Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем с Google Hrom и Web Companion

Методиев
в Премахване на зловреден софтуер

Featured Replies

Здравейте,

Отново ме налази нещо. При стартиране компютъра се бави. Погледнах процесите и видях, че Google Hrom върти усилено някакви 3 процеса. Деинсталирах го. Междувременно в IE се появи Yahoo като търсеща машина, появи се и Web Companion, за която четох, че е зловредна, но MBAM не я откри. 

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-04-2015 04
Ran by Metody Metodiev (administrator) on METODY-PD on 17-04-2015 14:54:39
Running from C:\Users\Metody Metodiev\Desktop
Loaded Profiles: Metody Metodiev (Available profiles: Metody Metodiev)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Acronis) C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
(CANON INC) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe
(CANON INC.) C:\Windows\System32\cnwiolss.exe
(Lavasoft Limited) C:\Program Files\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe
(WIBU-SYSTEMS AG) C:\Program Files\WIBUKEY\Server\WkSvW32.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Lavasoft) C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Acronis) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Graphisoft SE) C:\Program Files\Graphisoft\ArchiCAD 16\ArchiCAD.exe
(Graphisoft SE) C:\Program Files\Graphisoft\ArchiCAD 16\GSQuickTimeServer\GSQTServer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [21646944 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5503768 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Run: [Web Companion] => C:\Program Files\Lavasoft\Web Companion\Application\WebCompanion.exe [1303872 2015-03-12] (Lavasoft)
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Network Server.lnk
ShortcutTarget: Network Server.lnk -> C:\Program Files\WIBUKEY\Server\WkSvMgr.exe (WIBU-SYSTEMS AG)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.bg/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-631084387-3129735815-1494553587-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-631084387-3129735815-1494553587-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10099_swoc_campaign_150415__yaie&p={searchTerms}
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-04-08] (Oracle Corporation)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-08] (Oracle Corporation)
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.caminova.net/en/downloads/getmodule.aspx?lang=en
DPF: {167248DA-0F88-4DE1-B4B1-45176751026D} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/renew/CertManX.cab
DPF: {4DB62416-BC86-4439-B5BA-366948F47C8D} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/sign/SCManagerX.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-170-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0060-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0040-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab
Winsock: Catalog9 01 C:\Windows\system32\LavasoftTcpService.dll [326288] (Lavasoft Limited)
Winsock: Catalog9 02 C:\Windows\system32\LavasoftTcpService.dll [326288] (Lavasoft Limited)
Winsock: Catalog9 03 C:\Windows\system32\LavasoftTcpService.dll [326288] (Lavasoft Limited)
Winsock: Catalog9 04 C:\Windows\system32\LavasoftTcpService.dll [326288] (Lavasoft Limited)
Winsock: Catalog9 23 C:\Windows\system32\LavasoftTcpService.dll [326288] (Lavasoft Limited)
Tcpip\Parameters: [DhcpNameServer] 178.254.192.34 178.254.192.3

FireFox:
========
FF ProfilePath: C:\Users\Metody Metodiev\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412
FF DefaultSearchEngine: Yahoo
FF Homepage: https://www.google.bg/?gws_rd=cr&ei=uyufUu_LM8TfswabmoGACQ
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll [2014-03-31] (GARMIN Corp.)
FF Plugin: @graphisoft.com/GDL Web Plug-in -> C:\Program Files\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll [2012-06-25] (Graphisoft SE)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Windows\system32\npdeployJava1.dll [2015-04-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-08] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-631084387-3129735815-1494553587-1000: www.bobs.bg/bobsWinSigner -> C:\Users\Metody Metodiev\AppData\Roaming\BOBS\BOBS Web Plugin MSCAPI Sign\1.0.0.4\npbobsWinSigner.dll [2013-08-30] (BORICA - BANKSERVICE AD)
FF Extension: SalePeluss - C:\Users\Metody Metodiev\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412\Extensions\[email protected] [2015-04-15]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\[email protected] [2015-04-08]

Chrome:
=======
CHR HomePage: Default -> https://www.google.bg/
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Bejeweled) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm [2015-04-10]
CHR Extension: (ButtonBeats DubCube) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdijiampoihanablcndnakhfbgfciogm [2015-04-10]
CHR Extension: (Adblock Plus) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-10]
CHR Extension: (Facebook Customizer (by Adblock Plus)) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\deoeenbkoccjaefmmhpmlegngdjohdcm [2015-04-10]
CHR Extension: (Bookmark Manager) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-17]
CHR Extension: (ButtonBass Dubstep Balls) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmjadonkmcblbkocpaaefjbceiijfdg [2015-04-10]
CHR Extension: (90`s Games) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\illbbfoihflomkbpcaaakhijinbnejom [2015-04-10]
CHR Extension: (Burton Snowboards) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndfadpmchcfmnidepggefbcjgelboimi [2015-04-10]
CHR Extension: (Google Wallet) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [830376 2013-02-15] (Acronis)
R2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3783672 2013-12-03] (Acronis)
S3 AppIDSvc; C:\Windows\System32\appidsvc.dll [27648 2015-02-03] (Microsoft Corporation) [File not signed]
R3 Appinfo; C:\Windows\System32\appinfo.dll [47104 2013-02-27] (Microsoft Corporation) [File not signed]
R2 AudioEndpointBuilder; C:\Windows\System32\Audiosrv.dll [475136 2015-02-03] (Microsoft Corporation) [File not signed]
R2 Audiosrv; C:\Windows\System32\Audiosrv.dll [475136 2015-02-03] (Microsoft Corporation) [File not signed]
R2 Canon imagePROGRAF Status Monitor; C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe [726616 2014-02-10] (CANON INC)
R2 CryptSvc; C:\Windows\system32\cryptsvc.dll [143872 2015-02-03] (Microsoft Corporation) [File not signed]
S3 EFS; C:\Windows\System32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2012-12-13] (Flexera Software, Inc.)
S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [102912 2015-03-13] (Microsoft Corporation) [File not signed]
R2 IKEEXT; C:\Windows\System32\ikeext.dll [679424 2013-10-12] (Microsoft Corporation) [File not signed]
R2 iPFDeviceAgentService; C:\Windows\system32\Cnwiolss.exe [167752 2013-02-26] (CANON INC.)
R3 KeyIso; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R2 LavasoftTcpService; C:\Program Files\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe [836984 2015-03-12] (Lavasoft Limited)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation)
R2 MSSQLSERVER; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29178224 2007-02-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2008-07-18] (Hewlett-Packard) [File not signed]
S3 Netlogon; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\nlasvc.dll [242688 2014-12-06] (Microsoft Corporation) [File not signed]
R2 PcaSvc; C:\Windows\System32\pcasvc.dll [157184 2015-02-03] (Microsoft Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-07-18] (Hewlett-Packard) [File not signed]
R2 ProfSvc; C:\Windows\system32\profsvc.dll [164864 2014-12-19] (Microsoft Corporation) [File not signed]
S3 ProtectedStorage; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R2 SamSs; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 SearchProtectionService; C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe [17768 2015-03-12] ()
R2 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [7084672 2013-03-26] (Acronis)
S3 TermService; C:\Windows\System32\termsrv.dll [523776 2014-10-14] (Microsoft Corporation) [File not signed]
S3 VaultSvc; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R3 WdiServiceHost; C:\Windows\system32\wdi.dll [76800 2015-01-09] (Microsoft Corporation) [File not signed]
S3 WdiSystemHost; C:\Windows\system32\wdi.dll [76800 2015-01-09] (Microsoft Corporation) [File not signed]
S3 WebClient; C:\Windows\System32\webclnt.dll [205824 2013-07-04] (Microsoft Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 WkSvw32.exe; C:\Program Files\WIBUKEY\Server\WkSvw32.exe [659336 2015-04-08] (WIBU-SYSTEMS AG)
R2 wuauserv; C:\Windows\system32\wuaueng.dll [2020864 2015-03-25] (Microsoft Corporation) [File not signed]
S3 WwanSvc; C:\Windows\System32\wwansvc.dll [185344 2014-01-28] (Microsoft Corporation) [File not signed]
S2 834b7789; "C:\Windows\system32\rundll32.exe" "c:\Program Files\CutterSystem\CutterSystem.dll",serv

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 A38CCID; C:\Windows\System32\DRIVERS\a38ccid.sys [54528 2014-11-13] (Advanced Card Systems Ltd.) [File not signed]
R1 AFD; C:\Windows\system32\drivers\afd.sys [338944 2014-05-30] (Microsoft Corporation) [File not signed]
S3 AppID; C:\Windows\system32\drivers\appid.sys [50176 2015-02-03] (Microsoft Corporation) [File not signed]
S3 cxbu0wdm; C:\Windows\System32\DRIVERS\cxbu0wdm.sys [119040 2011-09-06] (HID Global Corporation)
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [514560 2015-02-25] (Microsoft Corporation) [File not signed]
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [14848 2010-06-19] (Siliten)
S0 is3srv; C:\Windows\System32\drivers\is3srv.sys [61328 2013-10-29] (iS3 Inc.)
R3 mcdbus; C:\Windows\System32\DRIVERS\mcdbus.sys [116736 2009-02-24] (MagicISO, Inc.) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation)
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [116224 2014-12-19] (Microsoft Corporation) [File not signed]
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [593920 2015-02-03] (Microsoft Corporation) [File not signed]
R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2011-10-16] (Padus, Inc.) [File not signed]
S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [14848 2012-08-23] (Microsoft Corporation) [File not signed]
S3 RDPWD; C:\Windows\system32\Drivers\RDPWD.sys [184320 2014-07-17] (Microsoft Corporation) [File not signed]
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [66344 2013-10-29] (GFI Software)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [324096 2014-01-07] (Duplex Secure Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13368 2015-04-02] (SlimWare Utilities, Inc.)
R0 szkg5; C:\Windows\System32\DRIVERS\szkg.sys [61328 2013-10-29] (iS3 Inc.)
S3 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [888640 2013-12-03] (Acronis International GmbH)
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [74752 2014-11-11] (Microsoft Corporation) [File not signed]
S3 terminpt; C:\Windows\system32\drivers\terminpt.sys [24064 2012-08-23] (Microsoft Corporation) [File not signed]
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [736192 2013-12-03] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [130488 2013-12-03] (Acronis)
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [31232 2014-07-17] (Microsoft Corporation) [File not signed]
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [49152 2013-10-02] (Microsoft Corporation) [File not signed]
S3 TsUsbGD; C:\Windows\system32\drivers\TsUsbGD.sys [27136 2012-08-23] (Microsoft Corporation) [File not signed]
S3 usbaudio; C:\Windows\system32\drivers\usbaudio.sys [80896 2013-07-12] (Microsoft Corporation) [File not signed]
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [76288 2013-11-27] (Microsoft Corporation) [File not signed]
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [86016 2013-07-12] (Microsoft Corporation) [File not signed]
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [43520 2013-11-27] (Microsoft Corporation) [File not signed]
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [258560 2013-11-27] (Microsoft Corporation) [File not signed]
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [20480 2013-11-27] (Microsoft Corporation) [File not signed]
R3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [36352 2013-07-03] (Microsoft Corporation) [File not signed]
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [24064 2013-11-27] (Microsoft Corporation) [File not signed]
S3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [146816 2013-07-12] (Microsoft Corporation) [File not signed]
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [116000 2013-12-03] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [85280 2013-12-03] (Acronis International GmbH)
R2 WIBUKEY; C:\Windows\System32\DRIVERS\WibuKey.sys [82696 2015-04-08] (WIBU-SYSTEMS AG)
R3 Wibukey2; C:\Windows\System32\drivers\wibukey2.sys [22400 2015-04-08] (WIBU-SYSTEMS AG)
S3 cpuz134; \??\C:\Users\METODY~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2006-03-03] () [File not signed]
S4 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\Metody Metodiev\AppData\Local\Temp\tmp1802.tmp [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-17 14:54 - 2015-04-17 14:55 - 00022273 _____ () C:\Users\Metody Metodiev\Desktop\FRST.txt
2015-04-17 14:52 - 2015-04-17 14:52 - 01137152 _____ (Farbar) C:\Users\Metody Metodiev\Desktop\FRST.exe
2015-04-17 12:40 - 2015-04-17 12:40 - 00060662 _____ () C:\Users\Metody Metodiev\Desktop\Graphic1.eps
2015-04-17 11:35 - 2015-04-17 11:35 - 00107016 _____ () C:\Users\Metody Metodiev\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-17 11:34 - 2015-04-17 11:34 - 00000056 _____ () C:\Windows\setupact.log
2015-04-17 11:34 - 2015-04-17 11:34 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-17 11:33 - 2015-04-17 11:33 - 00414264 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-17 11:33 - 2015-04-17 11:33 - 00002278 _____ () C:\Windows\PFRO.log
2015-04-17 11:09 - 2015-04-17 11:09 - 00010338 _____ () C:\Users\Metody Metodiev\Desktop\cc_20150417_110902.reg
2015-04-15 17:36 - 2015-04-15 17:36 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Lavasoft
2015-04-15 17:35 - 2015-04-15 17:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-04-15 17:35 - 2015-04-15 17:35 - 00000000 ____D () C:\Program Files\Lavasoft
2015-04-15 17:35 - 2015-03-12 11:58 - 00326288 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService.dll
2015-04-15 17:34 - 2015-04-15 17:34 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\Lavasoft
2015-04-15 17:34 - 2015-04-15 17:34 - 00000000 ____D () C:\ProgramData\Lavasoft
2015-04-15 17:33 - 2015-04-15 17:34 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\{13878C40-1706-4445-9466-7D582D4BE537}
2015-04-15 17:12 - 2015-04-15 17:12 - 00000000 ____D () C:\Users\Metody Metodiev\Documents\Inventor Server SDK ACAD 2016
2015-04-15 15:53 - 2015-04-15 15:53 - 00364683 _____ () C:\Users\Metody Metodiev\Downloads\2etaj.dwg
2015-04-15 14:18 - 2015-04-15 14:18 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\acad16po
2015-04-15 14:10 - 2015-04-15 14:12 - 221587400 _____ () C:\Users\Metody Metodiev\Downloads\acad16po.part3.rar
2015-04-15 14:09 - 2015-04-15 14:17 - 1073741824 _____ () C:\Users\Metody Metodiev\Downloads\acad16po.part2.rar
2015-04-15 14:09 - 2015-04-15 14:17 - 1073741824 _____ () C:\Users\Metody Metodiev\Downloads\acad16po.part1.rar
2015-04-15 11:48 - 2015-04-15 11:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-04-15 11:48 - 2015-04-15 11:48 - 00000000 ____D () C:\Program Files\7-Zip
2015-04-15 11:47 - 2015-04-15 11:48 - 01110476 _____ () C:\Users\Metody Metodiev\Downloads\7z920.exe
2015-04-15 11:35 - 2015-04-16 13:11 - 00000000 ____D () C:\ProgramData\{fee1d0d0-1124-de00-fee1-1d0d01124340}
2015-04-15 11:33 - 2015-04-15 15:28 - 00000000 ____D () C:\Program Files\CutterSystem
2015-04-15 11:31 - 2015-04-15 15:28 - 00000000 ____D () C:\Program Files\SalePeluss
2015-04-15 11:31 - 2015-04-15 11:31 - 00000000 ____D () C:\ProgramData\hegjabmdmckdgebcgakaamhddamcffdp
2015-04-15 11:30 - 2015-04-17 11:12 - 00000000 ____D () C:\ProgramData\{632bad20-cb0b-48cd-632b-bad20cb0b483}
2015-04-15 11:09 - 2015-04-02 02:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-15 11:09 - 2015-03-17 08:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-15 11:09 - 2015-03-17 08:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 11:09 - 2015-03-17 08:01 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 11:09 - 2015-03-17 08:01 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 11:09 - 2015-03-17 07:59 - 01306112 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 11:09 - 2015-03-17 07:56 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 11:09 - 2015-03-17 07:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 11:09 - 2015-03-17 07:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 11:09 - 2015-03-17 07:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 11:09 - 2015-03-17 07:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 11:09 - 2015-03-17 07:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 11:09 - 2015-03-13 06:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 11:09 - 2015-03-13 06:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 11:09 - 2015-03-13 06:42 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 11:09 - 2015-03-13 06:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 11:09 - 2015-03-13 06:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-15 11:09 - 2015-03-13 06:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 11:09 - 2015-03-13 06:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-15 11:09 - 2015-03-13 06:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-15 11:09 - 2015-03-13 06:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 11:09 - 2015-03-13 06:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 11:09 - 2015-03-13 06:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-15 11:09 - 2015-03-13 06:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 11:09 - 2015-03-13 06:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 11:09 - 2015-03-13 06:16 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-15 11:09 - 2015-03-13 06:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-15 11:09 - 2015-03-13 06:09 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 11:09 - 2015-03-13 06:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 11:09 - 2015-03-13 06:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 11:09 - 2015-03-13 05:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-15 11:09 - 2015-03-13 05:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 11:09 - 2015-03-13 05:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 11:09 - 2015-03-13 05:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 11:09 - 2015-03-13 05:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 11:09 - 2015-03-13 05:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 11:09 - 2015-03-13 05:43 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-15 11:09 - 2015-03-13 05:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-15 11:09 - 2015-03-13 05:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 11:09 - 2015-03-13 05:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 11:09 - 2015-03-13 05:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 11:09 - 2015-03-13 05:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 11:08 - 2015-03-25 06:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 11:08 - 2015-03-25 06:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 11:08 - 2015-03-10 06:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 11:08 - 2015-03-10 06:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 11:08 - 2015-03-05 07:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 11:08 - 2015-03-04 07:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 11:08 - 2015-03-04 07:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 11:08 - 2015-02-25 06:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 11:04 - 2015-04-16 14:47 - 00187239 _____ () C:\Users\Metody Metodiev\Desktop\departamentos playa avenida 1.2.dwg
2015-04-15 10:42 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-04-15 10:42 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-04-15 10:42 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-04-15 10:42 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-04-15 10:42 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-04-15 10:42 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-04-15 10:42 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-04-11 18:45 - 2015-04-11 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZBackitup
2015-04-11 18:32 - 2015-04-11 18:35 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\EASEUS Todo Backup Professional v2.5 + Boot CD
2015-04-11 18:11 - 2015-04-11 18:11 - 00000496 _____ () C:\Windows\Tasks\EZ Backup Ultimate.job
2015-04-11 17:55 - 2015-04-11 17:55 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\EZ Backup Ultimate
2015-04-11 17:45 - 2015-04-11 17:45 - 02597064 _____ () C:\Windows\rapidui.exe
2015-04-11 17:14 - 2015-04-11 17:15 - 01508423 _____ (Rob Decker ) C:\Users\Metody Metodiev\Downloads\EZBackitup_setup1.exe
2015-04-11 13:52 - 2015-04-11 13:52 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\koren-nti
2015-04-09 15:18 - 2015-03-23 06:06 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-09 15:18 - 2015-03-23 05:59 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-09 15:15 - 2015-04-15 17:34 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-09 15:15 - 2015-04-15 17:34 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-09 14:40 - 2015-04-09 14:40 - 00000000 ___HD () C:\Windows\msdownld.tmp
2015-04-09 11:01 - 2007-09-05 10:24 - 00920088 _____ (Intel® Corporation) C:\Windows\system32\heciudlg.exe
2015-04-09 11:00 - 2015-04-09 11:00 - 00000000 ____D () C:\Program Files\Intel Desktop Board
2015-04-08 16:59 - 2015-04-08 16:59 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-08 16:05 - 2015-04-08 16:05 - 00001101 _____ () C:\Users\Public\Desktop\Intel® Driver Update Utility 2.0.lnk
2015-04-08 16:05 - 2015-04-08 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility
2015-04-08 16:05 - 2015-04-08 16:05 - 00000000 ____D () C:\Program Files\Intel Driver Update Utility
2015-04-08 16:04 - 2015-04-15 10:41 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-08 12:33 - 2015-04-08 12:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WibuKey
2015-04-08 12:08 - 2015-04-08 12:07 - 00898472 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2015-04-08 12:08 - 2015-04-08 12:07 - 00818088 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2015-04-08 12:07 - 2015-04-08 12:07 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-04-08 11:30 - 2015-04-08 12:31 - 00491888 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WibuXpm4J32.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00471440 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\wibuKJni.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00344432 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WkExt32.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00157552 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WkWin32.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00082696 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\Drivers\WibuKey.sys
2015-04-08 11:30 - 2015-04-08 12:31 - 00022400 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\Drivers\Wibukey2.sys
2015-04-08 11:30 - 2015-04-08 11:30 - 00057552 _____ () C:\Windows\system32\WkDos.exe
2015-04-08 11:30 - 2015-04-08 11:30 - 00000000 ____D () C:\Program Files\WIBU-SYSTEMS
2015-04-07 17:53 - 2015-04-08 11:30 - 00000000 ____D () C:\Program Files\WIBUKEY
2015-04-06 13:18 - 2015-04-06 13:18 - 00880208 _____ (Google Inc.) C:\Users\Metody Metodiev\Downloads\GoogleEarthProSetup.exe
2015-04-04 16:49 - 2015-04-04 16:49 - 00010407 _____ () C:\Windows\system32\ScanResults.xml
2015-04-04 16:45 - 2015-04-04 16:45 - 00000464 _____ () C:\Windows\system32\ScannerSettings
2015-04-04 11:12 - 2015-04-04 11:12 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-02 16:16 - 2015-04-02 16:16 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\infinst_autol (1)
2015-04-02 15:49 - 2015-04-02 15:49 - 00000000 ____D () C:\Program Files\Realtek
2015-04-02 14:36 - 2015-04-02 17:00 - 00000000 ____D () C:\Program Files\DriverUpdate
2015-04-02 14:36 - 2015-04-02 16:24 - 00013368 _____ (SlimWare Utilities, Inc.) C:\Windows\system32\Drivers\SWDUMon.sys
2015-04-02 14:26 - 2015-04-02 14:26 - 00000386 _____ () C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Metody Metodiev).job
2015-04-02 14:25 - 2015-04-08 17:17 - 00017388 _____ () C:\Windows\system32\results.xml
2015-04-02 14:22 - 2015-04-08 16:20 - 00000000 ____D () C:\Program Files\Intel
2015-04-02 14:22 - 2011-02-28 08:09 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\system32\CSVer.dll
2015-04-02 14:13 - 2015-04-02 16:40 - 00000000 ___HD () C:\Program Files\Temp
2015-04-02 12:57 - 2015-04-02 12:57 - 00000000 ____D () C:\ProgramData\SlimWare Utilities, Inc
2015-04-02 12:55 - 2015-04-02 17:07 - 00000000 ____D () C:\Program Files\SlimCleaner Plus
2015-04-02 12:55 - 2015-04-02 14:36 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\SlimWare Utilities Inc
2015-04-02 12:54 - 2015-04-02 14:36 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2015-04-02 11:01 - 2015-04-02 11:01 - 00000000 ____D () C:\Windows\system32\Lang
2015-04-02 11:01 - 2015-04-02 11:01 - 00000000 ____D () C:\ProgramData\IntelDLM
2015-04-02 10:59 - 2015-04-02 10:59 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Intel
2015-04-01 13:38 - 2015-04-17 14:54 - 00000000 ____D () C:\FRST
2015-04-01 12:34 - 2015-04-01 12:34 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-01 12:09 - 2015-04-01 12:09 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-METODY-PD-Windows-7-Ultimate-(32-bit).dat
2015-04-01 12:09 - 2015-04-01 12:09 - 00000000 ____D () C:\RegBackup
2015-04-01 11:59 - 2015-04-01 12:00 - 00000000 ____D () C:\AdwCleaner
2015-03-31 17:45 - 2015-03-31 17:45 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\newSI_620
2015-03-31 17:42 - 2015-03-31 17:42 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\DRPSu
2015-03-28 13:52 - 2015-03-28 13:52 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\PSDKEYS.COM_Plants_Trees_Flowers_Grass_Collection_for_Maps
2015-03-27 12:39 - 2015-03-27 12:39 - 03704850 _____ () C:\Users\Metody Metodiev\Desktop\Пълномощно.tif

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-17 14:35 - 2014-08-28 13:15 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\Skype
2015-04-17 14:31 - 2015-01-31 13:17 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-17 13:01 - 2014-02-13 19:29 - 01677918 _____ () C:\Windows\WindowsUpdate.log
2015-04-17 12:39 - 2011-07-16 10:54 - 00002828 ___SH () C:\Windows\system32\KGyGaAvL.sys
2015-04-17 11:48 - 2011-07-16 13:20 - 00000000 ____D () C:\Users\Metody Metodiev\Graphisoft
2015-04-17 11:44 - 2013-08-01 12:45 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2015-04-17 11:43 - 2009-07-14 07:34 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-17 11:43 - 2009-07-14 07:34 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-17 11:34 - 2009-07-14 07:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-17 11:33 - 2013-11-22 23:59 - 00000000 ____D () C:\Windows\Temp752B8712-7F2C-66C1-0452-3ADABB6181D6-Signatures
2015-04-17 11:09 - 2014-09-30 17:45 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2015-04-17 11:08 - 2013-12-04 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
2015-04-17 11:08 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2015-04-16 13:58 - 2010-11-21 00:01 - 00852108 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-16 13:20 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\rescache
2015-04-16 12:49 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-15 17:35 - 2014-06-12 12:01 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Adobe
2015-04-15 17:19 - 2011-07-24 14:50 - 00040286 _____ () C:\Users\Metody Metodiev\Documents\plot.log
2015-04-15 15:02 - 2011-07-15 11:21 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\uTorrent
2015-04-15 14:40 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\system32\bg-BG
2015-04-15 13:47 - 2013-07-13 11:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 13:37 - 2011-07-14 20:42 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-15 10:42 - 2011-07-15 14:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2015-04-15 10:42 - 2011-07-15 14:22 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2015-04-15 10:38 - 2011-07-16 13:02 - 00000000 ____D () C:\Program Files\Autodesk
2015-04-12 14:18 - 2011-10-13 18:04 - 00000000 ____D () C:\Program Files\Perception
2015-04-11 18:45 - 2014-01-24 11:31 - 00000000 ____D () C:\Program Files\EZBackitup
2015-04-11 15:22 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-09 15:20 - 2014-12-11 12:15 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-09 15:20 - 2014-04-30 10:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-09 10:36 - 2013-12-10 18:04 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-08 13:11 - 2011-07-16 11:56 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\Install.GS
2015-04-08 12:08 - 2014-10-24 10:48 - 00000000 ____D () C:\Program Files\Java
2015-04-08 12:08 - 2013-09-11 17:23 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-08 12:07 - 2014-10-24 10:49 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-08 11:44 - 2009-12-03 09:00 - 02013696 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WibuKe32.cpl
2015-04-08 11:24 - 2012-03-02 11:34 - 00011580 _____ () C:\plot.log
2015-04-04 16:33 - 2010-11-20 23:57 - 00000000 ____D () C:\Users\Administrator
2015-04-02 17:10 - 2015-03-08 18:58 - 00000000 ____D () C:\Program Files\NWSoftware
2015-04-02 17:10 - 2011-07-18 12:41 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Google
2015-04-02 17:01 - 2015-03-08 18:58 - 00000000 ____D () C:\ProgramData\Focus Photoeditor 6
2015-04-02 16:40 - 2011-07-15 17:58 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-02 14:09 - 2011-07-31 12:46 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Downloaded Installations
2015-04-01 12:02 - 2009-07-14 07:53 - 00032586 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-01 11:54 - 2013-12-28 13:17 - 00448512 _____ (OldTimer Tools) C:\Users\Metody Metodiev\Desktop\TFC.exe
2015-03-31 18:07 - 2013-11-16 13:26 - 00000000 ____D () C:\Program Files\Foxit Software
2015-03-31 16:15 - 2012-01-26 12:22 - 00001718 _____ () C:\Users\Metody Metodiev\Documents\acad.err
2015-03-24 18:31 - 2013-12-24 19:29 - 00000938 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-03-24 18:31 - 2013-12-24 19:28 - 00000000 ____D () C:\Program Files\CCleaner
2015-03-24 15:50 - 2011-07-17 10:35 - 00000000 ____D () C:\PIN
2015-03-24 13:18 - 2014-10-03 14:31 - 00002790 _____ () C:\Windows\system32\debug.log
2015-03-22 13:56 - 2014-02-10 12:45 - 00000000 ____D () C:\Users\Metody Metodiev\Documents\Calibre Library
2015-03-21 11:38 - 2014-11-26 13:52 - 00000393 _____ () C:\Users\Metody Metodiev\Desktop\iepv.cfg

==================== Files in the root of some directories =======

2012-11-06 14:56 - 2013-01-02 11:57 - 0000744 _____ () C:\Users\Metody Metodiev\AppData\Roaming\burnaware.ini
2011-07-22 11:31 - 2013-02-11 16:04 - 0000125 _____ () C:\Users\Metody Metodiev\AppData\Roaming\Opusbext.dat
2011-07-28 12:59 - 2013-07-05 17:03 - 0031744 _____ () C:\Users\Metody Metodiev\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-03 11:28 - 2013-08-03 11:28 - 0000001 _____ () C:\Users\Metody Metodiev\AppData\Local\llftool.4.12.agreement
2014-08-22 13:58 - 2014-08-22 13:58 - 0068115 _____ () C:\Users\Metody Metodiev\AppData\Local\Metadata.xml
2011-07-17 13:01 - 2014-09-17 16:14 - 0007604 _____ () C:\Users\Metody Metodiev\AppData\Local\Resmon.ResmonCfg
2011-11-09 14:33 - 2011-11-09 14:33 - 0000147 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-14 16:01

==================== End Of Log ============================Addition.txt

 

Здравейте,

 

Web Companion е част от ad-aware програмата. Ако искате да се премахне, тогава деинсталирайте цялата Ad-aware програма. Ако искате да запазите програмата, но да премахнем само добавката защитава браузърите Web Companion, то тогава ще се наложи да използвам скрипт за да направя записа в Add\Remove programs видим, защото в момента е скрит и не може да се деинсталира:

 

Ad-Aware Web Companion (Version: 1.1.922.1860 - Lavasoft) Hidden

 

При вас като цяло обаче има други буби...За да ги премахнем направете следното:

 

Деинсталирайте от Control Panel-a следната програма: AppendInit. Можете да деинсталирате и видимия запис на Web Companion + Mozilla Maintenance Service (И двете са излишни за работата на браузърите).

 

След това изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

Пишете после как е положението.

 

 

Бтв, имате дори и Точка на възстановяване преди инсталирането на Web Companion. Ако не успеем да я изчистим по стандартния начин (нещо в което се съмнявам, но все пак), винаги можете да върнете точката преди инсталирането на добавката:

 

==================== Restore Points  =========================

15-04-2015 17:34:35 LavasoftWeCompanion

 

 

Поздрави!

  • Автор

Здравейте,

 AppendInit - такава програма не си спомням да съм виждал в Контрол панела. Web Companion и Mozilla Maintenance Service ги деинсталирах. Всъщност деинсталирах  Lavasoft Service и Web Companion се появи на Контрол панела. Деинсталирах и нея.

Това е логът на FRST:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-04-2015 01
Ran by Metody Metodiev at 2015-04-18 18:16:39 Run:2
Running from C:\Users\Metody Metodiev\Desktop
Loaded Profiles: Metody Metodiev (Available profiles: Metody Metodiev)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
CreateRestorePoint:
CloseProcesses:
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
FF Extension: SalePeluss - C:\Users\Metody Metodiev\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412\Extensions\[email protected] [2015-04-15]
S2 834b7789; "C:\Windows\system32\rundll32.exe" "c:\Program Files\CutterSystem\CutterSystem.dll",serv
2015-04-15 11:35 - 2015-04-16 13:11 - 00000000 ____D () C:\ProgramData\{fee1d0d0-1124-de00-fee1-1d0d01124340}
2015-04-15 11:33 - 2015-04-15 15:28 - 00000000 ____D () C:\Program Files\CutterSystem
2015-04-15 11:31 - 2015-04-15 15:28 - 00000000 ____D () C:\Program Files\SalePeluss
2015-04-15 11:31 - 2015-04-15 11:31 - 00000000 ____D () C:\ProgramData\hegjabmdmckdgebcgakaamhddamcffdp
2015-04-15 11:30 - 2015-04-17 11:12 - 00000000 ____D () C:\ProgramData\{632bad20-cb0b-48cd-632b-bad20cb0b483}
Ad-Aware Web Companion (Version: 1.1.922.1860 - Lavasoft) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
reboot:
end
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\Metody Metodiev\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412\Extensions\[email protected] => not found.
834b7789 => Service deleted successfully.
C:\ProgramData\{fee1d0d0-1124-de00-fee1-1d0d01124340} => Moved successfully.
"C:\Program Files\CutterSystem" => File/Directory not found.
C:\Program Files\SalePeluss => Moved successfully.
C:\ProgramData\hegjabmdmckdgebcgakaamhddamcffdp => Moved successfully.
C:\ProgramData\{632bad20-cb0b-48cd-632b-bad20cb0b483} => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\\SystemComponent => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\\SystemComponent => Value not found.

=========  bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

=========  netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

=========  ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

 

The system needed a reboot.

==== End of Fixlog 18:16:56 ====

 

 

 

 

Не мога да преценя как е положението. Утре ще видя.

Поздрави!

М.Методиев

Стартирали сте скрипта два пъти и затова някои неща вече са били изтрити и в лога са показани като липсващи. :)

 

Направете нова проверка с FRST.exe (сложете отметка пред Addition.txt преди да натиснете бутона SCAN) и публикувайте новите два лог файла да видим какво остава за почистване.

  • Автор

Здравейте,

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-04-2015 01
Ran by Metody Metodiev (administrator) on METODY-PD on 19-04-2015 12:00:27
Running from C:\Users\Metody Metodiev\Desktop
Loaded Profiles: Metody Metodiev (Available profiles: Metody Metodiev)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Acronis) C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
(CANON INC) C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe
(CANON INC.) C:\Windows\System32\cnwiolss.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(WIBU-SYSTEMS AG) C:\Program Files\WIBUKEY\Server\WkSvW32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation)
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [21646944 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5503768 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Network Server.lnk
ShortcutTarget: Network Server.lnk -> C:\Program Files\WIBUKEY\Server\WkSvMgr.exe (WIBU-SYSTEMS AG)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-631084387-3129735815-1494553587-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-04-08] (Oracle Corporation)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-08] (Oracle Corporation)
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.caminova.net/en/downloads/getmodule.aspx?lang=en
DPF: {167248DA-0F88-4DE1-B4B1-45176751026D} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/renew/CertManX.cab
DPF: {4DB62416-BC86-4439-B5BA-366948F47C8D} https://aixbs.b-trust.org/wl-dl/bs/client_test2/js/sign/SCManagerX.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0040-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_40-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-170-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_51-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0060-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_60-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0040-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 178.254.192.18 178.254.192.3

FireFox:
========
FF ProfilePath: C:\Users\Metody Metodiev\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412
FF DefaultSearchEngine: Yahoo
FF Homepage: https://www.google.bg/?gws_rd=cr&ei=uyufUu_LM8TfswabmoGACQ
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll [2014-03-31] (GARMIN Corp.)
FF Plugin: @graphisoft.com/GDL Web Plug-in -> C:\Program Files\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll [2012-06-25] (Graphisoft SE)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Windows\system32\npdeployJava1.dll [2015-04-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-08] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-631084387-3129735815-1494553587-1000: www.bobs.bg/bobsWinSigner -> C:\Users\Metody Metodiev\AppData\Roaming\BOBS\BOBS Web Plugin MSCAPI Sign\1.0.0.4\npbobsWinSigner.dll [2013-08-30] (BORICA - BANKSERVICE AD)
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\[email protected] [2015-04-08]

Chrome:
=======
CHR HomePage: Default -> https://www.google.bg/
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Bejeweled) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm [2015-04-10]
CHR Extension: (ButtonBeats DubCube) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdijiampoihanablcndnakhfbgfciogm [2015-04-10]
CHR Extension: (Adblock Plus) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-10]
CHR Extension: (Facebook Customizer (by Adblock Plus)) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\deoeenbkoccjaefmmhpmlegngdjohdcm [2015-04-10]
CHR Extension: (Bookmark Manager) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-17]
CHR Extension: (ButtonBass Dubstep Balls) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmjadonkmcblbkocpaaefjbceiijfdg [2015-04-10]
CHR Extension: (90`s Games) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\illbbfoihflomkbpcaaakhijinbnejom [2015-04-10]
CHR Extension: (Burton Snowboards) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndfadpmchcfmnidepggefbcjgelboimi [2015-04-10]
CHR Extension: (Google Wallet) - C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [830376 2013-02-15] (Acronis)
R2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3783672 2013-12-03] (Acronis)
S3 AppIDSvc; C:\Windows\System32\appidsvc.dll [27648 2015-02-03] (Microsoft Corporation) [File not signed]
R3 Appinfo; C:\Windows\System32\appinfo.dll [47104 2013-02-27] (Microsoft Corporation) [File not signed]
R2 AudioEndpointBuilder; C:\Windows\System32\Audiosrv.dll [475136 2015-02-03] (Microsoft Corporation) [File not signed]
R2 Audiosrv; C:\Windows\System32\Audiosrv.dll [475136 2015-02-03] (Microsoft Corporation) [File not signed]
R2 Canon imagePROGRAF Status Monitor; C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwisam.exe [726616 2014-02-10] (CANON INC)
R2 CryptSvc; C:\Windows\system32\cryptsvc.dll [143872 2015-02-03] (Microsoft Corporation) [File not signed]
S3 EFS; C:\Windows\System32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2012-12-13] (Flexera Software, Inc.)
S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [102912 2015-03-13] (Microsoft Corporation) [File not signed]
R2 IKEEXT; C:\Windows\System32\ikeext.dll [679424 2013-10-12] (Microsoft Corporation) [File not signed]
R2 iPFDeviceAgentService; C:\Windows\system32\Cnwiolss.exe [167752 2013-02-26] (CANON INC.)
R3 KeyIso; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation)
R2 MSSQLSERVER; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29178224 2007-02-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2008-07-18] (Hewlett-Packard) [File not signed]
S3 Netlogon; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\nlasvc.dll [242688 2014-12-06] (Microsoft Corporation) [File not signed]
R2 PcaSvc; C:\Windows\System32\pcasvc.dll [157184 2015-02-03] (Microsoft Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-07-18] (Hewlett-Packard) [File not signed]
R2 ProfSvc; C:\Windows\system32\profsvc.dll [164864 2014-12-19] (Microsoft Corporation) [File not signed]
S3 ProtectedStorage; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R2 SamSs; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [7084672 2013-03-26] (Acronis)
S3 TermService; C:\Windows\System32\termsrv.dll [523776 2014-10-14] (Microsoft Corporation) [File not signed]
S3 VaultSvc; C:\Windows\system32\lsass.exe [22528 2015-03-17] (Microsoft Corporation) [File not signed]
R3 WdiServiceHost; C:\Windows\system32\wdi.dll [76800 2015-01-09] (Microsoft Corporation) [File not signed]
R3 WdiSystemHost; C:\Windows\system32\wdi.dll [76800 2015-01-09] (Microsoft Corporation) [File not signed]
S3 WebClient; C:\Windows\System32\webclnt.dll [205824 2013-07-04] (Microsoft Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 WkSvw32.exe; C:\Program Files\WIBUKEY\Server\WkSvw32.exe [659336 2015-04-08] (WIBU-SYSTEMS AG)
S2 wuauserv; C:\Windows\system32\wuaueng.dll [2020864 2015-03-25] (Microsoft Corporation) [File not signed]
S3 WwanSvc; C:\Windows\System32\wwansvc.dll [185344 2014-01-28] (Microsoft Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 A38CCID; C:\Windows\System32\DRIVERS\a38ccid.sys [54528 2014-11-13] (Advanced Card Systems Ltd.) [File not signed]
R1 AFD; C:\Windows\system32\drivers\afd.sys [338944 2014-05-30] (Microsoft Corporation) [File not signed]
S3 AppID; C:\Windows\system32\drivers\appid.sys [50176 2015-02-03] (Microsoft Corporation) [File not signed]
S3 cxbu0wdm; C:\Windows\System32\DRIVERS\cxbu0wdm.sys [119040 2011-09-06] (HID Global Corporation)
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [514560 2015-02-25] (Microsoft Corporation) [File not signed]
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [14848 2010-06-19] (Siliten)
S0 is3srv; C:\Windows\System32\drivers\is3srv.sys [61328 2013-10-29] (iS3 Inc.)
R3 mcdbus; C:\Windows\System32\DRIVERS\mcdbus.sys [116736 2009-02-24] (MagicISO, Inc.) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation)
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [116224 2014-12-19] (Microsoft Corporation) [File not signed]
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [593920 2015-02-03] (Microsoft Corporation) [File not signed]
R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2011-10-16] (Padus, Inc.) [File not signed]
S3 RdpVideoMiniport; C:\Windows\System32\drivers\rdpvideominiport.sys [14848 2012-08-23] (Microsoft Corporation) [File not signed]
S3 RDPWD; C:\Windows\system32\Drivers\RDPWD.sys [184320 2014-07-17] (Microsoft Corporation) [File not signed]
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [66344 2013-10-29] (GFI Software)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [324096 2014-01-07] (Duplex Secure Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13368 2015-04-02] (SlimWare Utilities, Inc.)
R0 szkg5; C:\Windows\System32\DRIVERS\szkg.sys [61328 2013-10-29] (iS3 Inc.)
S3 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [888640 2013-12-03] (Acronis International GmbH)
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [74752 2014-11-11] (Microsoft Corporation) [File not signed]
S3 terminpt; C:\Windows\system32\drivers\terminpt.sys [24064 2012-08-23] (Microsoft Corporation) [File not signed]
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [736192 2013-12-03] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [130488 2013-12-03] (Acronis)
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [31232 2014-07-17] (Microsoft Corporation) [File not signed]
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [49152 2013-10-02] (Microsoft Corporation) [File not signed]
S3 TsUsbGD; C:\Windows\system32\drivers\TsUsbGD.sys [27136 2012-08-23] (Microsoft Corporation) [File not signed]
S3 usbaudio; C:\Windows\system32\drivers\usbaudio.sys [80896 2013-07-12] (Microsoft Corporation) [File not signed]
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [76288 2013-11-27] (Microsoft Corporation) [File not signed]
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [86016 2013-07-12] (Microsoft Corporation) [File not signed]
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [43520 2013-11-27] (Microsoft Corporation) [File not signed]
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [258560 2013-11-27] (Microsoft Corporation) [File not signed]
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [20480 2013-11-27] (Microsoft Corporation) [File not signed]
R3 usbscan; C:\Windows\System32\DRIVERS\usbscan.sys [36352 2013-07-03] (Microsoft Corporation) [File not signed]
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [24064 2013-11-27] (Microsoft Corporation) [File not signed]
S3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [146816 2013-07-12] (Microsoft Corporation) [File not signed]
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [116000 2013-12-03] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [85280 2013-12-03] (Acronis International GmbH)
R2 WIBUKEY; C:\Windows\System32\DRIVERS\WibuKey.sys [82696 2015-04-08] (WIBU-SYSTEMS AG)
R3 Wibukey2; C:\Windows\System32\drivers\wibukey2.sys [22400 2015-04-08] (WIBU-SYSTEMS AG)
S3 cpuz134; \??\C:\Users\METODY~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
R1 MpKsl65a8f750; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{41B20AA1-3731-433C-A77F-10028D21758C}\MpKsl65a8f750.sys [X]
R1 MpKsla6b8a7f7; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{41B20AA1-3731-433C-A77F-10028D21758C}\MpKsla6b8a7f7.sys [X]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2006-03-03] () [File not signed]
S4 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WinRing0_1_2_0; \??\C:\Users\Metody Metodiev\AppData\Local\Temp\tmp1802.tmp [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-19 12:00 - 2015-04-19 12:01 - 00020157 _____ () C:\Users\Metody Metodiev\Desktop\FRST.txt
2015-04-19 11:03 - 2015-04-19 11:03 - 00028864 _____ (Microsoft Corporation) C:\Users\Metody Metodiev\Downloads\KB3024777-x86.exe
2015-04-18 18:41 - 2015-01-30 01:53 - 00978520 _____ (Microsoft Corporation) C:\Users\Metody Metodiev\Desktop\msseces.exe
2015-04-18 18:18 - 2015-04-19 11:57 - 00000168 _____ () C:\Windows\setupact.log
2015-04-18 18:18 - 2015-04-18 18:18 - 00107016 _____ () C:\Users\Metody Metodiev\AppData\Local\GDIPFONTCACHEV1.DAT
2015-04-18 18:18 - 2015-04-18 18:18 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-18 18:17 - 2015-04-18 18:17 - 00414264 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-04-18 18:16 - 2015-04-18 18:16 - 00000000 ____D () C:\Users\Metody Metodiev\Desktop\FRST-OlderVersion
2015-04-18 17:06 - 2015-04-18 17:07 - 14839808 _____ () C:\Users\Metody Metodiev\Downloads\OPSWAT_GEARS_CLIENT_3445-7c867995737c1853977386e89a5560c5.msi
2015-04-18 16:34 - 2015-04-18 16:34 - 46627408 _____ () C:\Users\Metody Metodiev\Downloads\BDPUARLauncher.exe
2015-04-18 16:07 - 2015-04-18 16:07 - 00000366 _____ () C:\Users\Metody Metodiev\Desktop\cc_20150418_160707.reg
2015-04-18 14:53 - 2015-04-18 14:53 - 01190415 _____ () C:\Users\Metody Metodiev\Downloads\ProcessExplorer.zip
2015-04-18 13:40 - 2015-04-18 13:40 - 00002090 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-04-18 13:40 - 2015-04-18 13:40 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-04-18 13:22 - 2015-04-18 13:22 - 11557688 _____ (Microsoft Corporation) C:\Users\Metody Metodiev\Downloads\MSEInstall.exe
2015-04-17 17:24 - 2015-04-17 17:24 - 01057488 _____ (Adobe) C:\Users\Metody Metodiev\Downloads\install_readerdc_en_mssd_aaa_aih.exe
2015-04-17 17:11 - 2015-04-17 17:11 - 01056768 _____ () C:\Users\Metody Metodiev\Downloads\WOT-latest-en.msi
2015-04-17 15:30 - 2015-04-17 15:34 - 00000000 ____D () C:\ProgramData\Foolish IT
2015-04-17 15:30 - 2015-04-17 15:30 - 00053248 _____ () C:\Windows\system32\zlib.dll
2015-04-17 14:52 - 2015-04-18 18:16 - 01137664 _____ (Farbar) C:\Users\Metody Metodiev\Desktop\FRST.exe
2015-04-17 12:40 - 2015-04-17 12:40 - 00060662 _____ () C:\Users\Metody Metodiev\Desktop\Graphic1.eps
2015-04-15 17:35 - 2015-04-18 16:06 - 00000000 ____D () C:\Program Files\Lavasoft
2015-04-15 17:35 - 2015-04-18 15:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-04-15 17:33 - 2015-04-15 17:34 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\{13878C40-1706-4445-9466-7D582D4BE537}
2015-04-15 17:12 - 2015-04-15 17:12 - 00000000 ____D () C:\Users\Metody Metodiev\Documents\Inventor Server SDK ACAD 2016
2015-04-15 15:53 - 2015-04-15 15:53 - 00364683 _____ () C:\Users\Metody Metodiev\Downloads\2etaj.dwg
2015-04-15 14:18 - 2015-04-15 14:18 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\acad16po
2015-04-15 14:10 - 2015-04-15 14:12 - 221587400 _____ () C:\Users\Metody Metodiev\Downloads\acad16po.part3.rar
2015-04-15 14:09 - 2015-04-15 14:17 - 1073741824 _____ () C:\Users\Metody Metodiev\Downloads\acad16po.part2.rar
2015-04-15 14:09 - 2015-04-15 14:17 - 1073741824 _____ () C:\Users\Metody Metodiev\Downloads\acad16po.part1.rar
2015-04-15 11:48 - 2015-04-15 11:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-04-15 11:48 - 2015-04-15 11:48 - 00000000 ____D () C:\Program Files\7-Zip
2015-04-15 11:47 - 2015-04-15 11:48 - 01110476 _____ () C:\Users\Metody Metodiev\Downloads\7z920.exe
2015-04-15 11:09 - 2015-04-02 02:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-15 11:09 - 2015-03-17 08:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-04-15 11:09 - 2015-03-17 08:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 11:09 - 2015-03-17 08:01 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 11:09 - 2015-03-17 08:01 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 11:09 - 2015-03-17 07:59 - 01306112 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 11:09 - 2015-03-17 07:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 11:09 - 2015-03-17 07:56 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 11:09 - 2015-03-17 07:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 11:09 - 2015-03-17 07:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 11:09 - 2015-03-17 07:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 11:09 - 2015-03-17 07:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 11:09 - 2015-03-17 07:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 11:09 - 2015-03-17 07:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 11:09 - 2015-03-13 06:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 11:09 - 2015-03-13 06:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 11:09 - 2015-03-13 06:42 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 11:09 - 2015-03-13 06:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 11:09 - 2015-03-13 06:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-15 11:09 - 2015-03-13 06:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 11:09 - 2015-03-13 06:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-15 11:09 - 2015-03-13 06:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-15 11:09 - 2015-03-13 06:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 11:09 - 2015-03-13 06:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 11:09 - 2015-03-13 06:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-15 11:09 - 2015-03-13 06:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 11:09 - 2015-03-13 06:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 11:09 - 2015-03-13 06:16 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-15 11:09 - 2015-03-13 06:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-15 11:09 - 2015-03-13 06:09 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 11:09 - 2015-03-13 06:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 11:09 - 2015-03-13 06:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 11:09 - 2015-03-13 05:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-15 11:09 - 2015-03-13 05:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 11:09 - 2015-03-13 05:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 11:09 - 2015-03-13 05:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 11:09 - 2015-03-13 05:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 11:09 - 2015-03-13 05:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 11:09 - 2015-03-13 05:43 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-15 11:09 - 2015-03-13 05:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-15 11:09 - 2015-03-13 05:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 11:09 - 2015-03-13 05:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 11:09 - 2015-03-13 05:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 11:09 - 2015-03-13 05:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 03088384 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 02020864 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 11:08 - 2015-03-25 06:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 11:08 - 2015-03-25 06:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 11:08 - 2015-03-25 06:00 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 11:08 - 2015-03-10 06:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 11:08 - 2015-03-10 06:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 11:08 - 2015-03-05 07:06 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 11:08 - 2015-03-04 07:16 - 00249784 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 11:08 - 2015-03-04 07:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 11:08 - 2015-02-25 06:03 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 11:04 - 2015-04-16 14:47 - 00187239 _____ () C:\Users\Metody Metodiev\Desktop\departamentos playa avenida 1.2.dwg
2015-04-15 10:42 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-04-15 10:42 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-04-15 10:42 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-04-15 10:42 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-04-15 10:42 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-04-15 10:42 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-04-15 10:42 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-04-11 18:45 - 2015-04-11 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZBackitup
2015-04-11 18:32 - 2015-04-11 18:35 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\EASEUS Todo Backup Professional v2.5 + Boot CD
2015-04-11 18:11 - 2015-04-11 18:11 - 00000496 _____ () C:\Windows\Tasks\EZ Backup Ultimate.job
2015-04-11 17:55 - 2015-04-11 17:55 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\EZ Backup Ultimate
2015-04-11 17:45 - 2015-04-11 17:45 - 02597064 _____ () C:\Windows\rapidui.exe
2015-04-11 17:14 - 2015-04-11 17:15 - 01508423 _____ (Rob Decker ) C:\Users\Metody Metodiev\Downloads\EZBackitup_setup1.exe
2015-04-11 13:52 - 2015-04-11 13:52 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\koren-nti
2015-04-09 15:18 - 2015-03-23 06:06 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-09 15:18 - 2015-03-23 06:06 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-09 15:18 - 2015-03-23 05:59 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-09 15:15 - 2015-04-15 17:34 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-09 15:15 - 2015-04-15 17:34 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-09 14:40 - 2015-04-09 14:40 - 00000000 ___HD () C:\Windows\msdownld.tmp
2015-04-09 11:01 - 2007-09-05 10:24 - 00920088 _____ (Intel® Corporation) C:\Windows\system32\heciudlg.exe
2015-04-09 11:00 - 2015-04-09 11:00 - 00000000 ____D () C:\Program Files\Intel Desktop Board
2015-04-08 16:59 - 2015-04-08 16:59 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-08 16:05 - 2015-04-08 16:05 - 00001101 _____ () C:\Users\Public\Desktop\Intel® Driver Update Utility 2.0.lnk
2015-04-08 16:05 - 2015-04-08 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver Update Utility
2015-04-08 16:05 - 2015-04-08 16:05 - 00000000 ____D () C:\Program Files\Intel Driver Update Utility
2015-04-08 16:04 - 2015-04-15 10:41 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-08 12:33 - 2015-04-08 12:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WibuKey
2015-04-08 12:08 - 2015-04-08 12:07 - 00898472 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2015-04-08 12:08 - 2015-04-08 12:07 - 00818088 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2015-04-08 12:07 - 2015-04-08 12:07 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-04-08 11:30 - 2015-04-08 12:31 - 00491888 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WibuXpm4J32.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00471440 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\wibuKJni.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00344432 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WkExt32.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00157552 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WkWin32.dll
2015-04-08 11:30 - 2015-04-08 12:31 - 00082696 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\Drivers\WibuKey.sys
2015-04-08 11:30 - 2015-04-08 12:31 - 00022400 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\Drivers\Wibukey2.sys
2015-04-08 11:30 - 2015-04-08 11:30 - 00057552 _____ () C:\Windows\system32\WkDos.exe
2015-04-08 11:30 - 2015-04-08 11:30 - 00000000 ____D () C:\Program Files\WIBU-SYSTEMS
2015-04-07 17:53 - 2015-04-08 11:30 - 00000000 ____D () C:\Program Files\WIBUKEY
2015-04-06 13:18 - 2015-04-06 13:18 - 00880208 _____ (Google Inc.) C:\Users\Metody Metodiev\Downloads\GoogleEarthProSetup.exe
2015-04-04 16:49 - 2015-04-04 16:49 - 00010407 _____ () C:\Windows\system32\ScanResults.xml
2015-04-04 16:45 - 2015-04-04 16:45 - 00000464 _____ () C:\Windows\system32\ScannerSettings
2015-04-04 11:12 - 2015-04-04 11:12 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-02 16:16 - 2015-04-02 16:16 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\infinst_autol (1)
2015-04-02 15:49 - 2015-04-02 15:49 - 00000000 ____D () C:\Program Files\Realtek
2015-04-02 14:36 - 2015-04-02 17:00 - 00000000 ____D () C:\Program Files\DriverUpdate
2015-04-02 14:36 - 2015-04-02 16:24 - 00013368 _____ (SlimWare Utilities, Inc.) C:\Windows\system32\Drivers\SWDUMon.sys
2015-04-02 14:26 - 2015-04-02 14:26 - 00000386 _____ () C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Metody Metodiev).job
2015-04-02 14:25 - 2015-04-08 17:17 - 00017388 _____ () C:\Windows\system32\results.xml
2015-04-02 14:22 - 2015-04-08 16:20 - 00000000 ____D () C:\Program Files\Intel
2015-04-02 14:22 - 2011-02-28 08:09 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\system32\CSVer.dll
2015-04-02 14:13 - 2015-04-02 16:40 - 00000000 ___HD () C:\Program Files\Temp
2015-04-02 12:57 - 2015-04-02 12:57 - 00000000 ____D () C:\ProgramData\SlimWare Utilities, Inc
2015-04-02 12:55 - 2015-04-02 17:07 - 00000000 ____D () C:\Program Files\SlimCleaner Plus
2015-04-02 12:55 - 2015-04-02 14:36 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\SlimWare Utilities Inc
2015-04-02 12:54 - 2015-04-02 14:36 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2015-04-02 11:01 - 2015-04-02 11:01 - 00000000 ____D () C:\Windows\system32\Lang
2015-04-02 11:01 - 2015-04-02 11:01 - 00000000 ____D () C:\ProgramData\IntelDLM
2015-04-02 10:59 - 2015-04-02 10:59 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Intel
2015-04-01 13:38 - 2015-04-19 12:00 - 00000000 ____D () C:\FRST
2015-04-01 12:34 - 2015-04-01 12:34 - 00000000 ____D () C:\Program Files\HitmanPro
2015-04-01 12:09 - 2015-04-01 12:09 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-METODY-PD-Windows-7-Ultimate-(32-bit).dat
2015-04-01 12:09 - 2015-04-01 12:09 - 00000000 ____D () C:\RegBackup
2015-04-01 11:59 - 2015-04-01 12:00 - 00000000 ____D () C:\AdwCleaner
2015-03-31 17:45 - 2015-03-31 17:45 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\newSI_620
2015-03-31 17:42 - 2015-03-31 17:42 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\DRPSu
2015-03-28 13:52 - 2015-03-28 13:52 - 00000000 ____D () C:\Users\Metody Metodiev\Downloads\PSDKEYS.COM_Plants_Trees_Flowers_Grass_Collection_for_Maps
2015-03-27 12:39 - 2015-03-27 12:39 - 03704850 _____ () C:\Users\Metody Metodiev\Desktop\Пълномощно.tif

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-19 12:00 - 2014-08-28 13:15 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\Skype
2015-04-19 11:58 - 2009-07-14 07:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-19 11:56 - 2014-02-13 19:29 - 01974208 _____ () C:\Windows\WindowsUpdate.log
2015-04-19 11:31 - 2015-01-31 13:17 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-19 11:18 - 2010-11-21 00:01 - 00852108 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-19 11:17 - 2009-07-14 07:34 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-19 11:17 - 2009-07-14 07:34 - 00026576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-19 09:00 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2015-04-18 18:40 - 2011-07-14 20:26 - 00002198 _____ () C:\Windows\epplauncher.mif
2015-04-18 13:35 - 2014-09-30 17:45 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2015-04-18 13:26 - 2011-07-16 13:20 - 00000000 ____D () C:\Users\Metody Metodiev\Graphisoft
2015-04-18 11:12 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-17 12:39 - 2011-07-16 10:54 - 00002828 ___SH () C:\Windows\system32\KGyGaAvL.sys
2015-04-17 11:44 - 2013-08-01 12:45 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2015-04-17 11:33 - 2013-11-22 23:59 - 00000000 ____D () C:\Windows\Temp752B8712-7F2C-66C1-0452-3ADABB6181D6-Signatures
2015-04-17 11:08 - 2013-12-04 13:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
2015-04-16 13:20 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\rescache
2015-04-16 12:49 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-04-15 17:35 - 2014-06-12 12:01 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Adobe
2015-04-15 17:19 - 2011-07-24 14:50 - 00040286 _____ () C:\Users\Metody Metodiev\Documents\plot.log
2015-04-15 15:02 - 2011-07-15 11:21 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\uTorrent
2015-04-15 14:40 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\system32\bg-BG
2015-04-15 13:47 - 2013-07-13 11:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 13:37 - 2011-07-14 20:42 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-15 10:42 - 2011-07-15 14:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2015-04-15 10:42 - 2011-07-15 14:22 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2015-04-15 10:38 - 2011-07-16 13:02 - 00000000 ____D () C:\Program Files\Autodesk
2015-04-12 14:18 - 2011-10-13 18:04 - 00000000 ____D () C:\Program Files\Perception
2015-04-11 18:45 - 2014-01-24 11:31 - 00000000 ____D () C:\Program Files\EZBackitup
2015-04-11 15:22 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-09 15:20 - 2014-12-11 12:15 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-09 15:20 - 2014-04-30 10:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-08 13:11 - 2011-07-16 11:56 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Roaming\Install.GS
2015-04-08 12:08 - 2014-10-24 10:48 - 00000000 ____D () C:\Program Files\Java
2015-04-08 12:08 - 2013-09-11 17:23 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-08 12:07 - 2014-10-24 10:49 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-08 11:44 - 2009-12-03 09:00 - 02013696 _____ (WIBU-SYSTEMS AG) C:\Windows\system32\WibuKe32.cpl
2015-04-08 11:24 - 2012-03-02 11:34 - 00011580 _____ () C:\plot.log
2015-04-04 16:33 - 2010-11-20 23:57 - 00000000 ____D () C:\Users\Administrator
2015-04-02 17:10 - 2015-03-08 18:58 - 00000000 ____D () C:\Program Files\NWSoftware
2015-04-02 17:10 - 2011-07-18 12:41 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Google
2015-04-02 17:01 - 2015-03-08 18:58 - 00000000 ____D () C:\ProgramData\Focus Photoeditor 6
2015-04-02 16:40 - 2011-07-15 17:58 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2015-04-02 14:09 - 2011-07-31 12:46 - 00000000 ____D () C:\Users\Metody Metodiev\AppData\Local\Downloaded Installations
2015-04-01 12:02 - 2009-07-14 07:53 - 00032586 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-01 11:54 - 2013-12-28 13:17 - 00448512 _____ (OldTimer Tools) C:\Users\Metody Metodiev\Desktop\TFC.exe
2015-03-31 18:07 - 2013-11-16 13:26 - 00000000 ____D () C:\Program Files\Foxit Software
2015-03-31 16:15 - 2012-01-26 12:22 - 00001718 _____ () C:\Users\Metody Metodiev\Documents\acad.err
2015-03-24 18:31 - 2013-12-24 19:29 - 00000938 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-03-24 18:31 - 2013-12-24 19:28 - 00000000 ____D () C:\Program Files\CCleaner
2015-03-24 15:50 - 2011-07-17 10:35 - 00000000 ____D () C:\PIN
2015-03-24 13:18 - 2014-10-03 14:31 - 00002790 _____ () C:\Windows\system32\debug.log
2015-03-22 13:56 - 2014-02-10 12:45 - 00000000 ____D () C:\Users\Metody Metodiev\Documents\Calibre Library
2015-03-21 11:38 - 2014-11-26 13:52 - 00000393 _____ () C:\Users\Metody Metodiev\Desktop\iepv.cfg

==================== Files in the root of some directories =======

2012-11-06 14:56 - 2013-01-02 11:57 - 0000744 _____ () C:\Users\Metody Metodiev\AppData\Roaming\burnaware.ini
2011-07-22 11:31 - 2013-02-11 16:04 - 0000125 _____ () C:\Users\Metody Metodiev\AppData\Roaming\Opusbext.dat
2011-07-28 12:59 - 2013-07-05 17:03 - 0031744 _____ () C:\Users\Metody Metodiev\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-03 11:28 - 2013-08-03 11:28 - 0000001 _____ () C:\Users\Metody Metodiev\AppData\Local\llftool.4.12.agreement
2014-08-22 13:58 - 2014-08-22 13:58 - 0068115 _____ () C:\Users\Metody Metodiev\AppData\Local\Metadata.xml
2011-07-17 13:01 - 2014-09-17 16:14 - 0007604 _____ () C:\Users\Metody Metodiev\AppData\Local\Resmon.ResmonCfg
2011-11-09 14:33 - 2011-11-09 14:33 - 0000147 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-14 16:01

==================== End Of Log ============================

 

Addition.txt

Няма остатъци от зловреден софтуер според логовете...само такива от Ad-aware.

За да ги почистим направете следното:

 

След това изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

 

След това нека да проверим за остатъци:

 

 

 

СТЪПКА 1

 

  • Изтеглете и стартирайтe 6sv1DN9.jpgAdwCleaner.exe.
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[s0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието му в следващия си коментар.

 

 

СТЪПКА 2

 

 

Моля изтеглете icon1351185104.png Junkware Removal Tool на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

 

СТЪПКА 3

 

 

 

Моля изтеглете Malwarebytes Anti-Malware 2.1.4.1018 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-2.0.4.1028.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.
  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

СТЪПКА 4

 

 

 

1.Изтеглете Hitman Pro.
За 32-битова система - dEMD6.gif.
За 64-битова система - Download-button3.gif


2.Стартирайте програмата.

3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 
6-scanfin-choose.jpg
 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

 

 

Пишете после как е положението.

 

 

Поздрави!

  • Автор

ix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-04-2015 01
Ran by Metody Metodiev at 2015-04-19 15:13:50 Run:3
Running from C:\Users\Metody Metodiev\Desktop
Loaded Profiles: Metody Metodiev (Available profiles: Metody Metodiev)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [66344 2013-10-29] (GFI Software)
C:\Windows\System32\DRIVERS\sbapifs.sys
2015-04-15 17:35 - 2015-04-18 16:06 - 00000000 ____D () C:\Program Files\Lavasoft
2015-04-15 17:35 - 2015-04-18 15:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
Folder: C:\Users\Metody Metodiev\AppData\Roaming\{13878C40-1706-4445-9466-7D582D4BE537}
end
*****************

sbapifs => Service stopped successfully.
sbapifs => Service deleted successfully.
C:\Windows\System32\DRIVERS\sbapifs.sys => Moved successfully.
C:\Program Files\Lavasoft => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft => Moved successfully.

========================= Folder: C:\Users\Metody Metodiev\AppData\Roaming\{13878C40-1706-4445-9466-7D582D4BE537} ========================

====== End of Folder: ======

==== End of Fixlog 15:13:51 ====

 

Продължавам с почистването.

  • Автор

# AdwCleaner v4.201 - Logfile created 19/04/2015 at 15:22:38
# Updated 08/04/2015 by Xplode
# Database : 2015-04-18.3 [server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x86)
# Username : Metody Metodiev - METODY-PD
# Running from : C:\Users\Metody Metodiev\Desktop\adwcleaner_4.201.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

Task Deleted : driverupdate startup

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
Key Deleted : HKLM\SOFTWARE\f09e9cf3-4c2e-7ec9-198e-3afc1d91949d
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Key Deleted : HKCU\Software\Reimage
Key Deleted : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\Reimage
Key Deleted : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17728

-\\ Mozilla Firefox v37.0.1 (x86 en-US)

[w5uuc21c.default-1427894370412\prefs.js] - Line Deleted : user_pref("extensions.cH5fjYHWI4YVv5E3.scode", "(function(){try{if(window.self.location.href.indexOf(\"rjgGpdn9qTr9pdg5pdkFpjC8pdk\")>-1){return;}}catch(e){}try{var d=[[\"trianglecash.com\",\"acebook\[...]

-\\ Google Chrome v

[C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3321459&octid=EB_ORIGINAL_CTID&ISID=M853C6506-DB32-4FE8-A88D-F68EA334B217&SearchSource=58&CUI=&UM=6&UP=SP21A9D281-4343-4C94-8289-FBB1A4D483AB&q={searchTerms}&SSPV=
[C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&ctid=CT3220468
[C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://istart.webssearches.com/web/?type=ds&ts=1411482714&from=mind&uid=HitachiXHTS541616J9SA00_SB2482SJKZWP0HKZWP0HX&q={searchTerms}
[C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://istart.webssearches.com/web/?type=ds&ts=1411482714&from=mind&uid=HitachiXHTS541616J9SA00_SB2482SJKZWP0HKZWP0HX&q={searchTerms}
[C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Extension] : kfgaibfbmkjgmimhbbaikfnpkkjkpoan

-\\ Comodo Dragon v

-\\ Chrome Canary v

*************************

AdwCleaner[R0].txt - [7185 bytes] - [01/04/2015 11:59:27]
AdwCleaner[R1].txt - [3346 bytes] - [19/04/2015 15:21:14]
AdwCleaner[s0].txt - [7400 bytes] - [01/04/2015 12:00:43]
AdwCleaner[s1].txt - [3320 bytes] - [19/04/2015 15:22:38]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [3379  bytes] ##########

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.8 (04.17.2015:1)
OS: Windows 7 Ultimate x86
Ran by Metody Metodiev on 19.04.2015 at 15:33:13.56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Tasks

Successfully deleted: [Task] C:\Windows\System32\Tasks\DriverUpdate Scan
Successfully deleted: [Task] C:\Windows\System32\Tasks\SlimDrivers Startup

 

~~~ Registry Values

 

~~~ Registry Keys

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\opswat
Successfully deleted: [Folder] C:\Program Files\opswat

 

~~~ FireFox

Emptied folder: C:\Users\Metody Metodiev\AppData\Roaming\mozilla\firefox\profiles\w5uuc21c.default-1427894370412\minidumps [1 files]

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.04.2015 at 15:34:44.89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Update, 19.04.2015 15:39:39, SYSTEM, METODY-PD, Manual, Remediation Database, 2015.3.9.1, 2015.4.6.2,
Update, 19.04.2015 15:39:39, SYSTEM, METODY-PD, Manual, Rootkit Database, 2015.2.25.1, 2015.3.31.1,
Update, 19.04.2015 15:39:41, SYSTEM, METODY-PD, Manual, Malware Database, 2015.3.9.5, 2015.4.19.2,
Error, 19.04.2015 15:41:40, SYSTEM, METODY-PD, Scan, SDKDatabaseLoadDefaults failed with code: 20021, 20021,
Update, 19.04.2015 15:41:42, SYSTEM, METODY-PD, Manual, Remediation Database, 0.0.0.0, 2015.4.6.2,
Update, 19.04.2015 15:41:42, SYSTEM, METODY-PD, Manual, Rootkit Database, 0.0.0.0, 2015.3.31.1,
Update, 19.04.2015 15:41:45, SYSTEM, METODY-PD, Manual, Malware Database, 0.0.0.0, 2015.4.19.2,
Scan, 19.04.2015 16:03:20, SYSTEM, METODY-PD, Manual, Начало: 19.04.2015 15:41:47, Продължителност: 21 мин. 11 сек., Сканиране за заплахи, Завършено, 0 открита злонамерени програми, 8 открити нежелани програми,

(end)


HitmanPro 3.7.9.240

www.hitmanpro.com
   Computer name . . . . : METODY-PD

   Windows . . . . . . . : 6.1.1.7601.X86/2

   User name . . . . . . : Metody-PD\Metody Metodiev

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Trial (Expired)
   Scan date . . . . . . : 2015-04-19 16:13:03

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 7m 37s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
   Threats . . . . . . . : 1

   Traces  . . . . . . . : 11
   Objects scanned . . . : 1 697 117

   Files scanned . . . . : 26 578

   Remnants scanned  . . : 242 792 files / 1 427 747 keys
Miniport ____________________________________________________________________
   Primary

      DriverObject . . . : 86CF5718

      DriverName . . . . : \Driver\atapi

      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys

      StartIo  . . . . . : 00000000 +0

      IRP_MJ_SCSI  . . . : 86CDC1F8 +0

   Solution

      DriverObject . . . : 86CF5718

      DriverName . . . . : \Driver\atapi

      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys

      StartIo  . . . . . : 00000000 +0

      IRP_MJ_SCSI  . . . : 8DA5544E \SystemRoot\system32\drivers\ataport.SYS+25678
Malware _____________________________________________________________________
   C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\s_inst.exe

      Size . . . . . . . : 266 240 bytes

      Age  . . . . . . . : 18.9 days (2015-03-31 17:45:04)

      Entropy  . . . . . : 6.2

      SHA-256  . . . . . : AC34FA758DB4A659130D8583E1EB3FD2D387F2C2A2BAD6262141D0CBECEDD88A

    > Bitdefender  . . . : Gen:Variant.Jaik.6059

      Fuzzy  . . . . . . : 107.0

      Forensic Cluster

         -0.2s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\

         -0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\cp.bat

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\config.json

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\main.ini

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\s_inst.exe

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\background.html

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\background.js

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\content_script.js

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\manifest.json

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\options.html

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\options.js

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\ping.js

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\style.css

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\wp_background.js

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\wp_content_script.js

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\img\

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\img\favicon.png

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\img\icon128.png

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\img\icon32.png

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\img\icon48.png

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\img\icon_16.png

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_locales\en\

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_locales\en\messages.json

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_locales\

          0.0s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\scripts\

          0.1s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_locales\ru\

          0.1s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_locales\ru\messages.json

          0.1s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_metadata\

          0.1s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_metadata\computed_hashes.json

          0.1s C:\Users\Metody Metodiev\AppData\Roaming\newSI_620\chrome\wall_pepper\pepjgkdpkihjnbdaggonbpphlfkbhdli\_metadata\verified_contents.json

          0.9s C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Preferences_bkp

          0.9s C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Protected Preferences_bkp

          0.9s C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences_bkp

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\img\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\img\favicon.png

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\background.html

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\background.js

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\content_script.js

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\img\icon128.png

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\img\icon32.png

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\img\icon48.png

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\img\icon_16.png

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\manifest.json

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\options.html

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\options.js

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\ping.js

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_locales\en\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_locales\en\messages.json

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_locales\ru\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_locales\ru\messages.json

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_locales\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_metadata\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_metadata\computed_hashes.json

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\style.css

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\wp_background.js

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\wp_content_script.js

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\scripts\

          1.0s C:\FRST\Quarantine\C\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\pepjgkdpkihjnbdaggonbpphlfkbhdli\1.0.4_0\_metadata\verified_contents.json

          3.3s C:\AdwCleaner\Quarantine\C\Users\Metody Metodiev\AppData\Roaming\SetMyHomePage\main.ini.vir

          3.4s C:\AdwCleaner\Quarantine\C\Users\Metody Metodiev\AppData\Roaming\SetMyHomePage\setmyhomepage.exe.vir


Suspicious files ____________________________________________________________
   C:\Users\Metody Metodiev\Desktop\FRST-OlderVersion\FRST.exe

      Size . . . . . . . : 1 137 152 bytes

      Age  . . . . . . . : 2.1 days (2015-04-17 14:52:44)

      Entropy  . . . . . : 8.0

      SHA-256  . . . . . : C170A55C6555C003E1C74FDC526F4ABE7350D3DEE779786D01FA8A7605120B05

      Needs elevation  . : Yes

      Fuzzy  . . . . . . : 24.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.
   C:\Users\Metody Metodiev\Desktop\FRST.exe

      Size . . . . . . . : 1 137 664 bytes

      Age  . . . . . . . : 0.9 days (2015-04-18 18:16:28)

      Entropy  . . . . . : 8.0

      SHA-256  . . . . . : 2253B88A9D4C78F975CBB084907BEBC125703CF2B83B6AA6B2EA74193B780ADA

      Needs elevation  . : Yes

      Source URL . . . . : hxxp://download.bleepingcomputer.com/dl/7fbf545a8f0df02d6ec6001e408c45e8/55327554/windows/security/security-utilities/f/farbar-recovery-scan-tool/32/FRST.exe

      Fuzzy  . . . . . . : 27.0

         Program has no publisher information but prompts the user for permission elevation.

         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.

         The file is downloaded from the Internet to this computer.

         Authors name is missing in version info. This is not common to most programs.

         Version control is missing. This file is probably created by an individual. This is not typical for most programs.

         Time indicates that the file appeared recently on this computer.

      References

         HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Users\Metody Metodiev\Desktop\FRST.exe

      Forensic Cluster

         -1.3s C:\Users\Metody Metodiev\AppData\Roaming\Microsoft\Windows\Cookies\PLGJQU67.txt

         -1.3s C:\Users\Metody Metodiev\AppData\Roaming\Microsoft\Windows\Cookies\EBNMQT31.txt

         -1.3s C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZA7ARGQ4\81[1].htm

         -0.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Resource\{28D70F68-809E-48C3-8E14-D169DE762B93}

          0.0s C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\71W4O03H\FRST[1].exe

          0.0s C:\Users\Metody Metodiev\Desktop\FRST.exe

          1.7s C:\Users\Metody Metodiev\Desktop\FRST-OlderVersion\


Potential Unwanted Programs _________________________________________________
   HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\ (UniDeals)

   HKU\S-1-5-18\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\ (UniDeals)

   HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ (UniDeals)

   HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\ (UniDeals)

   HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.\ (ReimageRepair)

   HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ (UniDeals)

   HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\ (UniDeals)

Здравейте,

 

Почти сме готови.

 

Публикували сте грешния лог от MBAM.

 

  • Отворете Malwarebytes (MBAM) и отидете до табът History > Application Logs.
  • Отворете рапорта с името Scan Log (не Protection Log) последната дата и час и натиснете бутона "Copy to Clipboard"

65ZBqkR.jpg

  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

След това изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

Пишете как са нещата след това.

 

 

Поздрави!

  • Автор

Със МВАМ нещо не съм направил както трябва. Напоследък нямам Scan Logs, а само Protection. Не знам защо.

 

post-344460-0-70538400-1429455846_thumb.

 

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-04-2015 01
Ran by Metody Metodiev at 2015-04-19 17:53:35 Run:4
Running from C:\Users\Metody Metodiev\Desktop
Loaded Profiles: Metody Metodiev (Available profiles: Metody Metodiev)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
C:\Users\Metody Metodiev\AppData\Roaming\newSI_620
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
DeleteKey: HKU\S-1-5-18\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
DeleteKey: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
DeleteKey: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}
DeleteKey: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
DeleteKey: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}
DeleteKey: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}
exit
*****************

C:\Users\Metody Metodiev\AppData\Roaming\newSI_620 => Moved successfully.
HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} => Key Deleted Successfully.
HKU\S-1-5-18\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} => Key not found.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} => Key Deleted Successfully.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040} => Failed to delete key at first attempt (Error: C0000121), see next line.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040} => Key Deleted Successfully.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief. => Failed to delete key at first attempt (Error: C0000121), see next line.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief. => Key Deleted Successfully.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} => Key not found.
HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040} => Key not found.
exit => Error: No automatic fix found for this entry.

==== End of Fixlog 17:53:36 ====

А проверка изобщо направихте ли?

 

Я направо инсталирайте последната версия оттук => Malwarebytes Anti-Malware 2.1.6.1022 Final

Инсталирайте я и отидете до секцията Settings => Клкнете на колонката Detection and protection => сложете отметка пред Scan for rootkits.

Отидете сега до секцията Scan => кликнете на Threat Scan и изчакайте да проверката да завърши и след това вижте за лог файла и ако се е появил вече тогава го публикувайте в следващия си коментар.

 

 

Поздрави!

  • Автор

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 20.04.2015
Scan Time: 11:07:29
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.04.19.05
Rootkit Database: v2015.03.31.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Metody Metodiev

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 392598
Time Elapsed: 18 min, 23 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Disabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Disabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

Преди да приключим да направим следното:

 

 

СТЪПКА 1

 

 

Изтеглете ZOEK (by Smeenk) и да го запишете на вашия работен плот
Временно деактивирайте вашата антивирусна и антишпионска защита - инструкции при необходимост ще намерите тук

  • Щракнете с десния бутон върху тази икона  51a612a8b27e2-Zoek.pngи изберете RunAsAdmin.jpg Run as Administrator, за да стартирате инструмента.
  • Изчакайте търпеливо, докато  се появи  главната конзола (може да отнеме минута или две).

52b6de58f1952-Zoek_Startpagina_5.0.0.0.P

  • В главния прозорец, моля поставете в следния скрипт:

 

createsrpoint;
autoclean;

  • Уверете се, че  опцията Scan All Users е маркирана.
  • Натиснете Run Script и изчакайте. Сканирането може да отнеме няколко минути.
  • Когато сканирането приключи, ще се отвори лог файл с име zoek-results.
  • Ако е необходимо рестартиране, той ще се отвори след това.
  • Копирайте съдържанието му в следващия си отговор.

 

 

СТЪПКА 2

 

 

icon_zps423a0d9f.jpgМоля изтеглете ZHPcleaner и я запазете на вашия десктоп.

  • Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
  • Кликнете върху Ashampoo_Snap_20140819_13h09m50s_001__zp за да се съгласите с лицензионното споразумение.
  • Изберете бутона y3pI4LR.png.
  • Браузърите ще бъдат затворени автоматично.
  • Ще се отвори лог файл след прикючването на проверката.
  • Публикувайте лог файла в следващия си коментар.

 

 

 

СТЪПКА 3

 

 

emsisoft_emergency_kit.pnglogo.png

  • Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
  • Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
  • Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

EKK.gif

  • След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
  • Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
  • Сега вече изберете бутона Full Scan. Когато проверката приключи натиснете бутона View Report.
  • Копирайте съдържанието на лог файла в следващия си коментар.

 

 

СТЪПКА 4

 

 

Нека да видим за стар и уязвим софтуер:

 

 

Изтеглете Security Check от screen317 от този линк или и го запаметете на вашия десктоп.
Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля прикачете го в следващия ви коментар в тази тема.

 

Като видя и последните резултати ще ви дам финални съвети.

Поздрави!

  • Автор

Zoek.exe v5.0.0.0 Updated 08-April-2015
Tool run by Metody Metodiev on 20.04.2015 at 15:43:56.09.
Microsoft Windows 7 Ultimate  6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Metody Metodiev\Desktop\zoek.exe    [scan all users] [script inserted]

==== System Restore Info ======================

20.04.2015 15:46:38 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\Program Files\DriverUpdate deleted successfully
C:\Program Files\Foxit Software deleted successfully
C:\Program Files\Greatis deleted successfully
C:\Program Files\HitmanPro deleted successfully
C:\Program Files\McAfee Security Scan deleted successfully
C:\Program Files\MSXML 4.0 deleted successfully
C:\Program Files\NWSoftware deleted successfully
C:\Program Files\Perception deleted successfully
C:\Program Files\Skype 3.8 deleted successfully
C:\Program Files\Xenocode deleted successfully
C:\Program Files\Common Files\DivX Shared deleted successfully
C:\PROGRA~2\CorelDRAW Graphics Suite X6 deleted successfully
C:\PROGRA~2\Focus Photoeditor 6 deleted successfully
C:\PROGRA~2\Focus Photoeditor 6 Users deleted successfully
C:\PROGRA~2\Foolish IT deleted successfully
C:\PROGRA~2\Google deleted successfully
C:\PROGRA~2\RegRun deleted successfully
C:\PROGRA~2\VMware deleted successfully
C:\Users\Metody Metodiev\AppData\Roaming\Abvent deleted successfully
C:\Users\Metody Metodiev\AppData\Roaming\AdobeUM deleted successfully
C:\Users\Metody Metodiev\AppData\Roaming\Google deleted successfully
C:\Users\Metody Metodiev\AppData\Roaming\tor deleted successfully
C:\Users\Metody Metodiev\AppData\Roaming\{13878C40-1706-4445-9466-7D582D4BE537} deleted successfully
C:\Users\Metody Metodiev\AppData\Local\Axialis deleted successfully
C:\Users\Metody Metodiev\AppData\Local\BTrust deleted successfully
C:\Users\Metody Metodiev\AppData\Local\CrashDumps deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-631084387-3129735815-1494553587-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9A9F603B-51A8-4630-AE99-4BBF01675575} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\METODY~1\AppData\Roaming\Mozilla\Firefox\Profiles\794xfgg7.default-1378903933559

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs__1603_.backup

ProfilePath: C:\Users\METODY~1\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412

user.js not found
---- Lines extensions.cH5fjYHWI4YVv5E3 removed from prefs.js ----
user_pref("extensions.cH5fjYHWI4YVv5E3.epoch", "1429354688");
user_pref("extensions.cH5fjYHWI4YVv5E3.url", "http://guardsetstarr.info/sync2/?q=hfZ9oemMC7n5hShEAen0rHwFqTwMg708BNmGWj8cmGhGheDUojw8rdnFqja5rHwHrShIC
---- FireFox user.js and prefs.js backups ----

prefs__1603_.backup

==== Deleting Files \ Folders ======================

C:\Program Files\DriverUpdate not found
C:\Program Files\Foxit Software not found
C:\Program Files\Greatis not found
C:\Program Files\McAfee Security Scan not found
C:\Program Files\NWSoftware not found
C:\Program Files\Perception not found
C:\Program Files\Skype 3.8 not found
C:\Program Files\Xenocode not found
C:\Program Files\UltraISO deleted
C:\Users\Metody Metodiev\AppData\Roaming\calibre deleted
C:\Users\Metody Metodiev\AppData\LocalLow\{836BAA7E-8FC8-6CCA-8608-2273F441DD3F} deleted
C:\Users\Metody Metodiev\AppData\LocalLow\{C2F3D533-F89E-BD06-7FD7-6591610E198F} deleted
C:\PROGRA~2\10FB753404EFF550000010FB6441FEAE deleted
C:\PROGRA~2\18347744314017985998 deleted
C:\PROGRA~2\DivX deleted
C:\Program Files\Smart File Advisor deleted
C:\Users\Metody Metodiev\AppData\Roaming\burnaware.ini deleted
C:\Users\Metody Metodiev\AppData\Roaming\DRPSu deleted
C:\PROGRA~2\Adobe-BackupByPhotoshopCS5Portable deleted
C:\PROGRA~2\InstallMate deleted
C:\PROGRA~2\Package Cache deleted
C:\Users\Metody Metodiev\AppData\Local\cache deleted
C:\Users\Metody Metodiev\AppData\LocalLow\{7F08F20E-3871-037E-48CE-8ADFD643076C} deleted
C:\Users\Metody Metodiev\AppData\LocalLow\{8C4091E0-EF77-BAB4-4F75-292C1F8CD9B3} deleted
C:\Windows\System32\InstallUtil.InstallLog deleted
"C:\Windows\Installer\3a1a97.msi" deleted
"C:\Program Files\Perfect Uninstaller\Contextmenu.dll" deleted
"C:\Program Files\Perfect Uninstaller" not deleted
"C:\Windows\system32\config\systemprofile\Searches" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\METODY~1\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412
user_pref("browser.startup.homepage", "https://www.google.bg/?gws_rd=cr&ei=uyufUu_LM8TfswabmoGACQ");
user_pref("browser.search.defaultenginename", "Yahoo");

==== Firefox Extensions ======================

AppDir: C:\Program Files\Mozilla Firefox
- B-Trust Smart Card Certificate - %AppDir%\extensions\[email protected]
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Metody Metodiev\AppData\Roaming\Mozilla\Firefox\Profiles\w5uuc21c.default-1427894370412
D937A4645EFF8CB4F123E3C899C052B2 - C:\Program Files\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.6
049BD7AD3B94F24FA274ED1F7FC5871B - C:\Program Files\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.6
F9DE379CE8A782530A4FA0B731F3A49B - C:\Program Files\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.6
5D4279248A0E506CF007BD51EBF74CEA - C:\Program Files\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.6
559E8D42BE485208F1C4BB294D6840A4 - C:\Program Files\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.6
0806948270D853B709CCBBF38AF167E4 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat
9DF0C4F0CEF60158614EDD1B3AB441EE - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
98137411B9C632095F919E2CE70B288A - C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll - Google Update
893BF7D2261C56C24F813405D9D018E0 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll - Silverlight Plug-In
65F86262898A3C50CBD6BF8A9840A7EA - C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll - Java Platform SE 8 U40
CA8A2850F3BFDF9F98BC91236620B146 - C:\Windows\system32\npdeployJava1.dll - Java Deployment Toolkit 8.0.400.26
7AA0B6730ACBDEC97F1ED6D91B1E9B7D - C:\Program Files\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll - ArchiCAD
BE40D3882DCDC3E4BD8B284B8D5F4FDB - C:\Program Files\Garmin GPS Plugin\npGarmin.dll - Garmin Communicator Plug-In
9AE02005247DA91AB1743F5208DBEF76 - C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll - Shockwave Flash
C8159EEEC4539EC60FC9720F12342108 - C:\Users\Metody Metodiev\AppData\Roaming\BOBS\BOBS Web Plugin MSCAPI Sign\1.0.0.4\npbobsWinSigner.dll - BOBS Web Plugin MSCAPI Sign
8DA2ED6B04EA33F2EAE8BA883F903729 - C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrlui.dll - Microsoft® Silverlight
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System

==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Administrator\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Guest\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Metody Metodiev\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Metody Metodiev\AppData\Local\Comodo\Dragon deleted

==== Chromium Look ======================

Bejeweled - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm
ButtonBeats DubCube - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\bdijiampoihanablcndnakhfbgfciogm
Facebook Customizer (by Adblock Plus) - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\deoeenbkoccjaefmmhpmlegngdjohdcm
Bookmark Manager - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik
ButtonBass Dubstep Balls - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmjadonkmcblbkocpaaefjbceiijfdg
90`s Games - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\illbbfoihflomkbpcaaakhijinbnejom
Burton Snowboards - Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndfadpmchcfmnidepggefbcjgelboimi

==== Chromium Startpages ======================

C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "https://www.google.bg/",
"startup_urls": [ "http://google.com/" ]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.bg/"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.google.bg/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{7F0025BC-FCC7-45BF-96E8-237F10E3BC6A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
{7F0025BC-FCC7-45BF-96E8-237F10E3BC6A} Google  Url="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\37C4AD4FF62083D4C8B6580F91E3B465 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{10B7EA7C-5705-682D-9AB2-920C82A471F4} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{171C1CDA-0BC9-452E-BD33-0056FBF5EE22} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2E9D70F7-917F-6F03-87EC-412470BAB8CB} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{6E258C4D-B160-0470-056D-8D20EBE5BEA2} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{990D7BD0-003D-12C8-84CE-841678BD0B7E} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C67F8A02-798F-ED45-0244-F1A20E4FF10B} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F4DA4C73-026F-4D38-8C6B-85F0193E4B56} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\37C4AD4FF62083D4C8B6580F91E3B465 deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTibMounterMonitor deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyCuteBuddy deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smart File Advisor deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe deleted successfully

==== Empty IE Cache ======================

C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MEQJZR7 will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MK70HXO will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ03IEMF will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\STDXCZ96 will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MEQJZR7 will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MK70HXO will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ03IEMF will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\STDXCZ96 will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Mozilla\Firefox\Profiles\sbvuyqhe.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Metody Metodiev\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=1696 folders=188 516037416 bytes)

==== Empty Temp Folders ======================

C:\Users\Administrator\AppData\Local\temp emptied successfully
C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Metody Metodiev\AppData\Local\temp will be emptied at reboot
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\METODY~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Program Files\Perfect Uninstaller"  not found
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MEQJZR7" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MK70HXO" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ03IEMF" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\STDXCZ96" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3MEQJZR7" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6MK70HXO" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ03IEMF" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\STDXCZ96" not deleted

==== EOF on 20.04.2015 at 16:12:58.81 ======================

 

 

 

~ ZHPCleaner v2015.4.19.175 by Nicolas Coolman (20/04/2015)
~ Run by Metody Metodiev (Administrator)  (20/04/2015 16:24:48)
~ Forum : http://forum.nicolascoolman.fr
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Scan
~ Report : C:\Users\Metody Metodiev\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Metody Metodiev\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
~ Windows 7, 32-bit Service Pack 1 (Build 7601)

---\\  Services (0)
~ No malicious items found.

---\\  Browser internet (2)
FOUND Proxy: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyHttp1.1 ( 1 )
FOUND Proxy: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyHttp1.1 ( 1 )

---\\  Hosts file (1)
~ The hosts file is legitimate (1)

---\\  Scheduled automatic tasks. (0)
~ No malicious items found.

---\\  Explorer ( File, Folder) (4)
FOUND folder: C:\Program Files\Enigma Software Group\SpyHunter (PUP.EnigmaSoftware)
FOUND folder: C:\Program Files\Enigma Software Group (PUP.EnigmaSoftware)

---\\  Registry ( Key, Value, Data) (3)
FOUND data: HKCR\AutoCADScriptFile\Shell\Open\Command\\Default [bad : [scr] "C:\Windows\system32\NOTEPAD.EXE" "%1"]  (Broken.OpenCommand)
FOUND key: HKLM\SOFTWARE\Classes\Iminent.Companion.Buddy [] (Adware.IMBooster)
FOUND key: HKLM\SOFTWARE\EnigmaSoftwareGroup [] (PUP.EnigmaSoftware)

---\\ Result of repair
~ Any repair made
~ Browser not found (Opera Software)

---\\ Statistics
~ Items scanned : 72267
~ Items found : 9
~ Items repaired : 0

End of clean at 16:36:37
===================
ZHPCleaner--20042015-16_36_37.txt

 

 

 

 

 

Emsisoft Emergency Kit - Version 9.0
Last update: 20.04.2015 16:45:50
User account: Metody-PD\Metody Metodiev

Scan settings:

Scan type: Full Scan
Objects: Rootkits, Memory, Traces, C:\, D:\, E:\, F:\, G:\, K:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start: 20.04.2015 16:46:23
C:\Users\Metody Metodiev\AppData\Local\SlimWare Utilities Inc\DriverUpdate  detected: Application.InstallDrive (A)
Value: HKEY_USERS\S-1-5-21-631084387-3129735815-1494553587-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR  detected: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS  detected: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-631084387-3129735815-1494553587-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS  detected: Setting.DisableRegistryTools (A)
Key: HKEY_USERS\S-1-5-21-631084387-3129735815-1494553587-1000\SOFTWARE\SLIMWARE UTILITIES INC\DRIVERUPDATE  detected: Application.InstallDrive (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\SLIMWARE UTILITIES INC\DRIVERUPDATE  detected: Application.InstallDrive (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\SLIMWARE UTILITIES, INC.\DRIVERAPP  detected: Application.InstallDrive (A)
C:\Program Files\Software Companions\ViewCompanion Pro\viewcompanion.pro.7.10.0.645-patch.exe  detected: Gen:Trojan.Heur.FU.AuW@aaS9W2f (B)
C:\settings.ini  detected: Gen:Adware.MPlug.1 (B)
C:\Windows\rapidui.exe -> (Embedded EXE o)  detected: Gen:Variant.Kazy.337452 (B)
D:\TEMP INSTALL\ArchiCAD\bimx for archicad 16 crack.exe  detected: Adware.Agent.OGL (B)
D:\TEMP INSTALL\Backups\RinjaniSoft.EZ.Backup.Ultimate.v6.32.Incl.Keymaker.and.Patch-ROGUE\RinjaniSoft.EZ.Backup.Ultimate.v6.32.Incl.Keymaker.and.Patch-ROGUE\RinjaniSoft.EZ.Backup.Ultimate.v6.32.Incl.Keymaker.and.Patch-ROGUE\ROGUE\setup\ezbusetup6_32.exe -> (Embedded EXE o)  detected: Gen:Variant.Kazy.337452 (B)
D:\TEMP INSTALL\COREL\CDGSuite.X6.16.1.0.843.Portable\CDGSuite.X6.16.1.0.843.Portable\CorelDRAW Graphics Suite X6 16.1.0.843 Port\Keymaker-CORE\keygen.exe  detected: Application.Keygen.ET (B)
D:\TEMP INSTALL\COREL\CorelDRAW Technical Suite X6 SP1 32 Bit\Keygen\Keygen.exe  detected: Trojan.Generic.10024194 (B)
D:\TEMP INSTALL\Focus Photoeditor 6.5.2.0.rar -> Lz0\keymaker.exe  detected: Trojan.Generic.7348921 (B)
D:\TEMP INSTALL\Garmin\egqy8.Driver.Navigator.3.4.8.14348..Portable.rar.exe  detected: Gen:Variant.Application.Strictor.55164 (B)
D:\TEMP INSTALL\Photo Editors\Focus Photoeditor 6.5.2.0\Lz0\keymaker.exe  detected: Trojan.Generic.7348921 (B)
K:\chitanka.info.mobi.name-2014.01-cumulative\FNT.exe  detected: Gen:Trojan.Heur.AutoIT.1 (B)

Scanned 359531
Found 18

Scan end: 20.04.2015 19:03:49
Scan time: 2:17:26

 

 

 

 

 Results of screen317's Security Check version 1.00 
 Windows 7 Service Pack 1 x86 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
 Windows Firewall Disabled! 
Microsoft Security Essentials  
  (On Access scanning disabled!)
 Error obtaining update status for antivirus! 
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 CCleaner    
 Java 8 Update 31 
 Java 8 Update 40 
 Adobe Flash Player  17.0.0.169 
 Adobe Reader XI 
 Mozilla Firefox (37.0.1)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 Spybot Teatimer.exe is disabled!
 Malwarebytes Anti-Malware mbamscheduler.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 8%
````````````````````End of Log``````````````````````
 

 Това е всичко.

Лека вечер!

Привет!

 

 

СТЪПКА 1

 

 

  • Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
  • Кликнете върху Ashampoo_Snap_20140819_13h09m50s_001__zp за да се съгласите с лицензионното споразумение.
  • Изберете бутона slm23Pe.png
  • Браузърите ще бъдат затворени автоматично.
  • Ще се отвори лог файл след прикючването на проверката.
  • Публикувайте лог файла в следващия си коментар.

 

 

СТЪПКА 2

 

 

Деинсталирайте следните стари програми от Control Panel-a:

 

Java 8 Update 31
Java 8 Update 40

 

Изтеглете и инсталирайте следната актуализация:

 

software.gif Изтегли: Java 8 Update 45

 

 

Ето и няколко финални препоръки:

 

1. Стартирайте защитата в реално време на антивирусната си програма, защото в момента е спряна. Вече след като приключихме с почистването можете да я включите отново.

 

2. Проверете за стари приложения с помощта на PatchMyPC или с програмата Secunia Personal Software Inspector.

 

3. Инсталирайте Unchecky за да се предпазите от адуер по време на инсталацията на даден софтуер.

 

4. За да почистим използваните от нас инструменти направете следното:

 

Изтеглете OTC.exe и го стартирайте. Натиснете бутона CleanUp!.
Рестартирайте компютъра, ако ви попита!

 

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

 

Ако има папки, които не са се изтрили след гореспоменатите процедури пишете и ще ги премахнем ръчно.

 

5. За защита от криптовирусите, освен обновяване на ОС и антивирусната програма е добре да имунизирате системата си с CryptoPrevent и профила Maximum Protection: (Не използвайте последната опция, защото още е бъгава и не работи коректно):

 

mtBkCIZ.jpg

 

Можете да погледнете и новата програма CryptoMonitor (но инструмента още се разработва и е доста бъгав).

 

Не забравяйте да изключите и Autorun в Windows, защото криптовирусите могат да се настанят и там и да заразят Windows през USB базираните устройства при вкарването им в компютъра или да заразят информацията на външните дискове при свързването им с инфектирана система. Microsoft са създали автоматичен инструмент за целта => MSFixIt.

 

Има и други програми, но са главно за напреднали потребители и няма да ги споменавам повече, защото един потребител вече се оплете с тяхното използване...

Добра идея е и да забраните скриптовете, ако не използвате такива с помощта на инструмента - Noscript.exe. Стартирайте го и изберете Disable. Ако ви потрябва да стартирате някога (js или vbs файлове, просто стартирайте инструмента и го направете на Enable).

 

6. Добра идея е да инсталирате Malwarebytes Anti-Exploit за да си осигурите спокойствие при сърфиране.

 

7. За подобряване на производителността (ако системата ви се вижда мудна) вижте следните няколко теми:

 

Оптимизиране на Windows с цел по-добра производителност

Ръководство за поддръжка на Windows (XP, Vista и 7) [Revision 2.0]

Какво да направя, ако компютърът ми работи бавно

Профилактика на компютъра,как?

 

8. Проверете системата си актуални драйвери от сайтовете на производителите на компонентите ако ви се занимава (не използвайте програми за автоматично обновяване на драйверите за да си спестите главоболията после) и направете пълна проверка за гадини с наличната ви антивирусна програма за всеки случай.

 

Добре е обаче да не използвате програми за оптимизиране и да деинсталирате следните програми от Control Panel-a:

 

Perfect Uninstaller v6.3.3.9 (има по-добри и безплатни алтернативи в лицето на GeekUninstaller и Revo Uninstaller)

Spybot - Search & Destroy (вече е тежка и неефективна)

DriverUpdate (не я виждам в инсталираните програми, но я има в Task Scheduler-a).

SlimCleaner Plus (не я виждам в инсталираните програми, но я има в Task Scheduler-a).

 

9. Винаги правете бекъп на важните си документи на външни носители и за не толкова ценните неща на cloud услуги. Научете се да не инсталирате програми от съмнителни източници и да не изключвате System Restore. При вас в момента е включен, което е добре. Виждам, че имате и програма за създаване на огледален образ в лицето на True Image WD Edition. Това е добре. Възстановяването на такъв образ при нужда в пъти по-лесен и бърз начин за връщане на работещото състояние на системата от преинсталация или опит за ръчно премахване на даден проблем.

 

Поздрави и усмихната седмица! Ще маркирам случая като РЕШЕН! :bye1:

  • Автор

Здравейте,

Направих всичко точка по точка, но логът на  ZHPCleaner изчезна при почистването.

Когато отворих Task Sheduler-a, обаче, се появи съобщение за няколко процеса с номера, които вече не съществуват. Може би са остатъци от деинсталирани програми. Да ги премахна ли? Тези свързани със Spybot - Search & Destroy, DriverUpdate и SlimCleaner Plus, (които деинсталирах) ги премахнах. Освен това има много процеси с Google Update ......... Те необходими ли са всичките?

 

 

post-344460-0-34483400-1429689647_thumb.

Нормално е лога да изчезне след стартирането на Delfix и OTC. Те почистват всички остатъци от използваните от нас програми.

Колкото до планираните задачи, можете да ги изтриете само ако наистина сте сигурни, че са остатъци от деинсталираните програми. Вие като цяло имате доста планирани задачи и част от тях са добавени ръчно и реших, че вие сте си ги добавили и затова не съм ги закачал. Колкото до Google, не ползвам Chrome и не знам как ще се отрази спирането на задачите. Ако ги спрете или изтриете не знам дали после ще се отрази по някакъв начин на работат ана браузъра и после може да се наложи да го преинсталирате. Но ако пък смятате, че след чиста инсталация на браузъра задачите ще са по-малко (не е изключено и да е така) може да опитате. Няма гаранция обаче, че след 10-тина актуализации на Chrome-a те пак няма да набъбнат като бройка.

 

Поздрави!

  • Автор

Ми той Google Hrom-a е деинсталиран. Махнах го в самото начало, защото в него се появи Web Companion. Нищо ръчно не съм исталирал в Sheduler-a. Не съм толкова навътре в нещата. Аз също не ползвам Google Hrom, но го инсталирах, защото другите браузъри ми правеха проблем с подписване с електронен подпис.

Редактирано от Методиев (преглед на промените)

Щом не ползвате Chrome, тогава деинсталирайте и Google Update Helper от Control Panel-a.

 

Колкото до планираните задачи предполагам, че pcalua.exe базираните са безопасни за премахване.

 

Изтеглете edit-text.giffixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

Пишете как са нещата след това като отворите Task Scheduler-a.

 

 

Поздрави!

  • Автор

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 20-04-2015
Ran by Metody Metodiev at 2015-04-22 14:35:50 Run:1
Running from C:\Users\Metody Metodiev\Desktop
Loaded Profiles: Metody Metodiev (Available profiles: Metody Metodiev)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
CreateRestorePoint:
CloseProcesses:
Task: {038B8823-1EF6-4BCB-9F14-557AAA5AF0DA} - System32\Tasks\{9527B56C-F332-43F5-90D8-2284FE70A882} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\sp34743.exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {0A0977EA-3574-4D25-94A5-74910C7C1AF7} - System32\Tasks\{2D079436-1EA1-4BC2-AD66-8B2F5441B598} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\HECI_allOS_2.1.22.1033_PV.exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {136FE5D0-48D0-490F-82C5-ED2513CF7ADC} - System32\Tasks\GoogleUpdateTaskMachineCore1cf4b34204bee6e => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {155CEC5E-B5AD-4DDF-A505-5A8AFC9BB498} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe [2014-04-25] (Safer-Networking Ltd.)
Task: {1C600721-DAF2-49E8-B57E-E2E58881B958} - System32\Tasks\GoogleUpdateTaskMachineCore1cf8eb3a352d594 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {1F8EBCF5-1E12-4266-A02C-27D08E780855} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe [2014-04-25] (Safer-Networking Ltd.)
Task: {2979F757-9F44-4297-B5DA-AB3A208BF76A} - System32\Tasks\{CE3EEAC4-1346-452F-8C5E-FC71B72EAA5F} => pcalua.exe -a "D:\TEMP INSTALL\startuplite-setup-1.07.exe" -d "D:\TEMP INSTALL"
Task: {31530DCB-A130-42F9-A7F4-80B79A703BC0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {38B3BED8-081B-49A1-A1FC-4AC27031EAEE} - System32\Tasks\{5A02667A-1410-44F4-9219-1935737EFBF4} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\WIBUKEY32 (1).exe" -d "C:\Users\Metody Metodiev\Desktop"
Task: {3BE269DA-6E5E-4EA5-A1BF-436466133448} - System32\Tasks\{32EA7335-8385-4126-A77A-7107281C6CDA} => pcalua.exe -a "C:\Users\Metody Metodiev\Desktop\CadIS6_Demo_v75.6.EXE" -d "C:\Users\Metody Metodiev\Desktop"
Task: {6CC52BCC-06CD-41E3-8828-C20BA2AA147F} - System32\Tasks\DriverUpdate Startup => C:\Program Files\DriverUpdate\DriverUpdate.exe
Task: {73282ECA-B626-4750-A9DA-C11A0E38EA54} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe [2014-04-25] (Safer-Networking Ltd.)
Task: {7B292255-76D7-4F5D-989F-D963886D9DD4} - System32\Tasks\{F3A9C798-52AD-429B-BC48-5BA0D6C6E934} => pcalua.exe -a "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" -c /uninstall ENTERPRISE /dll OSETUP.DLL
Task: {7E4554A8-6419-4E70-BC23-D2BD4D247D10} - System32\Tasks\{E572D18E-EB25-4E0C-B85D-464E0206E2E6} => pcalua.exe -a H:\WIBU\WIBU32\WIBUKEY32.exe -d H:\WIBU\WIBU32
Task: {84DBB741-FE33-4D73-B0A6-411E3140D707} - System32\Tasks\{5E8204D2-8533-47BC-AADA-304DCF83D733} => pcalua.exe -a "C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZXZDB0VT\sp34743.exe" -d "C:\Users\Metody Metodiev\Desktop"
Task: {86382FD8-5410-4A6E-92D0-CA127CE65DD9} - System32\Tasks\{65DF9578-8579-46F0-9952-FD7CA27F7347} => pcalua.exe -a "C:\Program Files\SUPERAntiSpyware\Uninstall.exe"
Task: {8B7D66DD-54B8-4E23-B652-280038185531} - System32\Tasks\DriverUpdate Scan => C:\Program Files\DriverUpdate\DriverUpdate.exe
Task: {8F3D0124-73B5-40A5-83B1-C4EAC92B2780} - System32\Tasks\{E6961CF2-4230-4FC7-BDFD-00E1C1E7DC5F} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\0001-32bit_Win7_Win8_Win81_R275 (1).exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {9DD41951-C876-40A0-BFAE-8BE33D2A0718} - System32\Tasks\{C8787CC2-FC2D-4F30-B0A0-7B62EEBA1D89} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\sp33972.exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {A659D87C-E376-4F94-AFDE-E0853B5B23B4} - System32\Tasks\{300D5C5E-5CF3-491B-9BDE-D90E857463D8} => pcalua.exe -a C:\Users\METODY~1\AppData\Local\Temp\$PowerISO$\SETUP.EXE -d "D:\TEMP INSTALL\SQL Surver\SQL Server 2005 Enterprise Edition DVD"
Task: {A66A32C9-D975-4D23-A53B-1053FED7D224} - System32\Tasks\{32062233-1B62-43E9-B536-4E092976A9E1} => pcalua.exe -a "D:\TEMP INSTALL\jxpiinstall.exe" -d "D:\TEMP INSTALL"
Task: {A9E56675-777B-4332-B546-586CD9F1D728} - System32\Tasks\{5D6348D3-C206-48A7-8E76-DD4522E33765} => Firefox.exe http://ui.skype.com/ui/0/5.5.0.117/bg/abandoninstall?page=tsPlugin&amp;installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:notoffered;alreadyoffered
Task: {AF47B698-55E5-44BE-8BE9-F8643989074E} - System32\Tasks\{30404255-711A-4126-B9C7-7A61029081F3} => pcalua.exe -a "D:\TEMP INSTALL\COREL\CorelDrawGraphicsSuiteX3\Corel\CorelDRAW Graphics Suite X3 Setup Files\CGS13\Setup.exe" -d "D:\TEMP INSTALL\COREL\CorelDrawGraphicsSuiteX3\Corel\CorelDRAW Graphics Suite X3 Setup Files\CGS13"
Task: {AF838D55-F929-41A4-86A8-95C024D901A0} - System32\Tasks\GoogleUpdateTaskMachineCore1d000d9b4ae45b8 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {B1F08B68-328D-4130-B9C5-8F6065B21BFD} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - Metody Metodiev) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
Task: {BA5745BE-9A65-434D-8EFB-A49C037B554D} - System32\Tasks\{D85BDFC0-7939-49FA-AB38-FEDEED693DC6} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\FixSmashInstaller.exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {BB6DF598-B6DE-4171-81A1-2663C4B6F055} - System32\Tasks\{CEAEBBB5-70C6-4835-8401-574C0A64D80C} => pcalua.exe -a "C:\Users\Metody Metodiev\Desktop\AC9-2219.exe" -d "C:\Users\Metody Metodiev\Desktop"
Task: {C32028DC-7381-482D-9540-6B6B8C71AB55} - System32\Tasks\GoogleUpdateTaskMachineCore1cf2d2b18231441 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {C797F907-F2A3-439B-BD3E-E37FC74D63E7} - System32\Tasks\{C96C37D0-2834-4BB6-8AFB-1DCEFBB48ECD} => pcalua.exe -a "D:\TEMP INSTALL\Garmin\Map Greece\Auto_Drive_Hellas_v2.30T_en.exe" -d "D:\TEMP INSTALL\Garmin\Map Greece"
Task: {CB456166-C1A8-46CF-8C96-7BE579E94614} - System32\Tasks\{BE090371-DAE1-4936-B23C-78EC80B5D621} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\vcredist_x86.exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {CC844BC0-8E8B-4083-9BE3-0A11CF0B5AA9} - System32\Tasks\{53984B8B-EB8F-4177-94B7-7698EE18CBD4} => pcalua.exe -a "C:\Users\Metody Metodiev\Desktop\startuplite-setup-1.07.exe" -d "C:\Users\Metody Metodiev\Desktop"
Task: {D090881E-EE50-47C2-8DAB-BFD9911DA154} - System32\Tasks\GoogleUpdateTaskMachineCore1d045da563b00d1 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {D6F3BB4B-0E2F-4E2B-B463-B71429B2214E} - System32\Tasks\{7F75B9AD-A3DE-409F-B03F-83CC0E896897} => pcalua.exe -a H:\Setup.exe -d H:\
Task: {D83D4E0B-E207-41CA-8B98-BA89F37C47B5} - System32\Tasks\GoogleUpdateTaskMachineCore1cf6b402b696ce7 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {DAC5FB27-38C0-4292-9271-90F317DFA242} - System32\Tasks\{F607DA96-728A-4E7B-AF5B-319C76BD860F} => pcalua.exe -a "D:\TEMP INSTALL\Microsoft Office 2003\microsoft office 2003 setup.exe" -d "D:\TEMP INSTALL\Microsoft Office 2003"
Task: {DEE12CDD-4CFA-4607-A152-E39ED675D057} - System32\Tasks\SlimDrivers Startup => C:\Program Files\SlimDrivers\SlimDrivers.exe
Task: {DF13154A-B880-4950-A1D7-874A05E942EF} - System32\Tasks\{E0992562-AFD7-4CCA-876C-8839351390A2} => pcalua.exe -a H:\Setup.exe -d H:\
Task: {DF9E2A76-5320-4507-8256-BA6EDF9C1959} - System32\Tasks\{A642BC9D-8ABE-4972-B285-E159FB708B74} => pcalua.exe -a "H:\ArchiCAD 9\Setup.exe" -d "H:\ArchiCAD 9"
Task: {DFF4B556-4E4B-4B1C-9D2E-54856D17DF8C} - System32\Tasks\{C30584C2-DF02-4AFF-B9AA-1E617DDE9152} => pcalua.exe -a "D:\TEMP INSTALL\Auto CAD\Autocad.2007.Crack-included\Autocad.2007.Crack-included\Autodesk AutoCAD 2007\Setup.exe" -d "D:\TEMP INSTALL\Auto CAD\Autocad.2007.Crack-included\Autocad.2007.Crack-included\Autodesk AutoCAD 2007"
Task: {E2B99859-9111-4602-BBF6-F9E164508130} - System32\Tasks\{05B54E22-C9BF-4199-BAB5-D5A9D3C16B42} => pcalua.exe -a "C:\Users\Metody Metodiev\Downloads\0001-32bit_Win7_Win8_Win81_R275.exe" -d "C:\Users\Metody Metodiev\Downloads"
Task: {E5304991-FD14-4190-864E-FBF8824AE74C} - System32\Tasks\{BF23B9D7-53CF-440C-B183-E553A016ACA9} => pcalua.exe -a C:\Windows\unvise32qt.exe -d C:\Windows -c C:\Windows\system32\QUICKT~1\UNINST~1.LOG
Task: {E66D8115-2470-411B-BBA5-5AACD0433B96} - System32\Tasks\{B304719A-F3C2-4F13-8F4F-872A83B3A54B} => pcalua.exe -a "D:\TEMP INSTALL\Photoshop\Adobe Photoshop 7.0 [Mughal]\Setup.exe" -d "D:\TEMP INSTALL\Photoshop\Adobe Photoshop 7.0 [Mughal]"
Task: {EEBA0E59-BCA6-4EC5-BD45-CBDD01FBD3E0} - System32\Tasks\{59C6B4C3-D63B-4241-82DD-F0E20DDAFDD3} => pcalua.exe -a "C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XXGEI8ZV\startuplite-setup-1.07.exe" -d "C:\Users\Metody Metodiev\Desktop"
Task: {F5088CDC-90EE-49E5-83BF-3F8B63AF2AE0} - System32\Tasks\GoogleUpdateTaskMachineCore1cecbd59d8f097c => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {F7529803-C195-4093-87C7-F19B32BA1AAA} - System32\Tasks\{32CF6068-61E1-45C8-A395-10C0F910DF5A} => pcalua.exe -a "C:\Users\Metody Metodiev\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KHNI6IE2\CommunicatorPlugin_301.exe" -d "C:\Users\Metody Metodiev\Desktop"
Task: {FD3E4E0A-2790-427B-9758-07385A11B0AE} - System32\Tasks\GoogleUpdateTaskMachineCore1cef4babb8de539 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8eb3a352d594.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfed342a9a68e7.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d000d9b4ae45b8.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d045da563b00d1.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Metody Metodiev).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
end
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{038B8823-1EF6-4BCB-9F14-557AAA5AF0DA}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{038B8823-1EF6-4BCB-9F14-557AAA5AF0DA}" => Key Deleted successfully.
C:\Windows\System32\Tasks\{9527B56C-F332-43F5-90D8-2284FE70A882} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9527B56C-F332-43F5-90D8-2284FE70A882}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0A0977EA-3574-4D25-94A5-74910C7C1AF7}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A0977EA-3574-4D25-94A5-74910C7C1AF7}" => Key Deleted successfully.
C:\Windows\System32\Tasks\{2D079436-1EA1-4BC2-AD66-8B2F5441B598} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{2D079436-1EA1-4BC2-AD66-8B2F5441B598}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{136FE5D0-48D0-490F-82C5-ED2513CF7ADC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{136FE5D0-48D0-490F-82C5-ED2513CF7ADC}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cf4b34204bee6e => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1cf4b34204bee6e" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{155CEC5E-B5AD-4DDF-A505-5A8AFC9BB498} => Key not found.
C:\Windows\System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Scan the system => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1C600721-DAF2-49E8-B57E-E2E58881B958}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1C600721-DAF2-49E8-B57E-E2E58881B958}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cf8eb3a352d594 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1cf8eb3a352d594" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1F8EBCF5-1E12-4266-A02C-27D08E780855} => Key not found.
C:\Windows\System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Check for updates => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2979F757-9F44-4297-B5DA-AB3A208BF76A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2979F757-9F44-4297-B5DA-AB3A208BF76A}" => Key deleted successfully.
C:\Windows\System32\Tasks\{CE3EEAC4-1346-452F-8C5E-FC71B72EAA5F} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{CE3EEAC4-1346-452F-8C5E-FC71B72EAA5F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{31530DCB-A130-42F9-A7F4-80B79A703BC0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{31530DCB-A130-42F9-A7F4-80B79A703BC0}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{38B3BED8-081B-49A1-A1FC-4AC27031EAEE}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{38B3BED8-081B-49A1-A1FC-4AC27031EAEE}" => Key Deleted successfully.
C:\Windows\System32\Tasks\{5A02667A-1410-44F4-9219-1935737EFBF4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5A02667A-1410-44F4-9219-1935737EFBF4}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3BE269DA-6E5E-4EA5-A1BF-436466133448}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3BE269DA-6E5E-4EA5-A1BF-436466133448}" => Key deleted successfully.
C:\Windows\System32\Tasks\{32EA7335-8385-4126-A77A-7107281C6CDA} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{32EA7335-8385-4126-A77A-7107281C6CDA}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6CC52BCC-06CD-41E3-8828-C20BA2AA147F} => Key not found.
C:\Windows\System32\Tasks\DriverUpdate Startup not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverUpdate Startup => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73282ECA-B626-4750-A9DA-C11A0E38EA54} => Key not found.
C:\Windows\System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7B292255-76D7-4F5D-989F-D963886D9DD4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7B292255-76D7-4F5D-989F-D963886D9DD4}" => Key deleted successfully.
C:\Windows\System32\Tasks\{F3A9C798-52AD-429B-BC48-5BA0D6C6E934} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F3A9C798-52AD-429B-BC48-5BA0D6C6E934}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7E4554A8-6419-4E70-BC23-D2BD4D247D10}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7E4554A8-6419-4E70-BC23-D2BD4D247D10}" => Key Deleted successfully.
C:\Windows\System32\Tasks\{E572D18E-EB25-4E0C-B85D-464E0206E2E6} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E572D18E-EB25-4E0C-B85D-464E0206E2E6}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{84DBB741-FE33-4D73-B0A6-411E3140D707}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{84DBB741-FE33-4D73-B0A6-411E3140D707}" => Key deleted successfully.
C:\Windows\System32\Tasks\{5E8204D2-8533-47BC-AADA-304DCF83D733} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5E8204D2-8533-47BC-AADA-304DCF83D733}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{86382FD8-5410-4A6E-92D0-CA127CE65DD9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{86382FD8-5410-4A6E-92D0-CA127CE65DD9}" => Key deleted successfully.
C:\Windows\System32\Tasks\{65DF9578-8579-46F0-9952-FD7CA27F7347} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{65DF9578-8579-46F0-9952-FD7CA27F7347}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8B7D66DD-54B8-4E23-B652-280038185531}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8B7D66DD-54B8-4E23-B652-280038185531}" => Key deleted successfully.
C:\Windows\System32\Tasks\DriverUpdate Scan not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverUpdate Scan" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8F3D0124-73B5-40A5-83B1-C4EAC92B2780}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8F3D0124-73B5-40A5-83B1-C4EAC92B2780}" => Key deleted successfully.
C:\Windows\System32\Tasks\{E6961CF2-4230-4FC7-BDFD-00E1C1E7DC5F} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E6961CF2-4230-4FC7-BDFD-00E1C1E7DC5F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9DD41951-C876-40A0-BFAE-8BE33D2A0718}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9DD41951-C876-40A0-BFAE-8BE33D2A0718}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C8787CC2-FC2D-4F30-B0A0-7B62EEBA1D89} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C8787CC2-FC2D-4F30-B0A0-7B62EEBA1D89}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A659D87C-E376-4F94-AFDE-E0853B5B23B4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A659D87C-E376-4F94-AFDE-E0853B5B23B4}" => Key deleted successfully.
C:\Windows\System32\Tasks\{300D5C5E-5CF3-491B-9BDE-D90E857463D8} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{300D5C5E-5CF3-491B-9BDE-D90E857463D8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A66A32C9-D975-4D23-A53B-1053FED7D224}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A66A32C9-D975-4D23-A53B-1053FED7D224}" => Key deleted successfully.
C:\Windows\System32\Tasks\{32062233-1B62-43E9-B536-4E092976A9E1} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{32062233-1B62-43E9-B536-4E092976A9E1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A9E56675-777B-4332-B546-586CD9F1D728}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A9E56675-777B-4332-B546-586CD9F1D728}" => Key deleted successfully.
C:\Windows\System32\Tasks\{5D6348D3-C206-48A7-8E76-DD4522E33765} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5D6348D3-C206-48A7-8E76-DD4522E33765}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AF47B698-55E5-44BE-8BE9-F8643989074E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF47B698-55E5-44BE-8BE9-F8643989074E}" => Key deleted successfully.
C:\Windows\System32\Tasks\{30404255-711A-4126-B9C7-7A61029081F3} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{30404255-711A-4126-B9C7-7A61029081F3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AF838D55-F929-41A4-86A8-95C024D901A0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AF838D55-F929-41A4-86A8-95C024D901A0}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d000d9b4ae45b8 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1d000d9b4ae45b8" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B1F08B68-328D-4130-B9C5-8F6065B21BFD} => Key not found.
C:\Windows\System32\Tasks\SlimCleaner Plus (Scheduled Scan - Metody Metodiev) not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SlimCleaner Plus (Scheduled Scan - Metody Metodiev) => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BA5745BE-9A65-434D-8EFB-A49C037B554D}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA5745BE-9A65-434D-8EFB-A49C037B554D}" => Key Deleted successfully.
C:\Windows\System32\Tasks\{D85BDFC0-7939-49FA-AB38-FEDEED693DC6} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D85BDFC0-7939-49FA-AB38-FEDEED693DC6}" => Key Deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BB6DF598-B6DE-4171-81A1-2663C4B6F055}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BB6DF598-B6DE-4171-81A1-2663C4B6F055}" => Key deleted successfully.
C:\Windows\System32\Tasks\{CEAEBBB5-70C6-4835-8401-574C0A64D80C} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{CEAEBBB5-70C6-4835-8401-574C0A64D80C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C32028DC-7381-482D-9540-6B6B8C71AB55}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C32028DC-7381-482D-9540-6B6B8C71AB55}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cf2d2b18231441 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1cf2d2b18231441" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C797F907-F2A3-439B-BD3E-E37FC74D63E7}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C797F907-F2A3-439B-BD3E-E37FC74D63E7}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C96C37D0-2834-4BB6-8AFB-1DCEFBB48ECD} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C96C37D0-2834-4BB6-8AFB-1DCEFBB48ECD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CB456166-C1A8-46CF-8C96-7BE579E94614}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CB456166-C1A8-46CF-8C96-7BE579E94614}" => Key deleted successfully.
C:\Windows\System32\Tasks\{BE090371-DAE1-4936-B23C-78EC80B5D621} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BE090371-DAE1-4936-B23C-78EC80B5D621}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CC844BC0-8E8B-4083-9BE3-0A11CF0B5AA9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC844BC0-8E8B-4083-9BE3-0A11CF0B5AA9}" => Key deleted successfully.
C:\Windows\System32\Tasks\{53984B8B-EB8F-4177-94B7-7698EE18CBD4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{53984B8B-EB8F-4177-94B7-7698EE18CBD4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D090881E-EE50-47C2-8DAB-BFD9911DA154}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D090881E-EE50-47C2-8DAB-BFD9911DA154}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d045da563b00d1 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1d045da563b00d1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D6F3BB4B-0E2F-4E2B-B463-B71429B2214E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D6F3BB4B-0E2F-4E2B-B463-B71429B2214E}" => Key deleted successfully.
C:\Windows\System32\Tasks\{7F75B9AD-A3DE-409F-B03F-83CC0E896897} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{7F75B9AD-A3DE-409F-B03F-83CC0E896897}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D83D4E0B-E207-41CA-8B98-BA89F37C47B5}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D83D4E0B-E207-41CA-8B98-BA89F37C47B5}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cf6b402b696ce7 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1cf6b402b696ce7" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DAC5FB27-38C0-4292-9271-90F317DFA242}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DAC5FB27-38C0-4292-9271-90F317DFA242}" => Key deleted successfully.
C:\Windows\System32\Tasks\{F607DA96-728A-4E7B-AF5B-319C76BD860F} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F607DA96-728A-4E7B-AF5B-319C76BD860F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DEE12CDD-4CFA-4607-A152-E39ED675D057}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DEE12CDD-4CFA-4607-A152-E39ED675D057}" => Key deleted successfully.
C:\Windows\System32\Tasks\SlimDrivers Startup not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SlimDrivers Startup" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DF13154A-B880-4950-A1D7-874A05E942EF}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF13154A-B880-4950-A1D7-874A05E942EF}" => Key deleted successfully.
C:\Windows\System32\Tasks\{E0992562-AFD7-4CCA-876C-8839351390A2} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E0992562-AFD7-4CCA-876C-8839351390A2}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DF9E2A76-5320-4507-8256-BA6EDF9C1959}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DF9E2A76-5320-4507-8256-BA6EDF9C1959}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A642BC9D-8ABE-4972-B285-E159FB708B74} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A642BC9D-8ABE-4972-B285-E159FB708B74}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DFF4B556-4E4B-4B1C-9D2E-54856D17DF8C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DFF4B556-4E4B-4B1C-9D2E-54856D17DF8C}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C30584C2-DF02-4AFF-B9AA-1E617DDE9152} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C30584C2-DF02-4AFF-B9AA-1E617DDE9152}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E2B99859-9111-4602-BBF6-F9E164508130}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E2B99859-9111-4602-BBF6-F9E164508130}" => Key deleted successfully.
C:\Windows\System32\Tasks\{05B54E22-C9BF-4199-BAB5-D5A9D3C16B42} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{05B54E22-C9BF-4199-BAB5-D5A9D3C16B42}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E5304991-FD14-4190-864E-FBF8824AE74C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E5304991-FD14-4190-864E-FBF8824AE74C}" => Key deleted successfully.
C:\Windows\System32\Tasks\{BF23B9D7-53CF-440C-B183-E553A016ACA9} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BF23B9D7-53CF-440C-B183-E553A016ACA9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E66D8115-2470-411B-BBA5-5AACD0433B96}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E66D8115-2470-411B-BBA5-5AACD0433B96}" => Key deleted successfully.
C:\Windows\System32\Tasks\{B304719A-F3C2-4F13-8F4F-872A83B3A54B} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B304719A-F3C2-4F13-8F4F-872A83B3A54B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EEBA0E59-BCA6-4EC5-BD45-CBDD01FBD3E0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EEBA0E59-BCA6-4EC5-BD45-CBDD01FBD3E0}" => Key deleted successfully.
C:\Windows\System32\Tasks\{59C6B4C3-D63B-4241-82DD-F0E20DDAFDD3} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{59C6B4C3-D63B-4241-82DD-F0E20DDAFDD3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F5088CDC-90EE-49E5-83BF-3F8B63AF2AE0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F5088CDC-90EE-49E5-83BF-3F8B63AF2AE0}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cecbd59d8f097c => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1cecbd59d8f097c" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F7529803-C195-4093-87C7-F19B32BA1AAA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F7529803-C195-4093-87C7-F19B32BA1AAA}" => Key deleted successfully.
C:\Windows\System32\Tasks\{32CF6068-61E1-45C8-A395-10C0F910DF5A} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{32CF6068-61E1-45C8-A395-10C0F910DF5A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FD3E4E0A-2790-427B-9758-07385A11B0AE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD3E4E0A-2790-427B-9758-07385A11B0AE}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cef4babb8de539 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore1cef4babb8de539" => Key deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf8eb3a352d594.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfed342a9a68e7.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d000d9b4ae45b8.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d045da563b00d1.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Metody Metodiev).job not found.

The system needed a reboot.

==== End of Fixlog 14:36:34 

 

B Sheduler-a имаше останали няколко процеса свързани с ACDSee, която вече не използвам. Ако съм схванал логиката - ненужни. Изтрих ги. Дано не съм сбъркал.

Ами аз нямаше как да знам, че вече не използвате ACDSee и затова я оставих. Направете направо нова проверка с FRST (като сложите отметка пред Addition.txt преди да натиснете бутона Scan) и публикувайте само Addition.txt в следващия си коментар. Ще видим има ли още планирани задачи, които не са почистени, но преди да ги включа за премахване ще е добре да кажете, кои от тях не използвате вече за да знам предварително.

 

Поздрави!

  • Автор

Здравейте,

В този лог, който публикувах, както и в Контрол панела фигурират няколко Microsoft Visual C++  от 2005 до 2012г, както и Microsoft Visual Studio Tools.

Доколкото разбрах от гугъл, това са инструменти за разработчици. Не знам нужни ли са на други програми, но тъй като програмирането не е моя стихия, те необходими ли са ми, или само заемат място на диска?

Поздрави!

 

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-04-2015
Ran by Metody Metodiev at 2015-04-23 11:54:38
Running from C:\Users\Metody Metodiev\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\uTorrent) (Version: 3.4.3.40097 - BitTorrent Inc.)
32 Bit HP CIO Components Installer (Version: 3.1.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
ACR38U PCSC Driver 1.1.6.1 (HKLM\...\{155796AE-16D0-45D2-8939-6AE3AD67147B}) (Version: 1.1.0 - Advanced Card Systems Ltd.)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
A-PDF Creator (HKLM\...\A-PDF Creator_is1) (Version:  - A-PDF Inc.)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArchiCAD 16 INT (HKLM\...\001FFF1FFF16FF00FF0701F01F02F000-R1) (Version: 16.0 - GRAPHISOFT)
ArchiCAD 9 INT (HKLM\...\001FFFFFFF09FF00FF0701F00F02F000-R1) (Version:  - )
AutoCAD 2007 - English (HKLM\...\{5783F2D7-5001-0409-0002-0060B0CE6BBA}) (Version: 17.0.54.110 - Autodesk)
Autodesk Content Service Language Pack (Version: 3.0.84.0 - Autodesk) Hidden
BOBS Web Plugin MSCAPI Sign (HKLM\...\{853072DB-D7E5-43F2-ACDD-92EE04E9E7E8}) (Version: 1.0.0.4 - BORICA - BANKSERVICE AD)
B-Trust Digital Signature version 7.3 (HKLM\...\B-Trust Digital Signature_is1) (Version: 7.3 - BORICA - BANKSERVICE PLC)
Bulgarian BDS (2000,XP,2003,Vista,7,2008) - Microinvest (HKLM\...\{67437C58-1E0A-40E0-915E-95DF37BB4196}) (Version: 1.0.3.40 - Microinvest Ltd.)
Bulgarian PHO (2000,XP,2003,Vista,7,2008) - Microinvest (HKLM\...\{B263EA04-647B-4F01-B528-936E87ABA8A6}) (Version: 1.0.3.40 - Microinvest Ltd.)
calibre (HKLM\...\{69402281-8050-417B-93D8-9C2DB46C9DDC}) (Version: 2.1.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.04 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel Graphics - Windows Shell Extension (HKLM\...\_{B92076C0-C5FE-4DB1-AA8D-855430CDF098}) (Version: 16.0.0.707 - Corel Corporation)
Corel Graphics - Windows Shell Extension (Version: 16.0.707 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X3 (HKLM\...\{63218538-4A69-497F-8455-904261B0E9E4}) (Version: 13.1 - Corel Corporation)
CPUID CPU-Z 1.72 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CryptoPrevent (HKLM\...\{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1) (Version:  - Foolish IT LLC)
Crystal Reports 2008 Runtime SP2 (HKLM\...\{C484CC8D-03CF-4022-89C4-DB4F02E8A15B}) (Version: 12.2.0.290 - Business Objects)
cv act sc/interface 5.0.0 - user edition (HKLM\...\{3533B9EB-BE15-4C5F-8726-0150B12CAA6A}) (Version: 5.0.0 - cv cryptovision gmbh)
doPDF 7.2 printer (HKLM\...\doPDF 7 printer_is1) (Version:  - Softland)
EN (Version: 13.0 - Corel Corporation) Hidden
EPSON Scan (HKLM\...\EPSON Scanner) (Version:  - )
EZBack-it-up 2.0.1 (HKLM\...\EZBack-it-up_is1) (Version: 2.0.1 - Rob Decker)
FastStone Soft (HKLM\...\FastStone Soft) (Version:  - )
FontNav (Version: 5.0 - Corel Corporation) Hidden
Garmin Communicator Plugin (HKLM\...\{71DBFBF2-F7EB-4268-8485-9471D83C4E66}) (Version: 4.2.0 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{ABA5E381-EC46-425C-86C5-5CD15BBFB4BF}) (Version: 2.3.1.0 - Garmin Ltd or its subsidiaries)
Google Earth Pro (HKLM\...\{5BAA8884-F661-464B-B5B2-5C6C632BFC21}) (Version: 7.1.4.1529 - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.05) (Version: 9.05 - Artifex Software Inc.)
GPL Ghostscript 8.71 (HKLM\...\GPL Ghostscript 8.71) (Version:  - )
imagePROGRAF Firmware Update Tool (HKLM\...\imagePROGRAF Firmware Update Tool) (Version: 24.00 - Canon Inc.)
imagePROGRAF Status Monitor (HKLM\...\imagePROGRAF Status Monitor) (Version: 25.51 - Canon Inc.)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel® Management Engine Interface (HKLM\...\HECI) (Version:  - )
Intel® Driver Update Utility (HKLM\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
iPF600 Printer Driver Extra Kit (HKLM\...\{44B56E9E-5B88-4E90-97BD-D95D35932D06}) (Version: 1.92.11 - )
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Logitech Unifying Software 2.10 (HKLM\...\Logitech Unifying) (Version: 2.10.37 - Logitech)
MagicDisc 2.7.106 (HKLM\...\MagicDisc 2.7.106) (Version:  - )
Malwarebytes Anti-Exploit version 1.06.1.1018 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.06.1.1018 - Malwarebytes)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microinvest Invoice Pro (HKLM\...\{7A4F9EB6-08CC-43F5-ADF3-F28CF317F632}) (Version: 1.02.022 - Microinvest)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft CAPICOM 2.1.0.2 SDK (HKLM\...\{2FF43F5D-5729-4E02-A548-310E30A5F29B}) (Version: 2.1.0.2 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM\...\{90A40409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Mozilla Firefox 37.0.2 (x86 en-US) (HKLM\...\Mozilla Firefox 37.0.2 (x86 en-US)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NirSoft IE PassView (HKLM\...\NirSoft IE PassView) (Version:  - )
OKI Color Swatch Utility (HKLM\...\{A344F95E-E51A-450C-8F84-C940BF61903E}) (Version: 2.1.10 - Okidata)
OKI Colour Correct Utility (HKLM\...\{5D729200-F340-4A74-A1E9-32387CDC63EF}) (Version: 2.16.0 - Okidata)
PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
SAP Crystal Reports runtime engine for .NET Framework 4 (32-bit) (HKLM\...\{083988D7-BDA9-4244-983B-409A634BBC09}) (Version: 13.0.1.220 - SAP)
SES Driver (HKLM\...\{0673654C-5296-453B-9798-B61CD7E03FEB}) (Version: 1.0.0 - Western Digital)
Skype™ 7.3 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Unchecky v0.3.7.2 (HKLM\...\Unchecky) (Version: 0.3.7.2 - RaMMicHaeL)
Unlocker 1.8.1 (HKLM\...\Unlocker) (Version: 1.8.1 - Cedrick Collomb)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
WibuKey Setup (WibuKey Remove) (HKLM\...\{00060000-0000-1004-8002-0000C06B5161}) (Version: Version 6.20 of 2013-Dec-18 (Build 1230) (Setup) - WIBU-SYSTEMS AG)
Winamp (HKLM\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
Windows Driver Package - ACS (ACSSCR) SmartCardReader  (06/15/2009 1.1.6.1) (HKLM\...\5B693A45377E76C1C6F833AC636C5D61522090CB) (Version: 06/15/2009 1.1.6.1 - ACS)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (HKLM\...\98157A226B40B173301B0F53C8E98C47805D5152) (Version: 04/19/2012 2.3.1.0 - Garmin)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{037FB476-15E0-4ED1-B11A-E420B750B1A8}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{2837E0FE-686B-4CB0-BE53-0EA097EAF71B}\InprocServer32 -> C:\Windows\Downloaded Program Files\isusweb.dll (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{28B7AA99-C0F9-4C47-995E-8A8D729603A1}\localserver32 -> C:\Program Files\AutoCAD 2007\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{5AFAFE48-7107-4FE5-B21A-86A4254541DD}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{5B7524C8-2446-40E9-9474-94A779DBA224}\InprocServer32 -> C:\Windows\Downloaded Program Files\isusweb.dll (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{621D3650-F1D3-414C-97F9-03A02B211261}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{623E415A-22EF-4DAA-A2FF-E68E77A673C9}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{7AABBB95-79BE-4C0F-8024-EB6AF271231C}\localserver32 -> C:\Program Files\AutoCAD 2007\acad.exe (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{885BB46A-3F1E-44C3-A01B-A7D9260CC98B}\InprocServer32 -> C:\Windows\Downloaded Program Files\dwusplay.dll (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{915C2CEB-216B-4B7C-89E4-9ED3512D58D9}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{92C5E738-7372-4CD6-BE57-15833624EBF3}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{9CAAD2EA-177B-4D07-871F-47255B5D30F3}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{B391A1DB-28C8-4506-A43C-5BD6051F16BA}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\AutoCAD 2007\acadficn.dll (Autodesk, Inc.)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{E34B5755-7736-5C26-BEDF-0DF43F3CF56D}\InprocServer32 -> C:\Users\Metody Metodiev\AppData\Roaming\BOBS\BOBS Web Plugin MSCAPI Sign\1.0.0.4\npbobsWinSigner.dll (BORICA - BANKSERVICE AD)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{E42CE23D-69F9-480A-A15F-BFF5E4D170C3}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{E50C953D-311A-481B-8F8D-C55E65AF7417}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{E9880553-B8A7-4960-A668-95C68BED571E}\InprocServer32 -> C:\Windows\Downloaded Program Files\isusweb.dll (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{E9A93328-79D4-4AED-A778-146E7191F8BC}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\ISDM.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{F1522EC1-F84F-4CE2-A38C-F9384B0DFD41}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (Macrovision Corporation)
CustomCLSID: HKU\S-1-5-21-631084387-3129735815-1494553587-1000_Classes\CLSID\{FFF2D28F-E4EE-44D9-8104-8E71556757F6}\localserver32 -> C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe (Macrovision Corporation)

==================== Restore Points  =========================

21-04-2015 11:30:34 Windows Update
21-04-2015 11:59:51 Windows Update
22-04-2015 13:35:43 Removed Google Update Helper
22-04-2015 14:35:55 Restore Point Created by FRST

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 05:04 - 2015-04-23 11:04 - 00001196 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com

There are 5 more lines.

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {010AFA20-AA87-4DE4-A7CC-513FC56B2335} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan
Task: {0DF902EC-6D30-423B-AC22-DA940DA458CC} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {1753772B-1375-4DC5-A0FD-337BA1809D0D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {3DF90076-16F8-4543-8647-B0F6983A1DD5} - System32\Tasks\{B940D502-A257-492F-BCEE-64C4FBAFAFEB} => C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\SQLServer2008R2\x86\LandingPage.exe
Task: {63499E8B-577E-4BF6-8F9E-16E92575DD85} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {6350D8D1-059F-4B47-9C21-CF351C84CD56} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {64D79F75-07B1-41BB-AC01-E9FEDD97ECFA} - System32\Tasks\EZ Backup Ultimate => C:\Program Files\Perception\EZ Backup Ultimate\ezbackupultimate.exe
Task: {808A1D4B-7EF9-4662-AB32-5F28E3AD2D56} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {8EB3DDA5-C284-4984-B92F-E2B336187FB0} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {96FDD0E9-DB0D-4AF3-A812-618628978A8B} - System32\Tasks\GoogleUpdateTaskMachineCore1cfed342a9a68e7 => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {C13153FD-1A06-4982-8E09-384EBDAA8DAC} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {D8D60A5C-8A5F-46AE-BD62-052AA69F288E} - System32\Tasks\{98A23201-029A-4C95-810B-C89E03B5CF7B} => C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\SQLServer2008R2\x86\LandingPage.exe
Task: {DFE6B8ED-271F-4D6C-9B17-39611D5D04A3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {E788F88B-899B-4FDF-8CF6-6DA947E6ABE2} - System32\Tasks\{BC9FE4FC-31DD-42E0-9013-A9A99FAF7214} => C:\Program Files\Skype\\Phone\Skype.exe [2015-03-25] (Skype Technologies S.A.)
Task: {FC5AE46C-D9D4-433B-B2E0-A92F8B0B0CBB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-03-13] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\EZ Backup Ultimate.job => C:\Program Files\Perception\EZ Backup Ultimate\ezbackupultimate.exe

==================== Loaded Modules (whitelisted) ==============

2011-12-31 12:52 - 2009-09-18 17:27 - 00503808 _____ () C:\Windows\System32\apdfpubprintmon.dll
2011-07-15 17:58 - 2006-04-19 03:15 - 00010240 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\cnwfdpa2.dll
2011-07-15 17:27 - 2008-11-06 11:13 - 00273408 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\hpcpp6de.DLL
2011-07-15 17:46 - 2012-08-22 14:03 - 00035328 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\OPLAPP3.dll
2006-03-03 11:38 - 2006-03-03 11:38 - 00008704 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2011-07-31 12:44 - 2010-01-23 14:45 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll
2015-03-13 16:54 - 2015-03-13 16:54 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1026.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\b-trust.org -> hxxps://www.b-trust.org
IE trusted site: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\efaktura.bg -> hxxps://efaktura.bg
IE trusted site: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\google.bg -> hxxps://www.google.bg
IE trusted site: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\karta.bg -> hxxp://karta.bg
IE trusted site: HKU\S-1-5-21-631084387-3129735815-1494553587-1000\...\microsoft.com -> hxxp://download.wind...e.microsoft.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-631084387-3129735815-1494553587-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Metody Metodiev\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 178.254.192.18 - 178.254.192.3

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AcrSch2Svc => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: Autodesk Licensing Service => 3
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: HomeGroupListener => 3
MSCONFIG\Services: HomeGroupProvider => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: TabletInputService => 3
MSCONFIG\Services: TapiSrv => 3
MSCONFIG\Services: UmRdpService => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk => C:\Windows\pss\AutoCAD Startup Accelerator.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^cv act sc interface RegisterTool.lnk => C:\Windows\pss\cv act sc interface RegisterTool.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^imagePROGRAF Status Monitor.lnk => C:\Windows\pss\imagePROGRAF Status Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Network Server.lnk => C:\Windows\pss\Network Server.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Metody Metodiev^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk => C:\Windows\pss\MagicDisc.lnk.Startup
MSCONFIG\startupreg: AdobeBridge => "C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe" -stealth
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Autodesk Sync => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: CnwiDeviceAgent => C:\Program Files\Canon\imagePROGRAFStatusMonitor\cnwida.exe
MSCONFIG\startupreg: MCW Startup => "C:\Program Files\Monitor Calibration Wizard\MCW.exe" /s
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SDTray => "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: UnlockerAssistant => C:\Program Files\Unlocker\UnlockerAssistant.exe
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-631084387-3129735815-1494553587-500 - Administrator - Disabled)
Guest (S-1-5-21-631084387-3129735815-1494553587-501 - Limited - Disabled)
Metody Metodiev (S-1-5-21-631084387-3129735815-1494553587-1000 - Administrator - Enabled) => C:\Users\Metody Metodiev

==================== Faulty Device Manager Devices =============

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (04/23/2015 11:05:34 AM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (04/22/2015 05:42:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program flashplayer17_ga_install.exe version 1.0.0.14 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 15fc

Start Time: 01d07d0a68998495

Termination Time: 10

Application Path: C:\Users\Metody Metodiev\Downloads\flashplayer17_ga_install.exe

Report Id:

Error: (04/22/2015 02:39:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: The index cannot be initialized.

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: The application cannot be initialized.

Context: Windows Application

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: The gatherer object cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
 Element not found.  (HRESULT : 0x80070490) (0x80070490)

Error: (04/22/2015 10:44:15 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: The plug-in in <Search.JetPropStore> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:15 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: The Windows Search Service cannot load the property store information.

Context: Windows Application, SystemIndex Catalog

Details:
 The content index database is corrupt.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (04/22/2015 10:44:15 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Услугата Windows Search спира поради проблем с индексирането, The catalog is corrupt.

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

System errors:
=============
Error: (04/23/2015 11:04:34 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата:
is3srv

Error: (04/23/2015 11:04:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга Internet Connection Sharing (ICS) зависи от услуга Remote Access Connection Manager, която не може да бъде стартирана поради следната грешка:
%%1068

Error: (04/23/2015 11:04:16 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга Remote Access Connection Manager зависи от услуга Telephony, която не може да бъде стартирана поради следната грешка:
%%1058

Error: (04/23/2015 11:04:07 AM) (Source: SCardSvr) (EventID: 602) (User: )
Description: The system cannot find the path specified.

Error: (04/22/2015 02:38:16 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Неуспешно зареждане на следния драйвер, който се активира с включване на компютъра или стартиране на системата:
is3srv

Error: (04/22/2015 02:38:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга Internet Connection Sharing (ICS) зависи от услуга Remote Access Connection Manager, която не може да бъде стартирана поради следната грешка:
%%1068

Error: (04/22/2015 02:38:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга Remote Access Connection Manager зависи от услуга Telephony, която не може да бъде стартирана поради следната грешка:
%%1058

Error: (04/22/2015 02:37:58 PM) (Source: SCardSvr) (EventID: 602) (User: )
Description: The system cannot find the path specified.

Error: (04/22/2015 02:37:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга Print Spooler не може да бъде стартирана поради следната грешка:
%%1069

Error: (04/22/2015 02:37:07 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Услуга Spooler не може да влезе като NT AUTHORITY\SYSTEM с текущо конфигурираната парола, поради следната грешка:
%%50

За да осигурите правилното конфигуриране на услугата, използвайте конзолната добавка за услуги в конзолата на Microsoft за управление (MMC).

Microsoft Office Sessions:
=========================
Error: (04/23/2015 11:05:34 AM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/22/2015 05:42:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: flashplayer17_ga_install.exe1.0.0.1415fc01d07d0a6899849510C:\Users\Metody Metodiev\Downloads\flashplayer17_ga_install.exe

Error: (04/22/2015 02:39:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description:
Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Context: Windows Application

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Context: Windows Application, SystemIndex Catalog

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (04/22/2015 10:44:17 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Context: Windows Application, SystemIndex Catalog

Details:
 Element not found.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (04/22/2015 10:44:15 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Context: Windows Application, SystemIndex Catalog

Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (04/22/2015 10:44:15 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Context: Windows Application, SystemIndex Catalog

Details:
 The content index database is corrupt.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (04/22/2015 10:44:15 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description:
Details:
 The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

==================== Memory info ===========================

Processor: Intel® Core2 CPU 6400 @ 2.13GHz
Percentage of memory in use: 31%
Total physical RAM: 3575.31 MB
Available physical RAM: 2437.76 MB
Total Pagefile: 7148.91 MB
Available Pagefile: 5684.09 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.98 MB

==================== Drives ================================

Drive c: (PROGRAM DRIVE) (Fixed) (Total:48.83 GB) (Free:6.96 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (CLIP'S DATES) (Fixed) (Total:39.06 GB) (Free:5.15 GB) NTFS
Drive e: (WORK DRIVE) (Fixed) (Total:97.8 GB) (Free:52.14 GB) NTFS
Drive f: (HP_Recovery) (Fixed) (Total:2.42 GB) (Free:0.74 GB) NTFS
Drive g: (BACKUPS RES) (Fixed) (Total:35.47 GB) (Free:9.89 GB) NTFS
Drive h: (TEMP PRINT 1) (CDROM) (Total:3.85 GB) (Free:0 GB) UDF
Drive k: (My Backups) (Fixed) (Total:298.06 GB) (Free:178.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: D42AD42A)
Partition 1: (Active) - (Size=48.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.8 GB) - (Type=OF Extended)
Partition 3: (Not Active) - (Size=2.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 74.5 GB) (Disk ID: 624D2F08)
Partition 1: (Not Active) - (Size=39.1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=35.5 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 00028ACA)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Редактирано от Методиев (преглед на промените)

Здравейте,

В този лог, който публикувах, както и в Контрол панела фигурират няколко Microsoft Visual C++  от 2005 до 2012г, както и Microsoft Visual Studio Tools.

Доколкото разбрах от гугъл, това са инструменти за разработчици. Не знам нужни ли са на други програми, но тъй като програмирането не е моя стихия, те необходими ли са ми, или само заемат място на диска?

Поздрави!

 

Оставете на мира Visual C++ (това са поддържащи библиотеки и програмна среда нужна за доста програми, инструменти и дори игри в Windows). Заемат нищожно място.

Лог файлове са наред и другите планирани задачи можем да ги оставим. Мисля, че можем да приключим случая като решен.

 

 

Поздрави! :)

  • Автор

Благодаря сърдечно за отделеното време и търпеливите обяснения на разбираем за мене език!

Лек ден!

Поздрави!

М.Методиев

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.