Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Съмнения за вирус

20 април 201511 г.

Имам два компютъра от които единия вече е инфектиран със нещо като крипто локър.

Ето за това става въпрос. Получихме го след като установихме че снимките от jpg са се превърнали във ECC файлове.

Искам да проверя втория че на него имам по-важни докуммнети

Предварителнно благодаря : )

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-04-2015 01
Ran by bbbb (administrator) on BBBB-PC on 19-04-2015 22:27:32
Running from C:\Users\bbbb\Downloads
Loaded Profiles: bbbb (Available profiles: bbbb)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(HP) C:\Windows\System32\HPSIsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
() C:\Program Files (x86)\D-Link\DWA-130 revE\WlanWpsSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(D-Link Corp.) C:\Program Files (x86)\D-Link\DWA-130 revE\wirelesscm.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(EFD Software) C:\Users\bbbb\Documents\boris programs\HDTune.exe
(EFD Software) C:\Users\bbbb\Documents\boris programs\HDTune.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Users\bbbb\Downloads\Windows-KB890830-x64-V5.23.exe
(Microsoft Corporation) C:\a06aee7db25151cf3d\mrtstub.exe
(Microsoft Corporation) C:\Windows\System32\MRT.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Wireless Connection Manager.lnk [2014-11-25]
ShortcutTarget: Wireless Connection Manager.lnk -> C:\Program Files (x86)\D-Link\DWA-130 revE\wirelesscm.exe (D-Link Corp.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3718270677-4290495217-167408065-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKU\S-1-5-21-3718270677-4290495217-167408065-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?rd=1&ucc=CA&dcc=CA&opt=0&ocid=iehp&tc=2
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2013-02-20] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2013-02-20] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-04-08] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\bbbb\AppData\Roaming\Mozilla\Firefox\Profiles\pbn00b35.default
FF Keyword.URL:
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-04-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-04-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-25] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-04-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-05-01]

Chrome:
=======
CHR StartupUrls: Default -> "https://www.google.ca/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.510.13) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
CHR Plugin: (Java Platform SE 7 U51) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll No File
CHR Profile: C:\Users\bbbb\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Logitech SetPoint) - C:\Users\bbbb\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd [2014-05-22]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\bbbb\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-05]
CHR Extension: (Google Wallet) - C:\Users\bbbb\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-06]
CHR HKLM-x32\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx [2013-05-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed]
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WlanWpsSvc; C:\Program Files (x86)\D-Link\DWA-130 revE\WlanWpsSvc.exe [167936 2008-06-26] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2011-06-02] ()
R1 MpKsldac3b931; C:\Windows\system32\MpEngineStore\MpKsldac3b931.sys [45352 2015-04-19] (Microsoft Corporation)
R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [19968 2012-11-07] (Marvell Semiconductor, Inc.)
S3 PcaSp60; C:\Windows\SysWOW64\DRIVERS\PcaSp60.sys [38912 2010-09-07] (Printing Communications Assoc., Inc. (PCAUSA))
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-08-21] (Duplex Secure Ltd.)
U3 ashr5zpw; C:\Windows\System32\Drivers\ashr5zpw.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-19 22:27 - 2015-04-19 22:28 - 00012102 _____ () C:\Users\bbbb\Downloads\FRST.txt
2015-04-19 22:12 - 2015-04-19 22:13 - 02098176 _____ (Farbar) C:\Users\bbbb\Downloads\FRST64.exe
2015-04-19 22:11 - 2015-04-19 22:11 - 00000000 ____D () C:\Windows\system32\MpEngineStore
2015-04-19 22:11 - 2015-04-19 22:11 - 00000000 ____D () C:\a06aee7db25151cf3d
2015-04-19 22:07 - 2015-04-19 22:10 - 45142720 _____ (Microsoft Corporation) C:\Users\bbbb\Downloads\Windows-KB890830-x64-V5.23.exe
2015-04-19 07:46 - 2015-04-19 07:46 - 02217984 _____ () C:\Users\bbbb\Downloads\adwcleaner_4.201(1).exe
2015-04-18 20:59 - 2015-04-18 21:13 - 00000000 ____D () C:\Users\bbbb\Desktop\2015-apr
2015-04-18 07:32 - 2015-04-18 09:05 - 1186529280 _____ () C:\Users\bbbb\Downloads\ubuntu-15.04-beta2-desktop-i386.iso
2015-04-16 19:18 - 2015-04-16 19:18 - 10247035 _____ () C:\Users\bbbb\Downloads\sae_industrialisation.zip
2015-04-15 17:25 - 2015-04-15 17:25 - 00298161 _____ () C:\Users\bbbb\Downloads\quiz_gÉo_industriel_-_david_girard (2).pptx
2015-04-15 17:25 - 2015-04-15 17:25 - 00298161 _____ () C:\Users\bbbb\Downloads\quiz_gÉo_industriel_-_david_girard (1).pptx
2015-04-15 17:04 - 2015-04-15 17:04 - 00298161 _____ () C:\Users\bbbb\Downloads\quiz_gÉo_industriel_-_david_girard.pptx
2015-04-15 16:38 - 2015-04-15 16:39 - 07295488 _____ () C:\Users\bbbb\Downloads\1_Qu_est-ce_qu_un_territoire (1).ppt
2015-04-15 16:37 - 2015-04-15 16:38 - 07295488 _____ () C:\Users\bbbb\Downloads\1_Qu_est-ce_qu_un_territoire.ppt
2015-04-15 16:35 - 2015-04-15 16:36 - 07754240 _____ () C:\Users\bbbb\Downloads\ConceptsTerritoireForestier-D.pps
2015-04-14 17:03 - 2015-04-14 17:03 - 00637933 _____ () C:\Users\bbbb\Downloads\Outlook.com (6).zip
2015-04-14 17:03 - 2015-04-14 17:03 - 00637933 _____ () C:\Users\bbbb\Downloads\Outlook.com (5).zip
2015-04-12 19:58 - 2015-04-12 19:58 - 00243312 _____ () C:\Users\bbbb\Downloads\Firefox Setup Stub 37.0.1.exe
2015-04-11 19:05 - 2015-04-11 19:22 - 00000000 ____D () C:\Users\bbbb\Desktop\2015-jan
2015-04-11 11:43 - 2015-04-11 11:44 - 02217984 _____ () C:\Users\bbbb\Downloads\adwcleaner_4.201.exe
2015-04-10 17:21 - 2015-04-17 12:22 - 00031974 _____ () C:\Users\bbbb\Desktop\1.txt
2015-04-03 14:28 - 2015-04-03 14:28 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2015-04-02 12:12 - 2015-04-02 12:12 - 01672085 _____ () C:\Users\bbbb\Downloads\Laptop_Parts.zip
2015-04-02 00:08 - 2015-04-02 00:08 - 00698225 _____ () C:\Users\bbbb\Downloads\iphone2_ok.odp
2015-04-02 00:08 - 2015-04-02 00:08 - 00010453 _____ () C:\Users\bbbb\Downloads\fond_schema (1).odt
2015-04-01 23:08 - 2015-04-01 23:09 - 03101696 _____ () C:\Users\bbbb\Downloads\DIAPO1-3 (1).ppt
2015-04-01 21:43 - 2015-04-01 21:43 - 03968512 _____ () C:\Users\bbbb\Downloads\DIAPO3-5.ppt
2015-04-01 21:42 - 2015-04-01 21:43 - 03479040 _____ () C:\Users\bbbb\Downloads\DIAPO2-3.ppt
2015-04-01 21:42 - 2015-04-01 21:42 - 03101696 _____ () C:\Users\bbbb\Downloads\DIAPO1-3.ppt
2015-04-01 21:38 - 2015-04-01 21:38 - 00010453 _____ () C:\Users\bbbb\Downloads\fond_schema.odt
2015-04-01 18:59 - 2015-04-01 18:59 - 00155905 _____ () C:\Users\bbbb\Downloads\Messages importants.zip
2015-03-29 19:35 - 2015-03-29 19:36 - 00309570 _____ () C:\Users\bbbb\Downloads\quizgeoindustrie.pptx
2015-03-29 19:33 - 2015-03-29 19:34 - 05658255 _____ () C:\Users\bbbb\Downloads\conceptsterritoireindustriel (2).pptx
2015-03-29 19:19 - 2015-03-29 19:19 - 01173785 _____ () C:\Users\bbbb\Downloads\Dossier2Géographie (1).ppsx
2015-03-29 19:15 - 2015-03-29 19:15 - 05623576 _____ () C:\Users\bbbb\Downloads\ConceptsTerritoireIndustriel (1).pptx
2015-03-29 19:02 - 2015-03-29 19:02 - 05623576 _____ () C:\Users\bbbb\Downloads\ConceptsTerritoireIndustriel.pptx
2015-03-29 18:53 - 2015-03-29 18:53 - 01173785 _____ () C:\Users\bbbb\Downloads\Dossier2Géographie.ppsx
2015-03-27 21:36 - 2015-03-27 21:36 - 01124544 _____ (Adobe Systems Incorporated) C:\Users\bbbb\Downloads\flashplayer17_ha_install.exe
2015-03-26 20:58 - 2015-03-26 20:59 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (8).caf
2015-03-26 19:54 - 2015-03-26 19:55 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (7).caf
2015-03-26 19:53 - 2015-03-26 19:54 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (6).caf
2015-03-26 19:29 - 2015-03-26 19:30 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (5).caf
2015-03-26 19:28 - 2015-03-26 19:30 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (4).caf
2015-03-26 19:10 - 2015-03-26 19:12 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (3).caf
2015-03-26 18:51 - 2015-03-26 18:52 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (2).caf
2015-03-26 18:49 - 2015-03-26 18:50 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS.caf
2015-03-26 18:49 - 2015-03-26 18:50 - 19286000 _____ () C:\Users\bbbb\Downloads\Le cancre_201_MS (1).caf
2015-03-23 22:06 - 2015-03-23 22:06 - 06262601 _____ () C:\Users\bbbb\Downloads\chapter_02_part_1.wma
2015-03-23 20:54 - 2015-03-23 20:54 - 514921484 _____ () C:\Users\bbbb\Desktop\MVI_2843.MOV
2015-03-23 16:54 - 2015-03-23 16:54 - 01105315 _____ () C:\Users\bbbb\Downloads\chapter_20_part_2.wma
2015-03-23 16:52 - 2015-03-23 16:52 - 09453785 _____ () C:\Users\bbbb\Downloads\chapter_01_part_1.wma
2015-03-22 15:41 - 2015-03-22 15:42 - 15049496 _____ () C:\Users\bbbb\Downloads\Un_produit_mondialise.pptx

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-19 22:27 - 2014-05-31 18:48 - 00000000 ____D () C:\FRST
2015-04-19 22:07 - 2014-08-02 10:20 - 00000000 ____D () C:\Users\bbbb\Documents\forumi
2015-04-19 22:02 - 2009-07-14 00:45 - 00035280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-19 22:02 - 2009-07-14 00:45 - 00035280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-19 21:48 - 2012-07-31 05:02 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-19 21:39 - 2012-07-31 04:32 - 01864058 _____ () C:\Windows\WindowsUpdate.log
2015-04-19 18:07 - 2013-01-13 03:13 - 00000000 ____D () C:\Users\bbbb\Documents\kijiji
2015-04-19 16:20 - 2014-05-22 22:24 - 00002235 _____ () C:\Windows\setupact.log
2015-04-19 07:47 - 2013-08-20 23:39 - 00000000 ____D () C:\AdwCleaner
2015-04-19 07:37 - 2009-07-13 22:34 - 00000491 _____ () C:\Windows\win.ini
2015-04-19 07:26 - 2014-07-18 19:46 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-19 06:47 - 2012-07-31 05:02 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-19 06:47 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-18 20:37 - 2012-12-28 03:44 - 00007602 _____ () C:\Users\bbbb\AppData\Local\Resmon.ResmonCfg
2015-04-17 15:11 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-12 20:15 - 2014-08-07 23:46 - 00000000 ____D () C:\Users\bbbb\AppData\Local\Adobe
2015-04-12 20:02 - 2013-12-08 23:34 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-12 20:02 - 2013-12-08 23:34 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-12 20:00 - 2015-01-27 21:54 - 00001147 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-04-12 20:00 - 2014-10-15 09:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-11 19:12 - 2015-02-21 21:15 - 00000000 ____D () C:\Users\bbbb\Desktop\2015-feb
2015-04-11 09:41 - 2014-05-25 01:08 - 00001908 _____ () C:\Windows\diagwrn.xml
2015-04-11 09:41 - 2014-05-25 01:08 - 00001908 _____ () C:\Windows\diagerr.xml
2015-04-11 09:40 - 2014-05-22 22:24 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-10 17:20 - 2009-07-14 01:13 - 00786662 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-05 22:43 - 2012-07-31 05:02 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-04-05 22:43 - 2012-07-31 05:02 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-04-01 11:16 - 2012-07-31 05:43 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-31 16:33 - 2009-07-14 01:08 - 00032566 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-27 20:49 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Public\Libraries
2015-03-25 08:13 - 2014-04-25 21:48 - 00778784 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-03-25 08:07 - 2012-12-12 01:59 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-24 07:36 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-23 16:52 - 2009-07-14 00:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2014-02-04 22:26 - 2014-02-04 22:26 - 0002611 _____ () C:\Program Files (x86)\ASUS PC Diagnostics.lnk
2014-03-30 22:23 - 2014-03-30 22:23 - 0003584 _____ () C:\Users\bbbb\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-12-28 03:44 - 2015-04-18 20:37 - 0007602 _____ () C:\Users\bbbb\AppData\Local\Resmon.ResmonCfg
2012-07-31 05:19 - 2012-07-31 05:19 - 0219918 _____ () C:\ProgramData\1343726068.bdinstall.bin
2014-04-25 20:14 - 2010-05-28 22:37 - 0015086 _____ () C:\ProgramData\Amazon.ico
2015-01-29 18:56 - 2010-07-22 14:26 - 0024772 _____ () C:\ProgramData\P1100DEF.css
2015-01-29 18:56 - 2015-01-29 18:56 - 0004174 _____ () C:\ProgramData\P1100OS.HTM
2015-01-29 18:56 - 2010-07-22 14:26 - 0002944 _____ () C:\ProgramData\P1100SIG.GIF

Some content of TEMP:
====================
C:\Users\bbbb\AppData\Local\Temp\sfamcc00001.dll
C:\Users\bbbb\AppData\Local\Temp\SkypeSetup.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-14 17:54

==================== End Of Log ============================

Ето и другия файл

Cлагам го по този начин понеже ми изписва....файлът е прекалено голям.

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-04-2015 01
Ran by bbbb at 2015-04-19 22:28:39
Running from C:\Users\bbbb\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Ashampoo Office 2008 (C:\Program Files (x86)\Ashampoo\Ashampoo Office 2008) (HKLM-x32\...\sm-un1.u32) (Version: - SoftMaker Software GmbH)
ASUS PC Diagnostics (HKLM-x32\...\{D709005F-D8DC-42A8-8435-5AE880ECAF82}) (Version: 1.2.6 - ASUSTeK Computer Inc.)
BitTorrent (HKU\S-1-5-21-3718270677-4290495217-167408065-1000\...\BitTorrent) (Version: 7.9.2.36804 - BitTorrent Inc.)
Canon DIGITAL CAMERA Solution Disk Software Guide (HKLM-x32\...\Software Guide) (Version: 1.4.0.1 - Canon Inc.)
Canon MOV Decoder (HKLM-x32\...\Canon MOV Decoder) (Version: 1.8.0.7 - Canon Inc.)
Canon MOV Encoder (HKLM-x32\...\Canon MOV Encoder) (Version: 1.6.0.1 - Canon Inc.)
Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\...\MovieEditTask) (Version: 3.7.0.4 - Canon Inc.)
Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC8) (Version: 8.4.0.3 - Canon Inc.)
Canon Utilities CameraWindow Launcher (HKLM-x32\...\CameraWindowLauncher) (Version: 7.5.0.2 - Canon Inc.)
Canon Utilities Movie Uploader for YouTube (HKLM-x32\...\MovieUploaderForYouTube) (Version: 1.2.0.7 - Canon Inc.)
Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 7.4.0.2 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.5.0.9 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.03 - Piriform)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
D-Link DWA-130 Wireless N USB Adapter (HKLM-x32\...\{6F6F39E3-D24D-4EEE-9AEA-DEDAF991385D}) (Version: - D-Link)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version: - EFD Software)
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
Intel® Driver Update Utility 2.0 (x32 Version: 2.0.0.29 - Intel) Hidden
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4101 - Intel Corporation)
Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{8409c4f7-2340-4933-a304-5d37db4fb48b}) (Version: 2.0.0.29 - Intel)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Logitech SetPoint 6.52 (HKLM\...\sp6) (Version: 6.52.74 - Logitech)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.1.177.0 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
PeaZip 5.5.0 (HKLM-x32\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: - Giorgio Tani)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SOE Web Installer (HKU\S-1-5-21-3718270677-4290495217-167408065-1000\...\SOE Web Installer) (Version: 1.0.3.171 - Sony Online Entertainment)
Speccy (HKLM\...\Speccy) (Version: 1.17 - Piriform)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.22298 - TeamViewer)
TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points =========================

ATTENTION: System Restore is disabled.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0CD820D4-4265-4D6E-9699-6C6A2B55359F} - System32\Tasks\{30EE88BE-2A99-4B2F-8B7E-594C2992FCF1} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {0CDE5E2F-1001-49FA-8BFA-95395B6EB9A4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-05] (Google Inc.)
Task: {162D2C23-794C-4EB8-A49D-3E3C68319B06} - System32\Tasks\{72BFB8A7-F945-434D-95D4-EA42E9376934} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {2C5B47A4-3490-4C8E-9FE4-56DDA6BF19A0} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {3238A252-5CCB-42BA-8F57-BE15F32E2E3C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {37092164-FC8C-408C-BCDE-578B8CC68819} - \Browser Updater\PriceCongress Browser Updater No Task File <==== ATTENTION
Task: {3B004853-F72B-47B6-8E50-BB2E74D08CDA} - System32\Tasks\{B9E8BEE8-AEB0-4258-AFDE-F72EC7DCF591} => Chrome.exe http://ui.skype.com/ui/0/6.18.0.106/en/abandoninstall?page=tsProgressBar
Task: {52EDCF67-B8B3-4649-A22D-B6D318804EAF} - System32\Tasks\{FECC4138-112D-43DA-A5DF-1BEE7EDDC851} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {536DA2FE-536B-4CF2-8E8A-72C7C6CF4233} - System32\Tasks\{ADD3C34B-0447-4DDE-B915-B70FC9290761} => pcalua.exe -a "C:\Users\bbbb\Downloads\hdtune_255 (1).exe" -d C:\Users\bbbb\Downloads
Task: {54AC8D6A-31D3-4D03-B711-0617A9EA57E5} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {7B44C0AE-A87F-4B7A-AE72-B570171D5AAF} - System32\Tasks\{447D9187-2559-44E3-A74E-5B7A7FC8F8F0} => C:\Program Files (x86)\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {7DAC7784-CDBC-4325-8C90-F97059E9134D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-05] (Google Inc.)
Task: {7E083403-AC44-4C39-B833-EF39F489D429} - System32\Tasks\{6D08C050-F3F1-49B3-9FF5-C763EC369068} => F:\Program Files\Microsoft Office 2007\wordicon.exe
Task: {8FE820A3-0E02-40DE-8E07-6E0F44CBF846} - System32\Tasks\{AAF58CF2-61B9-4679-A6D7-38C78D562A4E} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {A78DE99A-E154-42AA-BC3C-22AE30DBF29D} - System32\Tasks\{C6538356-AA59-4944-9C23-F5D548E76510} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {A95FEB2E-BDF3-43B9-8C7C-0CE7518CADDA} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {CEC89B6F-C719-4FCB-9FC3-83E6C3DCD19E} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-01-29] (Microsoft)
Task: {D1214F74-73CF-4010-92E4-290BFF63A700} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {D5637EF5-F46F-40AF-B683-FC61F2F5BAE0} - \SystemSockets\SystemSockets No Task File <==== ATTENTION
Task: {DBF04BB9-50EB-4FB8-9054-EE95C49EFD3B} - System32\Tasks\{CB0B21D3-68DA-43F9-9DBD-3364750CF424} => F:\Program Files\Microsoft Office 2007\wordicon.exe
Task: {DDFCECB0-CA51-4091-9ECA-20750113D5E6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {EE49BC62-63DF-44B1-AB54-714BF11FBE30} - System32\Tasks\{14E177ED-6646-43F0-8C15-616D5D9AEC2F} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {EE65A594-F2D6-4CAC-A44A-DAE347A40BAB} - System32\Tasks\{1B1647F2-F970-42C5-BCF3-F0F6AD6FE1A9} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: {F3273449-95C6-4660-A4CE-AA2C6F2E29BA} - System32\Tasks\{32B9D108-7937-4DDD-B7CF-666752327F64} => C:\Users\bbbb\Downloads\HD Tune\HDTune.exe [2008-02-09] (EFD Software)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-01-30 11:25 - 2012-08-31 19:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2013-01-30 11:20 - 2012-08-31 19:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2013-01-30 11:25 - 2012-08-31 19:03 - 03034112 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100su.dll
2013-01-30 11:25 - 2012-08-31 19:02 - 01038336 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\HP1100GC.dll
2012-07-31 05:10 - 2008-06-26 22:09 - 00167936 _____ () C:\Program Files (x86)\D-Link\DWA-130 revE\WlanWpsSvc.exe
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-01-30 11:25 - 2012-08-31 19:03 - 00373760 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100sd.dll
2012-07-31 05:10 - 2009-08-06 19:15 - 00376832 _____ () C:\Program Files (x86)\D-Link\DWA-130 revE\WlanDll.dll
2015-04-18 06:49 - 2015-04-13 17:55 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libglesv2.dll
2015-04-18 06:49 - 2015-04-13 17:55 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.90\libegl.dll
2012-09-24 00:43 - 2012-09-24 00:43 - 00313992 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\sqlite.dll
2012-12-18 15:08 - 2012-12-18 15:08 - 14588632 _____ () C:\Program Files (x86)\Adobe\Reader 11.0\Reader\NPSWF32.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\bbbb\Downloads\BitTorrent.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\browse.php:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\chromeinstall-7u25.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\dxwebsetup.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\GoogleEarthPluginSetup.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\HWVendorDetection.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\Install_SOEWebInstaller.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\MS office 2010 pro .exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\MSIMG32.dll:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\NetFxRepairTool.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\rescue2usb.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\scroll_app_smart_4.00.33.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\SeaToolsforWindowsSetup-1208.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\setpoint632_smart.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\Silverlight.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\Support-LogMeInRescue (1).exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\tdsskiller.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\win64_152812.exe:BDU
AlternateDataStreams: C:\Users\bbbb\Downloads\Win64_152818.exe:BDU

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3718270677-4290495217-167408065-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AxAutoMntSrv => 2
MSCONFIG\Services: defragsvc => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: hidserv => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: WbioSrvc => 3
MSCONFIG\Services: WinDefend => 2
MSCONFIG\Services: WPCSvc => 3
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AlcoholAutomount => "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
MSCONFIG\startupreg: BDAgent => "C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe"
MSCONFIG\startupreg: BitTorrent => "C:\Users\bbbb\AppData\Roaming\BitTorrent\BitTorrent.exe" /MINIMIZED
MSCONFIG\startupreg: BlueStacks Agent => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
MSCONFIG\startupreg: EvtMgr6 => C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
MSCONFIG\startupreg: HotKeysCmds => "C:\Windows\system32\hkcmd.exe"
MSCONFIG\startupreg: IgfxTray => "C:\Windows\system32\igfxtray.exe"
MSCONFIG\startupreg: LifeCam => "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
MSCONFIG\startupreg: Persistence => "C:\Windows\system32\igfxpers.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-3718270677-4290495217-167408065-500 - Administrator - Disabled)
bbbb (S-1-5-21-3718270677-4290495217-167408065-1000 - Administrator - Enabled) => C:\Users\bbbb
Guest (S-1-5-21-3718270677-4290495217-167408065-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3718270677-4290495217-167408065-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (04/19/2015 07:29:36 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/19/2015 07:29:36 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/19/2015 06:49:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/18/2015 06:30:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/17/2015 07:34:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2015 03:29:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2015 05:31:16 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/15/2015 11:31:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/15/2015 02:02:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/15/2015 05:18:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (04/19/2015 10:07:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/19/2015 06:06:53 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/19/2015 06:49:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/18/2015 03:03:26 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/18/2015 03:03:10 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/18/2015 06:30:04 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/17/2015 11:09:41 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/17/2015 11:09:33 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/17/2015 11:08:24 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Error: (04/17/2015 11:08:22 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: machine-defaultLocalActivation{06622D85-6856-4460-8DE1-A81921B41C4B}{06622D85-6856-4460-8DE1-A81921B41C4B}NT AUTHORITYNETWORK SERVICES-1-5-20LocalHost (Using LRPC)

Microsoft Office Sessions:
=========================
Error: (04/19/2015 07:29:36 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\bbbb\Documents\boris programs\ESETSmartInstaller.exe

Error: (04/19/2015 07:29:36 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\bbbb\Documents\boris programs\esetsmartinstaller_bgr.exe

Error: (04/19/2015 06:49:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/18/2015 06:30:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/17/2015 07:34:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2015 03:29:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2015 05:31:16 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/15/2015 11:31:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/15/2015 02:02:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/15/2015 05:18:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

CodeIntegrity Errors:
===================================
Date: 2013-11-04 15:23:21.945
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 20:45:19.998
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 20:03:02.961
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 19:09:08.944
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 10:38:25.703
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 10:16:06.374
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 09:55:31.630
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 08:57:06.235
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 08:31:44.097
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-11-03 08:25:06.010
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files\Bitdefender\Bitdefender 2012\Active Virus Control\Avc3_00214_057\avcuf64.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Celeron® CPU G540 @ 2.50GHz
Percentage of memory in use: 62%
Total physical RAM: 3809.14 MB
Available physical RAM: 1429.92 MB
Total Pagefile: 7616.46 MB
Available Pagefile: 5303.74 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:698.63 GB) (Free:564.19 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Редактирано 20 април 201511 г. от B-boy[StyLe] (преглед на промените)

20 април 201511 г.

Здравейте,

От предоставените лог файлове поне тази система не е заразена. Но ще обясните ли защо сте без инсталирана антивирусна, защо Window Defender и System Restore са спрени?

Дори системата да се ползва за работа и да не е вързана към интернет, пак е недопустимо да няма поне една антивирусна програма. В момента не е желателно да поставяте флашки или външни дискове (поне не и докато не се уверите, че са чисти и преди това да спрете Autorun функцията на чистата система) и да осъществите каквото и да е връзка между двете системи без заразената да бъде почистена. Направете бекъп на важните документи от тази система (докато още можете). Ето някои съвети как да подсигурите системата си срещу криптобацилите преди да е станало прекалено късно:

https://www.kaldata.com/forums/topic/241180-нещо-ми-яде-производителността-на-процесораве/?p=3109466

20 април 201511 г.

Автор

От предоставените лог файлове поне тази система не е заразена. Но ще обясните ли защо сте без инсталирана антивирусна, защо Window Defender и System Restore са спрени?

Дори системата да се ползва за работа и да не е вързана към интернет, пак е недопустимо да няма поне една антивирусна програма. В момента не е желателно да поставяте флашки или външни дискове (поне не и докато не се уверите, че са чисти и преди това да спрете Autorun функцията на чистата система) и да осъществите каквото и да е връзка между двете системи без заразената да бъде почистена. Направете бекъп на важните документи от тази система (докато още можете). Ето някои съвети как да подсигурите системата си срещу криптобацилите преди да е станало прекалено късно:

https://www.kaldata.com/forums/topic/241180-нещо-ми-яде-производителността-на-процесораве/?p=3109466

Благодаря много за отделеното време

Антивирусна платена Битдефендър Antivirus имах доскоро на всички компютри.

Но откакто установих че:

1. не може да засече един досаден adware се отказах. Викам си какъв е смисъла от такова нещо, щом не може да се справи с един елементарен malware.

Става въпрос за тоя случай, когато пак опрях до вас:

https://www.kaldata.com/forums/topic/227845-%D0%BC%D0%B8%D1%81%D0%BB%D1%8F-%D1%87%D0%B5-%D0%B5-%D0%B2%D0%B8%D1%80%D1%83%D1%81/

2. Доста често ми натоварваше процесора на 99% и то не в момент на сканиране а ей така. Ето един шот където се вижда.

3. Понеже компа се използваше най-вече за поща, прочитането на някоя и друга новина, училищните проекти на сина ми..един път в седмицата пусках и да сканират malwarebyte + adwcleaner и си викам няма кой знае каква опасност..но явно не съм бил прав.

20 април 201511 г.

Доколкото виждам в другата тема не сте се върнали да отговорите на въпросите ми, нито сте се възползвали от съвета ми...това че не може да се справи с един аудер, не означава, че не става. След като натоварва е било редно да я смените например с Comodo Internet Security (както бях писал в другата ви тема), която хем е доста лека и сега нямаше да сте заразени с този криптобацил. Именно като прикачен zip, rar, cab архив към писмата в електронната поща се разпространява най-често този вид зловреден софтуер...От сега мога да кажа, че с файловете ви е свършено (пуснатата от вас нова тема), а на тази система не виждам зловредни файлове. Надявам се сте си научили урока...

Все пак направете следните две проверки:

СТЪПКА 1

След това моля изтеглете Malwarebytes Anti-Malware 2.1.6.1022 Final и я запазете на вашия десктоп.

Стартирайте файла mbam-setup-2.0.4.1028.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи се уверете че сте сложили отметка пред:
Launch Malwarebytes Anti-Malware
Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
Натиснете бутона Finish.
Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
Ще започне проверка за зловреден софтуер.
При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи натиснете бутона Apply Actions.
Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
Отидете то табът History > Application Logs.
Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

СТЪПКА 2

1.Изтеглете Hitman Pro.
За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.

3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

СТЪПКА 3

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Full Scan. Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

СТЪПКА 4

Нека да видим за стар и уязвим софтуер:

Изтеглете Security Check от screen317 от този линк или и го запаметете на вашия десктоп.
Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля прикачете го в следващия ви коментар в тази тема.

Поздрави!

20 април 201511 г.

Автор

Урока го нaучихме . Благодаря за което.

...Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 18/07/2014
Scan Time: 7:47:51 PM
Logfile:
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.18.10
Rootkit Database: v2014.07.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: bbbb

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 278382
Time Elapsed: 6 min, 14 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 3
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}, Quarantined, [19e9c8d92655ca6cc6319af8ec16a65a],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, Quarantined, [19e9c8d92655ca6cc6319af8ec16a65a],
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, Quarantined, [19e9c8d92655ca6cc6319af8ec16a65a],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.LiveSoftAction, C:\Users\bbbb\Downloads\GIGABYTE GA-H81TN user guide provided through pdfretriever.com (1).exe, Quarantined, [e41e168b245726101bf780560400e818],

Physical Sectors: 0
(No malicious items detected)

(end)

Редактирано 20 април 201511 г. от julienalexandrov (преглед на промените)

20 април 201511 г.

Автор

<?xml version="1.0"?>

-<Log filesProcessed="67291" timeSpentInSecs="222" date="2015-04-20T11:46:21" version="3.7.9.240" scan="Normal" windows="6.1.1.7601.X64/2" computer="BBBB-PC">