Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

instartsurf на компютъра и не мога да го изтрия

19 май 201511 г.

Не, не е необходимо. Изглежда, че тази папка е част от CCleaner, но каква е нейната функция не успях да установя.

Стъпка 1

Следвайте инструкциите тук, за да премахнете разширенията към Google Chrome, които не са ви необходими.

https://support.google.com/chrome_webstore/answer/187443?hl=bg

Стъпка 2

1. Изтеглете ComboFix от BleepingComputer

и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. Ако получите предупреждение от UAC, съгласете се.

5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.

6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне.

По време на сканирането не използвайте компютъра си !

19 май 201511 г.

Автор

ComboFix 15-05-13.01 - o 05.2015 г. 19:15:49.1.2 - x86

Microsoft Windows 7 Professional 6.1.7601.1.1251.359.1033.18.2038.1189 [GMT 3:00]

Running from: c:\users\o\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

c:\users\o\05.jpg

((((((((((((((((((((((((( Files Created from 2015-04-19 to 2015-05-19 )))))))))))))))))))))))))))))))

2015-05-19 18:07 . 2015-05-19 18:07 -------- d-----w- c:\users\GuestUser\AppData\Local\temp

2015-05-19 18:07 . 2015-05-19 18:07 -------- d-----w- c:\users\GuestUser.o-PC\AppData\Local\temp

2015-05-18 17:46 . 2015-05-18 17:46 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{541F99AE-BFAE-4EB8-A6C0-214FA90609F7}\offreg.dll

2015-05-18 17:16 . 2015-05-18 17:16 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2015-05-18 17:16 . 2015-05-18 17:16 194048 ----a-w- c:\windows\system32\elshyph.dll

2015-05-18 17:10 . 2015-05-18 17:10 645120 ----a-w- c:\windows\system32\jsIntl.dll

2015-05-18 17:10 . 2015-05-18 17:10 1052672 ----a-w- c:\program files\Internet Explorer\perf_nt.dll

2015-05-18 17:10 . 2015-05-18 17:10 126464 ----a-w- c:\program files\Internet Explorer\perfcore.dll

2015-05-18 17:09 . 2015-05-18 17:09 182272 ----a-w- c:\windows\system32\msls31.dll

2015-05-18 17:09 . 2015-05-18 17:09 1882112 ----a-w- c:\windows\system32\wininet.dll

2015-05-18 17:08 . 2015-05-18 17:08 235208 ----a-w- c:\program files\Internet Explorer\sqmapi.dll

2015-05-18 17:07 . 2015-05-18 17:07 62464 ----a-w- c:\windows\system32\tdc.ocx

2015-05-18 17:07 . 2015-05-18 17:07 287744 ----a-w- c:\program files\Internet Explorer\IEShims.dll

2015-05-18 17:07 . 2015-05-18 17:07 60416 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll

2015-05-18 17:07 . 2015-05-18 17:07 469504 ----a-w- c:\program files\Internet Explorer\ieinstal.exe

2015-05-18 17:07 . 2015-05-18 17:07 359632 ----a-w- c:\program files\Internet Explorer\iediagcmd.exe

2015-05-18 17:07 . 2015-05-18 17:07 255488 ----a-w- c:\program files\Internet Explorer\F12Tools.dll

2015-05-18 17:06 . 2015-05-18 17:06 341504 ----a-w- c:\windows\system32\html.iec

2015-05-18 17:06 . 2015-05-18 17:06 174592 ----a-w- c:\program files\Internet Explorer\DiagnosticsTap.dll

2015-05-18 17:06 . 2015-05-18 17:06 221184 ----a-w- c:\program files\Internet Explorer\ielowutil.exe

2015-05-18 17:05 . 2015-05-18 17:05 230400 ----a-w- c:\program files\Internet Explorer\DiagnosticsHub.ScriptedSandboxPlugin.dll

2015-05-18 17:05 . 2015-05-18 17:05 153600 ----a-w- c:\program files\Internet Explorer\Timeline.dll

2015-05-18 17:05 . 2015-05-18 17:05 62464 ----a-w- c:\windows\system32\iesetup.dll

2015-05-18 17:04 . 2015-05-18 17:04 1155072 ----a-w- c:\windows\system32\mshtmlmedia.dll

2015-05-18 17:04 . 2015-05-18 17:04 1075200 ----a-w- c:\program files\Internet Explorer\networkinspection.dll

2015-05-18 17:03 . 2015-05-18 17:03 2052608 ----a-w- c:\windows\system32\inetcpl.cpl

2015-05-18 17:03 . 2015-05-18 17:03 24576 ----a-w- c:\windows\system32\licmgr10.dll

2015-05-18 17:03 . 2015-05-18 17:03 285696 ----a-w- c:\program files\Internet Explorer\ieproxy.dll

2015-05-18 17:02 . 2015-05-18 17:02 772608 ----a-w- c:\program files\Internet Explorer\iedvtool.dll

2015-05-18 17:02 . 2015-05-18 17:02 139264 ----a-w- c:\windows\system32\wextract.exe

2015-05-18 17:02 . 2015-05-18 17:02 151552 ----a-w- c:\windows\system32\iexpress.exe

2015-05-18 17:01 . 2015-05-18 17:01 53760 ----a-w- c:\program files\Internet Explorer\JSProfilerCore.dll

2015-05-18 17:01 . 2015-05-18 17:01 504320 ----a-w- c:\windows\system32\vbscript.dll

2015-05-18 17:00 . 2015-05-18 17:00 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2015-05-18 17:00 . 2015-05-18 17:00 115712 ----a-w- c:\windows\system32\ieUnatt.exe

2015-05-18 17:00 . 2015-05-18 17:00 312392 ----a-w- c:\program files\Internet Explorer\msdbg2.dll

2015-05-18 17:00 . 2015-05-18 17:00 410680 ----a-w- c:\program files\Internet Explorer\pdm.dll

2015-05-18 17:00 . 2015-05-18 17:00 97880 ----a-w- c:\program files\Internet Explorer\pdmproxy100.dll

2015-05-18 16:59 . 2015-05-18 16:59 13312 ----a-w- c:\windows\system32\mshta.exe

2015-05-18 16:59 . 2015-05-18 16:59 10948096 ----a-w- c:\program files\Internet Explorer\F12Resources.dll

2015-05-18 16:59 . 2015-05-18 16:59 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll

2015-05-18 16:58 . 2015-05-18 16:58 102912 ----a-w- c:\windows\system32\ieetwcollector.exe

2015-05-18 16:58 . 2015-05-18 16:58 47616 ----a-w- c:\windows\system32\ieetwproxystub.dll

2015-05-18 16:58 . 2015-05-18 16:58 489472 ----a-w- c:\program files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll

2015-05-18 16:58 . 2015-05-18 16:58 105984 ----a-w- c:\program files\Internet Explorer\jsdebuggeride.dll

2015-05-18 16:57 . 2015-05-18 16:57 64000 ----a-w- c:\windows\system32\MshtmlDac.dll

2015-05-18 16:57 . 2015-05-18 16:57 1399296 ----a-w- c:\program files\Internet Explorer\MemoryAnalyzer.dll

2015-05-18 16:57 . 2015-05-18 16:57 36352 ----a-w- c:\windows\system32\imgutil.dll

2015-05-18 16:56 . 2015-05-18 16:56 817664 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2015-05-18 16:56 . 2015-05-18 16:56 1206272 ----a-w- c:\program files\Internet Explorer\F12.dll

2015-05-18 16:55 . 2015-05-18 16:55 3451392 ----a-w- c:\program files\Internet Explorer\D3DCompiler_47.dll

2015-05-18 16:55 . 2015-05-18 16:55 111616 ----a-w- c:\windows\system32\IEAdvpack.dll

2015-05-18 16:55 . 2015-05-18 16:55 579584 ----a-w- c:\program files\Internet Explorer\jsprofilerui.dll

2015-05-18 16:55 . 2015-05-18 16:55 438272 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll

2015-05-18 16:55 . 2015-05-18 16:55 124416 ----a-w- c:\program files\Internet Explorer\Timeline_is.dll

2015-05-18 16:55 . 2015-05-18 16:55 25600 ----a-w- c:\program files\Internet Explorer\ExtExport.exe

2015-05-18 16:55 . 2015-05-18 16:55 37888 ----a-w- c:\program files\Internet Explorer\DiagnosticsHub_is.dll

2015-05-18 16:54 . 2015-05-18 16:54 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2015-05-18 16:54 . 2015-05-18 16:54 620032 ----a-w- c:\windows\system32\jscript9diag.dll

2015-05-18 16:54 . 2015-05-18 16:54 4305920 ----a-w- c:\windows\system32\jscript9.dll

2015-05-18 16:53 . 2015-05-18 16:53 48640 ----a-w- c:\windows\system32\mshtmler.dll

2015-05-18 16:53 . 2015-05-18 16:53 86016 ----a-w- c:\windows\system32\iesysprep.dll

2015-05-18 16:16 . 2015-05-18 16:45 -------- dc--a-w- C:\3590F75ABA9E485486C100C1A9D4FF06ZZZ...ZZ....Z..Z

2015-05-18 15:06 . 2015-05-18 15:06 -------- d-----w- c:\program files\Mozilla Maintenance Service

2015-05-15 22:22 . 2015-05-15 22:22 -------- d-----w- c:\program files\Microsoft Silverlight

2015-05-15 20:09 . 2010-05-21 09:11 475648 ----a-w- c:\windows\system32\MyDefragScreenSaver_v4.3.1.scr

2015-05-15 20:09 . 2010-05-21 09:11 1061888 ----a-w- c:\windows\system32\MyDefragScreenSaver_v4.3.1.exe

2015-05-15 20:09 . 2015-05-18 11:53 -------- d-----w- c:\program files\MyDefrag v4.3.1

2015-05-15 15:45 . 2015-05-15 15:45 -------- d-----w- c:\program files\ESET

2015-05-15 15:35 . 2015-04-04 06:39 9201616 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{541F99AE-BFAE-4EB8-A6C0-214FA90609F7}\mpengine.dll

2015-05-14 17:50 . 2015-05-19 14:12 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys

2015-05-14 17:49 . 2015-05-15 04:25 -------- d-----w- c:\program files\Malwarebytes Anti-Malware

2015-05-14 17:49 . 2015-04-14 06:37 51928 ----a-w- c:\windows\system32\drivers\mwac.sys

2015-05-14 17:49 . 2015-04-14 06:37 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2015-05-14 17:49 . 2015-04-14 06:37 23256 ----a-w- c:\windows\system32\drivers\mbam.sys

2015-05-14 17:36 . 2015-05-19 18:06 29 ----a-w- c:\windows\system32\TempWmicBatchFile.bat

2015-05-14 17:19 . 2015-05-14 17:19 -------- d--h--w- c:\windows\PIF

2015-05-14 06:17 . 2015-05-14 17:31 -------- d-----w- c:\users\o\AppData\Local\Installer

2015-05-14 00:43 . 2015-05-01 13:16 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 19:48 . 2015-04-23 16:47 291312 ----a-w- c:\windows\system32\aswBoot.exe

2015-05-13 03:43 . 2015-01-29 03:02 844288 ----a-w- c:\windows\system32\drivers\UMDF\WpdMtpDr.dll

2015-05-13 03:43 . 2015-01-29 03:02 2311168 ----a-w- c:\windows\system32\wpdshext.dll

2015-05-13 03:41 . 2015-05-05 01:12 248832 ----a-w- c:\windows\system32\schannel.dll

2015-05-13 03:41 . 2015-04-18 02:56 342016 ----a-w- c:\windows\system32\certcli.dll

2015-05-13 03:41 . 2015-03-04 04:11 5120 ----a-w- c:\windows\system32\shimeng.dll

2015-05-13 03:41 . 2015-03-04 04:10 295936 ----a-w- c:\windows\system32\apphelp.dll

2015-05-13 03:41 . 2015-03-04 04:10 62464 ----a-w- c:\windows\system32\aelupsvc.dll

2015-05-13 03:41 . 2015-03-04 04:10 20992 ----a-w- c:\windows\system32\sdbinst.exe

2015-05-13 03:41 . 2015-04-13 03:19 259072 ----a-w- c:\windows\system32\services.exe

2015-05-13 03:41 . 2015-04-08 03:14 938496 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2015-05-13 03:40 . 2015-04-08 03:14 1415168 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\InkObj.dll

2015-05-13 03:40 . 2015-04-08 03:14 216064 ----a-w- c:\windows\system32\InkEd.dll

2015-05-13 03:40 . 2015-04-08 03:14 126464 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\rtscom.dll

2015-05-13 03:40 . 2015-04-08 03:14 274944 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\InkDiv.dll

2015-05-13 03:40 . 2015-02-18 07:06 123904 ----a-w- c:\windows\system32\poqexec.exe

2015-04-23 16:47 . 2015-04-23 16:47 43112 ----a-w- c:\windows\avastSS.scr

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2015-04-23 16:47 . 2013-12-21 06:24 106912 ----a-w- c:\windows\system32\drivers\aswStm.sys

2015-04-23 16:47 . 2013-03-01 13:00 209048 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2015-04-23 16:47 . 2013-03-01 13:00 49904 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2015-04-23 16:47 . 2010-10-08 17:25 427992 ----a-w- c:\windows\system32\drivers\aswSP.sys

2015-04-23 16:47 . 2010-10-08 17:25 74976 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2015-04-23 16:47 . 2014-04-19 03:50 24144 ----a-w- c:\windows\system32\drivers\aswHwid.sys

2015-04-23 16:47 . 2012-02-24 07:31 81728 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

2015-04-23 16:47 . 2011-07-05 10:24 787760 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2015-04-15 09:51 . 2012-07-24 15:09 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2015-04-15 09:51 . 2011-06-05 07:57 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2015-03-25 03:00 . 2015-04-15 04:17 3088384 ----a-w- c:\windows\system32\wucltux.dll

2015-03-25 03:00 . 2015-04-15 04:17 92672 ----a-w- c:\windows\system32\wudriver.dll

2015-03-25 03:00 . 2015-04-15 04:17 566784 ----a-w- c:\windows\system32\wuapi.dll

2015-03-25 03:00 . 2015-04-15 04:17 35328 ----a-w- c:\windows\system32\wups2.dll

2015-03-25 03:00 . 2015-04-15 04:17 29696 ----a-w- c:\windows\system32\wups.dll

2015-03-25 03:00 . 2015-04-15 04:17 173056 ----a-w- c:\windows\system32\wuwebv.dll

2015-03-25 03:00 . 2015-04-15 04:17 2020864 ----a-w- c:\windows\system32\wuaueng.dll

2015-03-25 03:00 . 2015-04-15 04:17 50176 ----a-w- c:\windows\system32\WinSetupUI.dll

2015-03-25 03:00 . 2015-04-15 04:17 11776 ----a-w- c:\windows\system32\wu.upgrade.ps.dll

2015-03-25 03:00 . 2015-04-15 04:17 33792 ----a-w- c:\windows\system32\wuapp.exe

2015-03-25 03:00 . 2015-04-15 04:17 131584 ----a-w- c:\windows\system32\wuauclt.exe

2015-03-23 03:06 . 2015-04-15 04:17 576000 ----a-w- c:\windows\system32\generaltel.dll

2015-03-23 03:06 . 2015-04-15 04:17 630784 ----a-w- c:\windows\system32\invagent.dll

2015-03-23 03:06 . 2015-04-15 04:17 331264 ----a-w- c:\windows\system32\devinv.dll

2015-03-23 03:06 . 2015-04-15 04:17 860160 ----a-w- c:\windows\system32\appraiser.dll

2015-03-23 03:06 . 2015-04-15 04:17 26112 ----a-w- c:\windows\system32\acmigration.dll

2015-03-23 03:06 . 2015-04-15 04:17 159744 ----a-w- c:\windows\system32\aepic.dll

2015-03-23 03:06 . 2015-04-15 04:17 202752 ----a-w- c:\windows\system32\aepdu.dll

2015-03-23 02:59 . 2015-04-15 04:17 896000 ----a-w- c:\windows\system32\aeinv.dll

2015-03-10 03:08 . 2015-04-15 04:16 1237504 ----a-w- c:\windows\system32\msxml3.dll

2015-03-10 03:05 . 2015-04-15 04:16 2048 ----a-w- c:\windows\system32\msxml3r.dll

2015-03-05 04:06 . 2015-04-15 04:17 305152 ----a-w- c:\windows\system32\gdi32.dll

2015-03-04 04:16 . 2015-04-15 04:18 249784 ----a-w- c:\windows\system32\clfs.sys

2015-03-04 04:10 . 2015-04-15 04:18 58880 ----a-w- c:\windows\system32\clfsw32.dll

2015-03-04 04:10 . 2015-05-13 03:41 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2015-03-04 04:10 . 2015-05-13 03:41 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll

2015-03-04 04:06 . 2015-05-13 03:41 2560 ----a-w- c:\windows\apppatch\AcRes.dll

2015-02-25 03:03 . 2015-04-15 04:16 514560 ----a-w- c:\windows\system32\drivers\http.sys

2015-02-24 01:23 . 2010-10-08 17:01 246920 ------w- c:\windows\system32\MpSigStub.exe

2015-02-20 04:13 . 2015-03-11 14:49 26624 ----a-w- c:\windows\system32\lpk.dll

2015-02-20 04:13 . 2015-03-11 14:49 70656 ----a-w- c:\windows\system32\fontsub.dll

2015-02-20 04:13 . 2015-03-11 14:49 10240 ----a-w- c:\windows\system32\dciman32.dll

2015-02-20 04:13 . 2015-03-11 14:49 34304 ----a-w- c:\windows\system32\atmlib.dll

2015-02-20 03:09 . 2015-03-11 14:49 299008 ----a-w- c:\windows\system32\atmfd.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2015-04-23 16:47 645144 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2015-04-28 08:33 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2015-04-28 08:33 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]

2015-04-28 08:33 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2015-04-28 08:33 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2015-04-28 08:33 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2015-04-28 08:33 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-03-13 5529880]

"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]

"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2015-05-11 5515496]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

"SoftwareSASGeneration"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SetPoint.lnk]

backup=c:\windows\pss\SetPoint.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^smart security registration status.lnk]

backup=c:\windows\pss\smart security registration status.lnk.CommonStartup

backupExtension=.CommonStartup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CDWallpaperChanger

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirMessage

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2014-12-19 06:48 1022152 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]

2010-03-06 00:44 500208 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Akamai NetSession Interface]

2014-04-17 18:07 4672920 ----a-w- c:\users\o\AppData\Local\Akamai\netsession_win.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]

2007-10-11 19:49 163840 ----a-w- c:\program files\DellTPad\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2014-02-12 18:57 43848 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]

2010-03-13 12:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2010-04-01 09:16 357696 ----a-w- e:\daemon tools lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-05-08 13:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]

2008-07-22 15:33 150528 ----a-w- c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2014-02-21 01:54 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2011-06-16 04:55 6276408 ----a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeSyncProcess]

2012-01-20 19:03 719672 ----a-w- c:\program files\Microsoft Office\Office14\MSOSYNC.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2014-01-17 14:24 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\T-Mobile ModemListener]

2012-04-25 08:39 117624 ----a-w- c:\program files\T-Mobile\Connection Manager\Background\ModemListener.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]

2014-11-27 13:19 1385808 ----a-w- c:\users\o\AppData\Roaming\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2006-11-21 17:38 35328 ----a-w- c:\program files\Winamp\winampa.exe

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-04-14 1871160]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-04-14 1080120]

R2 Modem Device Helper;Modem Device Helper;c:\program files\T-Mobile\Connection Manager\BackgroundService\ServiceManager.exe [2012-04-25 51576]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2014-01-22 88576]

R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys [x]

R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-05-18 102912]

R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys [2011-08-05 105344]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-04-14 23256]

R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-04-14 51928]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2012-06-27 121064]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2012-06-27 12776]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2012-06-27 136808]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2012-06-27 114280]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2014-01-22 184192]

R3 ssudobex;SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudobex.sys [2012-09-20 181344]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-13 1343400]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S0 BMLoad;Bytemobile Boot Time Load Driver;c:\windows\system32\drivers\BMLoad.sys [2011-08-05 13184]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-09 691696]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-04-23 787760]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-04-23 427992]

S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2013-12-03 26248]

S1 RawDisk3;RawDisk3;c:\windows\system32\drivers\rawdsk3.sys [2014-08-12 28256]

S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-04-23 24144]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-04-23 74976]

S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-04-23 106912]

S2 CronService;Cron Service for Prey;c:\prey\platform\windows\cronsvc.exe [2013-05-08 23552]

S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]

S2 ezGOSvc;Easybits GO Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 20992]

S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files\Hp\Common\HPSupportSolutionsFrameworkService.exe [2014-07-07 72992]

S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\Alwil Software\Avast5\ng\vbox\VBoxAswDrv.sys [2015-04-23 220752]

S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe [2015-04-23 3207800]

S3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\DRIVERS\BthAvrcp.sys [2009-08-13 22528]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HPService REG_MULTI_SZ HPSLPSVC

utcsvc REG_MULTI_SZ DiagTrack

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezGOSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2015-05-14 12:16 988488 ----a-w- c:\program files\Google\Chrome\Application\42.0.2311.152\Installer\chrmstp.exe

Contents of the 'Scheduled Tasks' folder

2015-05-19 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-24 09:51]

2015-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-08 23:09]

2015-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-08 23:09]

------- Supplementary Scan -------

mSearch Bar = https://www.google.com/?trackid=sp-006

IE: &Експортиране към Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000

IE: &Изпрати към OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: E&xport to Microsoft Excel

TCP: DhcpNameServer = 10.122.133.1

FF - ProfilePath - c:\users\o\AppData\Roaming\Mozilla\Firefox\Profiles\wvwaemly.default\

FF - ExtSQL: !HIDDEN! 2012-01-09 11:11; [email protected]; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

- - - - ORPHANS REMOVED - - - -

Toolbar-10 - (no file)

MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

MSConfigStartUp-Facebook Update - c:\users\o\AppData\Local\Facebook\Update\FacebookUpdate.exe

MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe

AddRemove-MyFreeCodec - c:\program files\MyFree Codec\1.0b beta\uninstall.exe

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

Completion time: 2015-05-19 21:14:08

ComboFix-quarantined-files.txt 2015-05-19 18:14

Pre-Run: 9 428 889 600 bytes free

Post-Run: 9 395 716 096 bytes free

- - End Of File - - 68194E7855068393893D87D7CF9525C5

A36C5E4F47E84449FF07ED3517B43A31

19 май 201511 г.

Отворете notepad и с copy/paste въведете следната информация:
```
Folder::
c:\program files\MyFree Codec

JavaClearCache::
```
Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).
По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

20 май 201511 г.

Автор

Здравейте, изпълних указанията ви, но когато провлачвам документа в ComboFix, той не се ектрактва по начина показан на вашият коментар, а се появява едно + Open with ComboFix ... Instaler, след което се отваря инсталационният прозорец на програмата и съотвено натискам RUN. Сканирането си продължава и се генерира файл подобен на вчерашния, новото е, че има папка Qoobox а вътре са следните папки и файлове: Backenv, Quarantine, Add- remove programs, CFScripts, ComboFix2 -19.05, ComboFix- quarantined- files. Копирах файла, който се генерира след края на сканирането и го качвам, надявам се всичко да е правилно.

ComboFix 15-05-13.01 - o 05.2015 г. 9:33.2.2 - x86

Microsoft Windows 7 Professional 6.1.7601.1.1251.359.1033.18.2038.1144 [GMT 3:00]

Running from: c:\users\o\Desktop\ComboFix.exe

Command switches used :: c:\users\o\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

((((((((((((((((((((((((( Files Created from 2015-04-20 to 2015-05-20 )))))))))))))))))))))))))))))))

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\users\GuestUser\AppData\Local\temp

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\users\GuestUser.o-PC\AppData\Local\temp

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\users\GuestUser.o-PC.001\AppData\Local\temp

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\users\GuestUser.o-PC.000\AppData\Local\temp

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\users\Guest\AppData\Local\temp

2015-05-20 07:05 . 2015-05-20 07:05 -------- d-----w- c:\users\Default\AppData\Local\temp

2015-05-20 03:17 . 2015-05-03 03:42 9265072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{50031472-4AEA-48EC-801B-F3440C2121A7}\mpengine.dll

2015-05-19 03:42 . 2015-04-21 15:51 667648 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe