Здравейте, приятели. Проблема е следния - наскоро се с сдобих с лаптоп с уин 8.1 и след като инсталирах мозила почнаха проблеми - изкачащи поп ъп реклами под които има надпис   Ad by CinemaP-1.8cV27.03 | Close .

Прилагам и нужните файлове:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Емил Вълков (administrator) on LENOVO-PC on 03-04-2015 09:53:32
Running from C:\Users\Емил Вълков\Downloads
Loaded Profiles: Емил Вълков (Available profiles: Емил Вълков)
Platform: Windows 8.1 Connected (X64) OS Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel® Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
() C:\Program Files (x86)\Mtel NetAgent\MtelNetAgent_Service.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Pokki) C:\Users\Емил Вълков\AppData\Local\Pokki\Engine\StartMenuIndexer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Program Files (x86)\Mtel NetAgent\MtelNetAgent_Launcher.exe
() C:\Program Files\Lenovo PhoneCompanion\adb.exe
(Pokki) C:\Users\Емил Вълков\AppData\Local\Pokki\Engine\HostAppService.exe
(Pokki) C:\Users\Емил Вълков\AppData\Local\Pokki\Engine\HostAppService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ClientConnect LTD) C:\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe
(ClientConnect LTD) C:\Program Files (x86)\LenovoBrowserGuard\LenovoBrowserGuard\bin\cltmng.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\CSP\1.3.336.0\McCSPServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files\WindowsApps\Microsoft.BingMaps_2.0.2530.2317_x64__8wekyb3d8bbwe\Map.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe
(McAfee, Inc.) C:\Program Files\mcafee\vul\McVulCtr.exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\mcods.exe
(McAfee, Inc.) C:\Program Files\mcafee\vul\McVulAlert.exe
(Microsoft Corporation) C:\Windows\System32\dfrgui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-05] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2891080 2013-10-17] (ELAN Microelectronics Corp.)
HKLM\...\Run: [btServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216064 2014-01-07] (Realtek Semiconductor Corporation)
HKLM\...\Run: [RtsFT] => C:\windows\RTFTrack.exe [6340312 2014-02-27] (Realtek semiconductor)
HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [836592 2014-06-09] (Lenovo)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [16094704 2014-06-09] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [10842096 2014-06-09] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\mcafee\platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.)
HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
HKLM-x32\...\Run: [TAG_MtelNetAgent_Launcher.exe] => C:\Program Files (x86)\Mtel NetAgent\MtelNetAgent_Launcher.exe [952888 2014-04-14] ()
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\...\Run: [Pokki] => C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\Launcher.dll",RunLaunchPlatform
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\...\Run: [skype] => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\...\MountPoints2: {46493da0-d423-11e4-825b-90489a05e78e} - "F:\.\Autorun.exe" AUTORUN=1
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\...\MountPoints2: {46494259-d423-11e4-825b-90489a05e78e} - "G:\.\Autorun.exe" AUTORUN=1
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\...\MountPoints2: {526e302d-d422-11e4-825a-90489a05e78e} - "F:\.\Autorun.exe" AUTORUN=1
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Ribbons.scr [130048 2013-08-22] (Microsoft Corporation)
Startup: C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows 8.1 Final Activator 100%  Working With All Windows Edition(1).lnk
ShortcutTarget: Windows 8.1 Final Activator 100%  Working With All Windows Edition(1).lnk -> C:\ProgramData\{9b2043ea-4eb6-6dde-9b20-043ea4eb0fa9}\Windows 8.1 Final Activator 100%  Working With All Windows Edition(1).exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com
HKU\S-1-5-21-4079883155-4122363980-4031217907-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com
SearchScopes: HKU\S-1-5-21-4079883155-4122363980-4031217907-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4079883155-4122363980-4031217907-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
BHO: DealExpruessu -> {4e61c78d-86f2-40eb-889a-c198d79a5266} -> C:\Program Files (x86)\DealExpruessu\HgMMmS4fS9YFvL.x64.dll [2015-04-03] ()
BHO: PriceLesas -> {6caaf312-e208-4d75-88cc-35af62c39f62} -> C:\Program Files (x86)\PriceLesas\OQOpbY4PrjmP7D.x64.dll [2015-03-28] ()
BHO: SaaverEXtueension -> {96a0d097-fb13-400c-b8c4-166d731de575} -> C:\Program Files (x86)\SaaverEXtueension\lQB9dzXEKJUDrY.x64.dll [2015-04-03] ()
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll No File
BHO-x32: PriceLesas -> {6caaf312-e208-4d75-88cc-35af62c39f62} -> C:\Program Files (x86)\PriceLesas\OQOpbY4PrjmP7D.dll No File
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll No File
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2015-01-13] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2015-01-13] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{675E96AE-8A91-463C-BFA3-D742198B2933}: [NameServer] 10.250.238.3 10.250.238.4
Tcpip\..\Interfaces\{732D5C2B-67FA-4395-B353-DEF86E1124D7}: [NameServer] 10.250.238.3 10.250.238.4

FireFox:
========
FF ProfilePath: C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: https://www.google.bg/?gws_rd=ssl
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SKY2DF&PC=SKY2&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-29] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-29] ()
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll [2013-12-13] (Nitro PDF)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-03-28] (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-03-28] (globalUpdate)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\911bg.xml [2015-03-27]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\diribg.xml [2015-03-27]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\pe-bg.xml [2015-03-27]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\portalbgdict.xml [2015-03-27]
FF Extension: Bing Search Engine - C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default\Extensions\[email protected] [2015-03-27]
FF Extension: CinemaP-1.8cV27.03 - C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default\Extensions\[email protected] [2015-03-28]
FF Extension: Mozilla Firefox Hotfixer - C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default\Extensions\[email protected] [2015-03-30]
FF Extension: Zoom It - C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default\Extensions\{d401849f-1f0d-7231-0af9-1c2b0ed5e420} [2015-03-31]
FF Extension: ABV Notifier - C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default\Extensions\[email protected] [2015-04-03]
FF Extension: Adblock Plus - C:\Users\Емил Вълков\AppData\Roaming\Mozilla\Firefox\Profiles\voyly9tc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-03]
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2014-06-09]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Емил Вълков\AppData\Local\Google\Chrome\User Data\Default

Opera:
=======
OPR Extension: (CinemaP-1.8cV27.03) - C:\Users\Емил Вълков\AppData\Roaming\Opera Software\Opera Stable\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-03-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 be0fb33b; c:\Program Files (x86)\Supporter\Supporter.dll [1629696 2015-03-28] () [File not signed]
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [84992 2014-01-23] () [File not signed]
R2 CltMngSvc; C:\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe [2490184 2014-03-13] (ClientConnect LTD)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [99632 2013-10-09] (ELAN Microelectronics Corp.)
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-03-28] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-03-28] (globalUpdate) [File not signed]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-12] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-02] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-02] (Intel® Corporation)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1662424 2014-02-20] ()
R2 LUService; C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe [38896 2014-02-18] (Lenovo(beijing) Limited)
R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1851192 2015-03-28] (Maxthon)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2015-01-13] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-30] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [601864 2015-01-07] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-13] (Nitro PDF Software)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [288240 2014-06-09] (Lenovo)
R3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [305136 2014-06-09] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
R2 TAG_Service; C:\Program Files (x86)\Mtel NetAgent\MtelNetAgent_Service.exe [536632 2014-04-14] ()
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [67856 2014-06-09] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
S2 c2cautoupdatesvc; "C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service [X]
S2 c2cpnrsvc; "C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service [X]
S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
S3 hwusb_cdcacm; C:\Windows\system32\DRIVERS\ew_cdcacm.sys [121728 2013-12-10] (Huawei Technologies Co., Ltd.)
S3 hwusb_wwanecm; C:\Windows\system32\DRIVERS\ew_wwanecm.sys [376704 2013-12-10] (Huawei Technologies Co., Ltd.)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-10] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [558296 2014-01-14] (Realtek Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [9109720 2014-02-27] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation                           )
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-02] (Intel Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-03 09:53 - 2015-04-03 09:56 - 00021440 _____ () C:\Users\Емил Вълков\Downloads\FRST.txt
2015-04-03 09:53 - 2015-04-03 09:53 - 00000000 ____D () C:\FRST
2015-04-03 09:51 - 2015-04-03 09:51 - 02095616 _____ (Farbar) C:\Users\Емил Вълков\Downloads\FRST64.exe
2015-04-03 09:28 - 2015-04-03 09:29 - 00000000 ____D () C:\Program Files (x86)\DealExpruessu
2015-04-03 09:28 - 2015-04-03 09:28 - 00000000 ____D () C:\Program Files (x86)\Pirate Bay Advanced Search
2015-04-03 09:27 - 2015-04-03 09:28 - 00000000 ____D () C:\Program Files (x86)\SaaverEXtueension
2015-04-03 09:23 - 2015-04-03 09:23 - 00001186 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-04-03 09:23 - 2015-04-03 09:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-03 09:23 - 2015-04-03 09:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-02 20:02 - 2015-04-02 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-04-02 19:52 - 2015-04-02 19:54 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Google
2015-04-02 19:51 - 2015-04-02 19:54 - 00000000 ____D () C:\Program Files (x86)\Google
2015-04-01 20:22 - 2015-04-01 20:22 - 00000000 ____D () C:\ProgramData\Yellow AdBlocker
2015-04-01 20:04 - 2015-04-01 20:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mtel NetAgent
2015-04-01 19:58 - 2015-04-01 19:58 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2015-04-01 19:58 - 2015-04-01 19:58 - 00000000 ____D () C:\Program Files\Unlocker
2015-04-01 19:56 - 2015-04-01 19:57 - 01681749 _____ () C:\Users\Емил Вълков\Downloads\Unlocker1.9.1-x64.exe
2015-03-31 23:34 - 2015-03-31 23:34 - 01151388 _____ () C:\Users\Емил Вълков\Documents\ALL music.aimppl
2015-03-31 15:30 - 2015-03-31 16:02 - 43074952 _____ () C:\Users\Емил Вълков\Downloads\firefox-40.0a1.en-US.win64.installer.exe
2015-03-31 15:07 - 2015-03-31 15:07 - 00000000 ____D () C:\windows\SysWOW64\Drivers\bg-BG
2015-03-31 15:07 - 2015-03-31 15:07 - 00000000 ____D () C:\windows\system32\Drivers\bg-BG
2015-03-31 15:07 - 2015-03-31 15:07 - 00000000 ____D () C:\windows\system32\bg
2015-03-31 15:07 - 2015-03-31 15:07 - 00000000 ____D () C:\windows\bg-BG
2015-03-31 15:05 - 2015-04-01 20:10 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-31 15:05 - 2015-03-31 15:05 - 00003834 _____ () C:\windows\System32\Tasks\Opera scheduled Autoupdate 1427803505
2015-03-31 15:05 - 2015-03-31 15:05 - 00001162 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-03-31 15:05 - 2015-03-31 15:05 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Opera Software
2015-03-31 15:05 - 2015-03-31 15:05 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Opera Software
2015-03-31 15:04 - 2015-03-31 15:04 - 32664584 _____ (Opera Software) C:\Users\Емил Вълков\Downloads\Opera_28.0.1750.48_Setup.exe
2015-03-31 00:31 - 2015-03-31 00:30 - 00492957 ____N () C:\Users\Емил Вълков\Desktop\Dzhek_London_-_Tom_4._Razkazi_i_noveli_-331-b.txt.zip
2015-03-29 22:08 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\windows\system32\Drivers\HipShieldK.sys
2015-03-29 20:27 - 2015-03-29 20:27 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-03-29 09:40 - 2015-03-29 09:40 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Macromedia
2015-03-29 00:05 - 2015-04-03 09:00 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-03-29 00:05 - 2015-04-02 19:51 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-03-28 18:37 - 2015-03-28 18:37 - 00000000 ____D () C:\Program Files (x86)\Supporter
2015-03-28 18:35 - 2015-04-03 09:28 - 00000000 ____D () C:\ProgramData\2177943551573595904
2015-03-28 18:35 - 2015-03-31 09:44 - 00000000 ____D () C:\Program Files (x86)\PriceLesas
2015-03-28 18:33 - 2015-03-31 09:44 - 00000000 ____D () C:\ProgramData\{9bf90369-82a2-bade-9bf9-9036982a0da6}
2015-03-28 18:32 - 2015-04-02 23:32 - 00002472 _____ () C:\windows\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-5.job
2015-03-28 18:32 - 2015-03-28 18:32 - 00005476 _____ () C:\windows\System32\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-5
2015-03-28 18:32 - 2015-03-28 18:32 - 00002472 _____ () C:\windows\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-5_user.job
2015-03-28 18:31 - 2015-04-03 09:31 - 00003164 _____ () C:\windows\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-1-6.job
2015-03-28 18:31 - 2015-04-02 23:36 - 00001006 _____ () C:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-03-28 18:31 - 2015-04-02 23:31 - 00005210 _____ () C:\windows\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-11.job
2015-03-28 18:31 - 2015-04-02 23:31 - 00004520 _____ () C:\windows\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-4.job
2015-03-28 18:31 - 2015-04-02 23:31 - 00003500 _____ () C:\windows\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-1-7.job
2015-03-28 18:31 - 2015-04-02 17:36 - 00001002 _____ () C:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-03-28 18:31 - 2015-03-28 18:31 - 02045952 _____ (Cinema PlusV27.03) C:\Users\Емил Вълков\AppData\Roaming\XBSK.exe
2015-03-28 18:31 - 2015-03-28 18:31 - 01554432 _____ (Cinema PlusV27.03) C:\Users\Емил Вълков\AppData\Roaming\ZQK.exe
2015-03-28 18:31 - 2015-03-28 18:31 - 00008214 _____ () C:\windows\System32\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-11
2015-03-28 18:31 - 2015-03-28 18:31 - 00007524 _____ () C:\windows\System32\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-4
2015-03-28 18:31 - 2015-03-28 18:31 - 00006504 _____ () C:\windows\System32\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-1-7
2015-03-28 18:31 - 2015-03-28 18:31 - 00006168 _____ () C:\windows\System32\Tasks\45bccf4b-4c7e-4c60-9c9e-1ea97b543050-1-6
2015-03-28 18:31 - 2015-03-28 18:31 - 00003978 _____ () C:\windows\System32\Tasks\globalUpdateUpdateTaskMachineUA
2015-03-28 18:31 - 2015-03-28 18:31 - 00003742 _____ () C:\windows\System32\Tasks\globalUpdateUpdateTaskMachineCore
2015-03-28 18:31 - 2015-03-28 18:31 - 00001378 _____ () C:\windows\Tasks\XBSK.job
2015-03-28 18:31 - 2015-03-28 18:31 - 00001376 _____ () C:\windows\Tasks\ZQK.job
2015-03-28 18:30 - 2015-04-02 11:23 - 00000000 ____D () C:\Program Files (x86)\CinemaP-1.8cV27.03
2015-03-28 18:30 - 2015-03-28 18:30 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\globalUpdate
2015-03-28 18:30 - 2015-03-28 18:30 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2015-03-28 18:13 - 2015-03-28 18:14 - 00000000 ____D () C:\Program Files (x86)\Windows 8 n 8.1 Activator
2015-03-28 16:21 - 2015-04-02 12:41 - 00000000 ____D () C:\ProgramData\{e06253a9-4a99-1fca-e062-253a94a94ea5}
2015-03-28 16:20 - 2015-04-02 12:41 - 00000000 ____D () C:\ProgramData\{872ede43-ad2b-d5d3-872e-ede43ad2790e}
2015-03-28 16:20 - 2015-04-02 12:41 - 00000000 ____D () C:\ProgramData\{55694745-d63c-c12b-5569-94745d631d17}
2015-03-28 16:20 - 2015-03-30 01:12 - 00000000 ____D () C:\ProgramData\{9b2043ea-4eb6-6dde-9b20-043ea4eb0fa9}
2015-03-28 16:15 - 2015-04-02 12:42 - 00000000 ____D () C:\ProgramData\{15aa0734-c4c7-f61d-15aa-a0734c4c1cd3}
2015-03-28 16:15 - 2015-04-02 12:41 - 00000000 ____D () C:\ProgramData\{a941787d-775b-0a4e-a941-1787d775e1f5}
2015-03-28 16:15 - 2015-04-02 12:41 - 00000000 ____D () C:\ProgramData\{82ac96fc-46fa-0e0a-82ac-c96fc46f5bf1}
2015-03-28 11:01 - 2015-03-28 11:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SDFormatter
2015-03-28 11:01 - 2015-03-28 11:01 - 00000000 ____D () C:\Program Files (x86)\SDA
2015-03-28 11:00 - 2015-03-28 11:00 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Downloaded Installations
2015-03-28 09:32 - 2015-04-01 20:02 - 00000000 __RDO () C:\Users\Емил Вълков\OneDrive
2015-03-28 00:56 - 2015-03-28 00:56 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\WebApp
2015-03-28 00:56 - 2015-03-28 00:56 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Cyberlink
2015-03-28 00:56 - 2015-03-28 00:56 - 00000000 ____D () C:\Users\Public\CyberLink
2015-03-28 00:55 - 2015-03-29 09:17 - 00000000 ____D () C:\Users\Емил Вълков\Documents\Lenovo
2015-03-28 00:55 - 2015-03-28 00:56 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\CyberLink
2015-03-28 00:55 - 2015-03-28 00:55 - 00000000 ____D () C:\Users\Емил Вълков\Documents\CyberLink
2015-03-28 00:55 - 2015-03-28 00:55 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Lenovo
2015-03-28 00:32 - 2015-03-28 00:32 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Maxthon3
2015-03-27 23:34 - 2015-03-27 23:34 - 00000000 ____D () C:\Users\Емил Вълков\Tracing
2015-03-27 23:24 - 2015-03-31 22:00 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Skype
2015-03-27 23:24 - 2015-03-27 23:24 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Skype
2015-03-27 23:24 - 2015-03-27 23:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-03-27 23:23 - 2015-03-27 23:24 - 00000000 ____D () C:\ProgramData\Skype
2015-03-27 23:03 - 2015-03-27 23:03 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2015-03-27 22:04 - 2015-04-01 19:44 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\AIMP3
2015-03-27 22:04 - 2015-03-27 22:04 - 00000000 ____D () C:\Program Files (x86)\AIMP3
2015-03-27 21:43 - 2015-03-27 21:43 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Nitro
2015-03-27 21:40 - 2015-04-02 19:52 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Adobe
2015-03-27 21:39 - 2015-03-27 21:39 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\LSC
2015-03-27 14:43 - 2015-03-27 14:44 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Mozilla
2015-03-27 14:43 - 2015-03-27 14:44 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Mozilla
2015-03-27 14:43 - 2015-03-27 14:43 - 00000000 ____D () C:\Users\Public\Pokki
2015-03-27 14:43 - 2015-03-27 14:43 - 00000000 ____D () C:\ProgramData\Mozilla
2015-03-27 14:42 - 2015-04-01 20:02 - 00002180 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2015-03-27 14:42 - 2015-03-27 14:42 - 00002371 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo Web Start.lnk
2015-03-27 14:42 - 2015-03-27 14:42 - 00002311 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-03-27 14:11 - 2015-04-03 08:49 - 00003954 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{4A87ADAF-8289-4815-BFAA-28FEB3569C47}
2015-03-27 14:11 - 2015-03-27 14:11 - 00000000 __SHD () C:\Users\Емил Вълков\AppData\Local\EmieUserList
2015-03-27 14:11 - 2015-03-27 14:11 - 00000000 __SHD () C:\Users\Емил Вълков\AppData\Local\EmieSiteList
2015-03-27 14:03 - 2015-03-27 14:03 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\LenovoBrowserGuard
2015-03-27 14:00 - 2013-12-10 14:37 - 00376704 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_wwanecm.sys
2015-03-27 14:00 - 2013-12-10 14:36 - 00121728 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_cdcacm.sys
2015-03-27 14:00 - 2013-11-30 18:11 - 00246272 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_juwwanecm.sys
2015-03-27 14:00 - 2013-11-30 18:10 - 00110592 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_jucdcacm.sys
2015-03-27 14:00 - 2013-11-30 18:10 - 00091648 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_jubusenum.sys
2015-03-27 14:00 - 2013-11-30 18:10 - 00077312 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_jucdcecm.sys
2015-03-27 14:00 - 2013-11-30 18:10 - 00030720 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_juextctrl.sys
2015-03-27 14:00 - 2013-11-30 18:01 - 00456704 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ewusbwwan.sys
2015-03-27 14:00 - 2013-11-30 17:55 - 00226176 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ewusbmdm.sys
2015-03-27 14:00 - 2013-01-25 10:16 - 00109568 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_hwusbdev.sys
2015-03-27 14:00 - 2012-12-22 10:46 - 00014976 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_usbenumfilter.sys
2015-03-27 14:00 - 2012-08-20 09:37 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01007.dll
2015-03-27 14:00 - 2012-08-20 09:37 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdfCoInstaller01007.dll
2015-03-27 14:00 - 2010-10-08 17:59 - 00032768 _____ (Huawei Tech. Co., Ltd.) C:\windows\system32\Drivers\ewdcsc.sys
2015-03-27 14:00 - 2010-09-26 19:09 - 00022016 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\ew_hwupgrade.sys
2015-03-27 13:59 - 2015-03-31 01:04 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Nitro PDF
2015-03-27 13:59 - 2015-03-27 14:03 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\TAG
2015-03-27 13:59 - 2015-03-27 13:59 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Sierra Wireless
2015-03-27 13:59 - 2015-03-27 13:59 - 00000000 ____D () C:\Program Files (x86)\Mtel NetAgent
2015-03-27 04:58 - 2015-04-03 09:28 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4079883155-4122363980-4031217907-1001
2015-03-27 04:52 - 2015-03-27 04:52 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2015-03-27 04:52 - 2015-03-27 04:52 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2015-03-27 04:51 - 2015-04-03 03:20 - 00046783 _____ () C:\Users\Емил Вълков\AppData\Local\BTServer.log
2015-03-27 04:51 - 2015-03-27 21:39 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Adobe
2015-03-27 04:51 - 2015-03-27 04:51 - 00001457 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-27 04:51 - 2015-03-27 04:51 - 00001264 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BTServer Toasts App.lnk
2015-03-27 04:51 - 2015-03-27 04:51 - 00000000 ____D () C:\Users\Емил Вълков\Documents\My Bluetooth
2015-03-27 04:51 - 2015-03-27 04:51 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\VirtualStore
2015-03-27 04:50 - 2015-04-02 19:40 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Packages
2015-03-27 04:50 - 2015-03-27 04:50 - 00000180 _____ () C:\windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-03-27 04:50 - 2015-03-27 04:50 - 00000020 ___SH () C:\Users\Емил Вълков\ntuser.ini
2015-03-27 04:49 - 2015-04-03 09:14 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Local\Pokki
2015-03-27 04:49 - 2015-03-28 09:32 - 00000000 ____D () C:\Users\Емил Вълков
2015-03-27 04:49 - 2014-06-09 19:10 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Macromedia
2015-03-27 04:49 - 2014-03-18 13:06 - 00000000 ___RD () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-27 04:49 - 2014-03-18 13:06 - 00000000 ___RD () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-03-27 04:49 - 2014-03-18 12:54 - 00000369 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-03-27 04:49 - 2014-03-18 12:54 - 00000369 _____ () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-03-27 04:49 - 2013-08-22 18:36 - 00000000 ___RD () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-27 04:49 - 2013-08-22 18:36 - 00000000 ____D () C:\Users\Емил Вълков\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-03-27 04:46 - 2015-03-27 04:46 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-03-26 22:14 - 2015-03-26 22:14 - 00005542 _____ () C:\Users\Емил Вълков\AppData\Roaming\XBSK
2015-03-26 22:14 - 2015-03-26 22:14 - 00004185 _____ () C:\Users\Емил Вълков\AppData\Roaming\ZQK

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-03 09:03 - 2014-06-09 18:37 - 01730788 _____ () C:\windows\WindowsUpdate.log
2015-04-03 09:00 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\system32\sru
2015-04-02 19:57 - 2014-06-09 19:18 - 00000000 ____D () C:\ProgramData\Office2013
2015-04-02 19:40 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\AppReadiness
2015-04-02 13:13 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\rescache
2015-04-01 20:10 - 2014-03-18 12:53 - 00863592 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-01 20:01 - 2014-06-09 19:16 - 00002560 _____ () C:\windows\system32\VfService.trf
2015-04-01 20:01 - 2013-08-22 17:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-01 20:01 - 2013-08-22 16:25 - 00262144 ___SH () C:\windows\system32\config\BBI
2015-04-01 20:00 - 2014-06-09 18:32 - 00709952 _____ () C:\Users\Public\CAFADEBUG.log
2015-03-31 16:06 - 2014-03-18 12:44 - 00004078 _____ () C:\windows\PFRO.log
2015-03-31 15:10 - 2013-08-22 18:20 - 00000000 ____D () C:\windows\CbsTemp
2015-03-31 15:07 - 2014-03-18 12:38 - 00000000 ____D () C:\Program Files\Windows Journal
2015-03-31 15:07 - 2014-03-18 12:25 - 00000000 ____D () C:\windows\SysWOW64\WCN
2015-03-31 15:07 - 2014-03-18 12:25 - 00000000 ____D () C:\windows\SysWOW64\slmgr
2015-03-31 15:07 - 2014-03-18 12:25 - 00000000 ____D () C:\windows\system32\WCN
2015-03-31 15:07 - 2014-03-18 12:25 - 00000000 ____D () C:\windows\system32\slmgr
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\WinStore
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\SysWOW64\bg-BG
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\system32\SystemResetPlatform
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\system32\migwiz
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\system32\bg-BG
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\PolicyDefinitions
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\Help
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\FileManager
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\Program Files\Common Files\System
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2015-03-31 15:07 - 2013-08-22 18:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-03-31 15:07 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\SysWOW64\oobe
2015-03-31 15:07 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\Sysprep
2015-03-31 15:07 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\system32\oobe
2015-03-31 15:07 - 2013-08-22 16:36 - 00000000 ____D () C:\windows\servicing
2015-03-31 14:29 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\system32\NDF
2015-03-31 09:39 - 2014-06-09 19:05 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-03-31 00:31 - 2013-08-22 17:46 - 00024605 _____ () C:\windows\setupact.log
2015-03-29 22:09 - 2014-06-09 19:04 - 00000000 ____D () C:\ProgramData\McAfee
2015-03-29 21:45 - 2014-06-09 19:05 - 00000000 ____D () C:\Program Files\Common Files\mcafee
2015-03-29 21:44 - 2013-08-22 18:36 - 00000000 ___HD () C:\windows\ELAMBKUP
2015-03-28 11:00 - 2013-08-22 18:36 - 00000000 ____D () C:\windows\system32\restore
2015-03-28 00:56 - 2014-06-09 19:00 - 00000000 ____D () C:\ProgramData\CyberLink
2015-03-28 00:55 - 2014-06-09 19:10 - 00000000 ____D () C:\ProgramData\Lenovo
2015-03-27 04:51 - 2014-06-09 19:13 - 00098714 ____H () C:\windows\modules.log
2015-03-27 04:51 - 2014-04-02 20:34 - 00000000 ____D () C:\windows\Panther
2015-03-27 04:51 - 2013-08-22 16:25 - 00262144 ___SH () C:\windows\system32\config\ELAM
2015-03-27 04:48 - 2013-08-22 17:44 - 00344624 _____ () C:\windows\system32\FNTCACHE.DAT

==================== Files in the root of some directories =======

2015-03-26 22:14 - 2015-03-26 22:14 - 0005542 _____ () C:\Users\Емил Вълков\AppData\Roaming\XBSK
2015-03-28 18:31 - 2015-03-28 18:31 - 2045952 _____ (Cinema PlusV27.03) C:\Users\Емил Вълков\AppData\Roaming\XBSK.exe
2015-03-26 22:14 - 2015-03-26 22:14 - 0004185 _____ () C:\Users\Емил Вълков\AppData\Roaming\ZQK
2015-03-28 18:31 - 2015-03-28 18:31 - 1554432 _____ (Cinema PlusV27.03) C:\Users\Емил Вълков\AppData\Roaming\ZQK.exe
2015-03-27 04:51 - 2015-04-03 03:20 - 0046783 _____ () C:\Users\Емил Вълков\AppData\Local\BTServer.log
2014-06-09 18:32 - 2014-06-09 18:32 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Емил Вълков\AppData\Local\Temp\certutil.exe
C:\Users\Емил Вълков\AppData\Local\Temp\KMS Windows 8 n 8.1 Activator__9771_il67290.exe
C:\Users\Емил Вълков\AppData\Local\Temp\msvcr71.dll
C:\Users\Емил Вълков\AppData\Local\Temp\nspr4.dll
C:\Users\Емил Вълков\AppData\Local\Temp\nss3.dll
C:\Users\Емил Вълков\AppData\Local\Temp\octE818.tmp.exe
C:\Users\Емил Вълков\AppData\Local\Temp\Opera_NI_stable.exe
C:\Users\Емил Вълков\AppData\Local\Temp\plc4.dll
C:\Users\Емил Вълков\AppData\Local\Temp\plds4.dll
C:\Users\Емил Вълков\AppData\Local\Temp\smime3.dll
C:\Users\Емил Вълков\AppData\Local\Temp\softokn3.dll
C:\Users\Емил Вълков\AppData\Local\Temp\Zzoomit_uninstall.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-09 18:15

==================== End Of Log ============================

Addition.txt

Addition.txt

Ще ми трябва малко време за да прегледам логовете и да напише скрипт. Но първо е хапна. До 1 час ще съм писал в темата.

 

Поздрави!

Хрумна ми да се опитам да си възстановя първоначалната конфигурация на системата преди заразяването. Мисля че трябва да свърши работа. Ще опитам.

Поздрави!

Ами тогава темата става излишна...

 

Поздрави!