2014 г. 17:55:04 ч., SYSTEM, RADI-PC, Manual, Start:21.12.2014 г. 17:48:26 ч., Duration:5 min 42 sec, Threat Scan, Completed, 20 Malware Detections, 2 Non-Malware Detections, 
Protection, 21.12.2014 г. 17:56:22 ч., SYSTEM, RADI-PC, Protection, Malware Protection, Starting, 
Protection, 21.12.2014 г. 17:56:22 ч., SYSTEM, RADI-PC, Protection, Malware Protection, Started, 
Protection, 21.12.2014 г. 17:56:22 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Starting, 
Protection, 21.12.2014 г. 17:56:22 ч., SYSTEM, RADI-PC, Protection, Malicious Website Protection, Started, 
 
(end)



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 7 Ultimate x64
Ran by Radi on ­Ґ¤ 21.12.2014 Ј. at 17:43:53,15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ­Ґ¤ 21.12.2014 Ј. at 17:45:37,54
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




 
# AdwCleaner v4.105 - Създаден отчет 21/12/2014 на 17:40:13
# Актуализиран 08/12/2014 от Xplode
# Database : 2014-12-21.4 [Live]
# Операционна система : Windows 7 Ultimate Service Pack 1 (64 bits)
# Потребителско име : Radi - RADI-PC
# Стартиран от : E:\Greek\adwcleaner_4.105.exe
# Настройка : Сканиране
 
***** [ Услуги ] *****
 
 
***** [ Файлове / Папки ] *****
 
Папка Открит : C:\ProgramData\WindowsMangerProtect
Папка Открит : C:\Users\Public\Documents\Goobzo
Папка Открит : C:\Users\Public\Documents\YTAHelper
Папка Открит : C:\Users\Radi\AppData\Local\CrashRpt
Папка Открит : C:\Users\Radi\AppData\Local\globalUpdate
Файл Открит : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml
Файл Открит : C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage
Файл Открит : C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal
Файл Открит : C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default\user.js
 
***** [ задачи ] *****
 
 
***** [ Преки пътища ] *****
 
 
***** [ Системен регистър ] *****
 
Данни Открити : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1407832072&from=smt&uid=WDCXWD10EZEX-22BN5A0_WD-WCC3F422854028540
Ключ Открити : HKCU\Software\AppDataLow\Software\Crossrider
Ключ Открити : HKCU\Software\GlobalUpdate
Ключ Открити : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Ключ Открити : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Открити : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Ключ Открити : HKCU\Software\Mozilla\Extends
Ключ Открити : HKCU\Software\SupHpUISoft
Ключ Открити : HKCU\Software\YahooPartnerToolbar
Ключ Открити : [x64] HKCU\Software\GlobalUpdate
Ключ Открити : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Ключ Открити : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Ключ Открити : [x64] HKCU\Software\SupHpUISoft
Ключ Открити : [x64] HKCU\Software\YahooPartnerToolbar
Ключ Открити : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Открити : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Ключ Открити : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Ключ Открити : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Ключ Открити : HKLM\SOFTWARE\istartsurfSoftware
Ключ Открити : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Открити : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Ключ Открити : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
Ключ Открити : HKLM\SOFTWARE\supWindowsMangerProtect
Ключ Открити : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Ключ Открити : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Открити : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Ключ Открити : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
 
***** [ Браузъри ] *****
 
-\\ Internet Explorer v11.0.9600.17496
 
Настройки Открит : HKCU\Software\Microsoft\Internet Explorer\Main [start Page] - hxxp://www.istartsurf.com/?type=hp&ts=1407832072&from=smt&uid=WDCXWD10EZEX-22BN5A0_WD-WCC3F422854028540
 
-\\ Mozilla Firefox v
 
[tmlrytqk.default] - Ред открит : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[tmlrytqk.default] - Ред открит : user_pref("extensions.crossrider.bic", "147c96242ca2565a2ae92b882711f658");
[tmlrytqk.default] - Ред открит : user_pref("extensions.quick_start.enable_search1", false);
[tmlrytqk.default] - Ред открит : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
 
-\\ Google Chrome v39.0.2171.95
 
 
*************************
 
AdwCleaner[R0].txt - [4430 octets] - [21/12/2014 17:40:13]
 
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4490 octets] ##########

HitmanPro 3.7.9.232
www.hitmanpro.com
 
   Computer name . . . . : RADI-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Radi-PC\Radi
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free
 
   Scan date . . . . . . : 2014-12-21 18:06:44
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 2m 22s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No
 
   Threats . . . . . . . : 0
   Traces  . . . . . . . : 18
 
   Objects scanned . . . : 1 429 996
   Files scanned . . . . : 15 105
   Remnants scanned  . . : 191 014 files / 1 223 877 keys
 
Suspicious files ____________________________________________________________
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\dll\wc002342.dll
      Size . . . . . . . : 969 032 bytes
      Age  . . . . . . . : 130.7 days (2014-08-13 01:40:20)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : FC5702BFEF687EDAF89499C7849E4FDA0AF9D72A5A632C5B4E20F2562468596C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\pbcl.dll
      Size . . . . . . . : 969 032 bytes
      Age  . . . . . . . : 108.0 days (2014-09-04 18:11:19)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : FC5702BFEF687EDAF89499C7849E4FDA0AF9D72A5A632C5B4E20F2562468596C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\pbclold.dll
      Size . . . . . . . : 969 032 bytes
      Age  . . . . . . . : 130.7 days (2014-08-13 01:33:44)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : FC5702BFEF687EDAF89499C7849E4FDA0AF9D72A5A632C5B4E20F2562468596C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\PnkBstrK.sys
      Size . . . . . . . : 140 520 bytes
      Age  . . . . . . . : 130.7 days (2014-08-13 01:36:12)
      Entropy  . . . . . : 7.8
      SHA-256  . . . . . : A02F21CE0AAE716212DD2593B8392A7674D8CE932B3B133B3A33152809E7307C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Windows\FreeMem.exe
      Size . . . . . . . : 16 976 bytes
      Age  . . . . . . . : 141.1 days (2014-08-02 15:09:24)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : B3AB6C5C5E64603FCCA99A9FA46C137DCB4758071B14FEA194733E8B652CA956
      Product  . . . . . : Free Memory
      Publisher  . . . . : Yamicsoft
      Description
      Version  . . . . . : 5.3.0.0
      RSA Key Size . . . : 2048
      LanguageID . . . . : 0
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 22.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
 
 
Potential Unwanted Programs _________________________________________________
 
   HKLM\SYSTEM\ControlSet001\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}\ (ShopperPro)
   HKLM\SYSTEM\ControlSet001\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}\ (ShopperPro)
   HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SPDRIVER_1.37.0.486\ (ShopperPro)
   HKLM\SYSTEM\ControlSet002\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}\ (ShopperPro)
   HKLM\SYSTEM\ControlSet002\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}\ (ShopperPro)
   HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_SPDRIVER_1.37.0.486\ (ShopperPro)
   HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}\ (ShopperPro)
   HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}\ (ShopperPro)
   HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPDRIVER_1.37.0.486\ (ShopperPro)
   HKU\.DEFAULT\Software\AppDataLow\Software\Sense\ (SaveSense)
   HKU\S-1-5-18\Software\AppDataLow\Software\Sense\ (SaveSense)
   HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} (ShopperPro)
   HKU\S-1-5-21-3713473699-1209246516-1782926497-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} (ShopperPro)
 
 

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Публикували сте грешния лог (protection log) от MBAM. На мен ми трябва scan log-a.

 

  • Отворете MBAM.
  • Отидете то табът History > Application Logs.
  • Отворете рапорта (Scan Log) с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

Сподели този отговор


Линк към този отговор
Сподели в други сайтове
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 21.12.2014 г.
Scan Time: 17:48:26 ч.
Logfile: 
Administrator: Yes
 
Version: 2.00.3.1025
Malware Database: v2014.12.21.03
Rootkit Database: v2014.12.14.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Radi
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 324071
Time Elapsed: 5 min, 42 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 1
PUP.Optional.iWebar.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\iWebar, Quarantined, [47d690d3463696a0fcc341537c8735cb], 
 
Registry Values: 1
Hijack.FolderOptions, HKU\S-1-5-21-3713473699-1209246516-1782926497-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NoFolderOptions, 1, Quarantined, [79a47fe43844fa3c08647892ba4a10f0]
 
Registry Data: 0
(No malicious items detected)
 
Folders: 1
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
 
Files: 8
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-02-7.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-03-1.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-04-2.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-05-3.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-06-4.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-07-5.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-08-6.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
Stolen.Data, C:\Users\Radi\AppData\Roaming\dclogs\2014-08-09-7.dc, Quarantined, [df3ea8bba2da50e6cef6e08ae51f2fd1], 
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

2313123213721893792173981237819 ДЕНА ЧАКАМ да ми пишете , бъдете малко сериозни пууууууууу

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Ще чакате.,..като за без пари толкова! Това да не ми е работата и да кисна по 24x7 на седмица за да ви оправям проблемите? Това е просто хоби. Аз също си имам лични ангажименти и трябва да отделя от свободното си време за да пиша тук! Като не ви харесва знаете как да процедирате!

 

 

Изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

 

След това вижте дали проблема остава.

 

Повторете и проверките с HitmanPro и adwcleaner и публикувайте новите логове.

 

Поздрави!

  • Харесва ми 1

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Прав си ;) извинявай...Fixlog_23-12-2014_07-48-12.txt

 

# AdwCleaner v4.105 - Създаден отчет 21/12/2014 на 17:41:15
# Актуализиран 08/12/2014 от Xplode
# Database : 2014-12-21.4 [Live]
# Операционна система : Windows 7 Ultimate Service Pack 1 (64 bits)
# Потребителско име : Radi - RADI-PC
# Стартиран от : E:\Greek\adwcleaner_4.105.exe
# Настройка : Почистване
 
***** [ Услуги ] *****
 
 
***** [ Файлове / Папки ] *****
 
Папка Изтритa : C:\ProgramData\WindowsMangerProtect
Папка Изтритa : C:\Users\Public\Documents\Goobzo
Папка Изтритa : C:\Users\Public\Documents\YTAHelper
Папка Изтритa : C:\Users\Radi\AppData\Local\globalUpdate
Папка Изтритa : C:\Users\Radi\AppData\Local\CrashRpt
Файл Изтритa : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml
Файл Изтритa : C:\Users\Radi\AppData\Roaming\Mozilla\Firefox\Profiles\tmlrytqk.default\user.js
Файл Изтритa : C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage
Файл Изтритa : C:\Users\Radi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal
 
***** [ задачи ] *****
 
 
***** [ Преки пътища ] *****
 
Пряк път Почистени : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Пряк път Почистени : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Пряк път Почистени : C:\Users\Radi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
 
***** [ Системен регистър ] *****
 
Ключ Изтрит : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Ключ Изтрит : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Ключ Изтрит : HKCU\Software\Mozilla\Extends
Ключ Изтрит : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Изтрит : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Ключ Изтрит : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Ключ Изтрит : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Изтрит : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Ключ Изтрит : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Изтрит : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Ключ Изтрит : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
Ключ Изтрит : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Изтрит : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Ключ Изтрит : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Ключ Изтрит : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Данни Възстановени : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Ключ Изтрит : HKCU\Software\GlobalUpdate
Ключ Изтрит : HKCU\Software\SupHpUISoft
Ключ Изтрит : HKCU\Software\YahooPartnerToolbar
Ключ Изтрит : HKCU\Software\AppDataLow\Software\Crossrider
Ключ Изтрит : HKLM\SOFTWARE\istartsurfSoftware
Ключ Изтрит : HKLM\SOFTWARE\supWindowsMangerProtect
 
***** [ Браузъри ] *****
 
-\\ Internet Explorer v11.0.9600.17496
 
Настройки Възстановен : HKCU\Software\Microsoft\Internet Explorer\Main [start Page]
 
-\\ Mozilla Firefox v
 
[tmlrytqk.default\prefs.js] - Елемент изтрит : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[tmlrytqk.default\prefs.js] - Елемент изтрит : user_pref("extensions.crossrider.bic", "147c96242ca2565a2ae92b882711f658");
[tmlrytqk.default\prefs.js] - Елемент изтрит : user_pref("extensions.quick_start.enable_search1", false);
[tmlrytqk.default\prefs.js] - Елемент изтрит : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
 
-\\ Google Chrome v39.0.2171.95
 
 
*************************
 
AdwCleaner[R0].txt - [4602 octets] - [21/12/2014 17:40:13]
AdwCleaner[s0].txt - [4268 octets] - [21/12/2014 17:41:15]
 
########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4328 octets] ##########


-----------------------------------------------------------------------------------------------------



HitmanPro 3.7.9.232
www.hitmanpro.com
 
   Computer name . . . . : RADI-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Radi-PC\Radi
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free
 
   Scan date . . . . . . : 2014-12-23 08:01:26
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 31s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No
 
   Threats . . . . . . . : 0
   Traces  . . . . . . . : 5
 
   Objects scanned . . . : 1 431 634
   Files scanned . . . . : 13 883
   Remnants scanned  . . : 189 276 files / 1 228 475 keys
 
Suspicious files ____________________________________________________________
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\dll\wc002342.dll
      Size . . . . . . . : 969 032 bytes
      Age  . . . . . . . : 132.3 days (2014-08-13 01:40:20)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : FC5702BFEF687EDAF89499C7849E4FDA0AF9D72A5A632C5B4E20F2562468596C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\pbcl.dll
      Size . . . . . . . : 969 032 bytes
      Age  . . . . . . . : 109.6 days (2014-09-04 18:11:19)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : FC5702BFEF687EDAF89499C7849E4FDA0AF9D72A5A632C5B4E20F2562468596C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\pbclold.dll
      Size . . . . . . . : 969 032 bytes
      Age  . . . . . . . : 132.3 days (2014-08-13 01:33:44)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : FC5702BFEF687EDAF89499C7849E4FDA0AF9D72A5A632C5B4E20F2562468596C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Users\Radi\AppData\Local\PunkBuster\BF3\pb\PnkBstrK.sys
      Size . . . . . . . : 140 520 bytes
      Age  . . . . . . . : 132.3 days (2014-08-13 01:36:12)
      Entropy  . . . . . : 7.8
      SHA-256  . . . . . : A02F21CE0AAE716212DD2593B8392A7674D8CE932B3B133B3A33152809E7307C
      RSA Key Size . . . : 2048
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : 22.0
         The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
         The file is a device driver. Device drivers run as trusted (highly privileged) code.
         Program is code signed with a valid Authenticode certificate.
 
   C:\Windows\FreeMem.exe
      Size . . . . . . . : 16 976 bytes
      Age  . . . . . . . : 142.7 days (2014-08-02 15:09:24)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : B3AB6C5C5E64603FCCA99A9FA46C137DCB4758071B14FEA194733E8B652CA956
      Product  . . . . . : Free Memory
      Publisher  . . . . : Yamicsoft
      Description
      Version  . . . . . : 5.3.0.0
      RSA Key Size . . . : 2048
      LanguageID . . . . : 0
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 22.0
         Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
 
 
 
 

 


Поздрави и на теб  :wink12:

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Аз също се извинявам за по-острия тон. Просто вчера бях скапан от работа.

 

Така, машината вече е почистена от всички остатъци. Ако проблема продължава да съществува, то той не се дължи на зловреден софтуер. Пробвахте ли с преинсталация на Скайп (различни версии) и обновяването на драйверите за компонентите на компютъра?

 

 

Поздрави!

  • Харесва ми 1

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

обновяването на драйверите за компонентите на компютъра това какво ще каже?? 
по някой път както си седя ми показва Amd has stopped responding and has recovered Display driver AMD driver stopped responding and has seccefully recovered.

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Компонент = чаркалък...(видеокарта, дъно-чипсет, лан карта, звукова карта) и т.н...

Предния ви пост затвърждава това твърдение...трябва да преинсталирате или обновите драйверите за видеокартата...

  • Харесва ми 1

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Тук се пиши на КИРИЛИЦА! Следващи постове на латиница ще бъдат изтрити без предупреждение. Колкото до драйверите, деинсталирайте текущите с DDU, рестартирайте системата и след това пробвайте с последните версии...ако пак има проблем, повторете стъпките и опитайте с по-стари драйвери, докато не намерите читави такива.

Сподели този отговор


Линк към този отговор
Сподели в други сайтове

Регистрирайте се или влезете в профила си за да коментирате

Трябва да имате регистрация за да може да коментирате това

Регистрирайте се

Създайте нова регистрация в нашия форум. Лесно е!

Нова регистрация

Вход

Имате регистрация? Влезте от тук.

Вход

×

Информация

Поставихме бисквитки на устройството ви за най-добро потребителско изживяване. Можете да промените настройките си за бисквитки, или в противен случай приемаме, че сте съгласни с нашите условия за ползване.