Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Странни exe - файлове

Seenoevil
в Премахване на зловреден софтуер

Featured Replies

Някакви странни прозорци ми излизат предполагам от windows-а на програми които дори в google ги няма. Та тези изскачащи прозорци пише че еди коя си програмка е спряла да работи забелязах че от както почнаха да ми изкачат подобни прозорци лаптопът почна да загрява до 70 градуса на ядро.Ето и снимка на подобен прозорец.

Имам диск на операционната система.

Лог фаил :

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-05-2015 02

Ran by kalin (administrator) on KALIN-PC on 19-05-2015 19:40:20
Running from C:\Users\kalin\Downloads
Loaded Profiles: kalin (Available profiles: kalin)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Connectify) C:\Program Files (x86)\Connectify\ConnectifyService.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Connectify) C:\Program Files (x86)\Connectify\Connectify.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe
() C:\Users\kalin\AppData\Roaming\AceWebExtension\updater\ace_web_extension.exe
() C:\Users\kalin\AppData\Roaming\WinBatch\msdn.exe
(Connectify) C:\Program Files (x86)\Connectify\Connectifyd.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Skype Technologies S.A.) C:\Users\kalin\Desktop\skype38i_patched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2611112 2012-09-04] ()
HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12558440 2011-07-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-03] (Realtek Semiconductor)
HKLM\...\Run: [Connectify Hotspot] => C:\Program Files (x86)\Connectify\Connectify.exe [4155640 2015-01-29] (Connectify)
HKLM-x32\...\Run: [NBKeyScan] => C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-06-08] (Nero AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe [691656 2009-04-23] (DT Soft Ltd)
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2008-06-24] (Nero AG)
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [AceWebExtensionUpdater] => C:\Users\kalin\AppData\Roaming\AceWebExtension\updater\ace_web_extension.exe [22824 2015-02-28] ()
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [steam] => C:\Program Files (x86)\Steam\steam.exe [2889408 2015-04-14] (Valve Corporation)
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [Viber] => C:\Users\kalin\AppData\Local\Viber\Viber.exe [776400 2015-02-25] ()
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [Keyboard Inf.] => C:\Users\kalin\AppData\Roaming\WinBatch\msdn.exe [4538880 2015-05-10] ()
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\MountPoints2: {39bb7130-a8b2-11e4-8889-e840f25cb86c} - G:\autorun.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-05-21] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2014-05-14] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2014-05-21] (Microsoft Corporation)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO-x32: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2013-10-05] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2014-05-14] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-04-01] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 213.91.136.1
 
FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-01-21] (Microsoft Corporation)
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://zamunda.net/
CHR StartupUrls: Default -> "hxxp://zamunda.net/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-30]
CHR Extension: (Google Docs) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-30]
CHR Extension: (Google Drive) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-30]
CHR Extension: (YouTube) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-30]
CHR Extension: (Google Search) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-30]
CHR Extension: (Video Downloader professional) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2015-05-12]
CHR Extension: (Google Sheets) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-30]
CHR Extension: (AdBlock) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-30]
CHR Extension: (Bookmark Manager) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (No Name) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2015-03-01]
CHR Extension: (Grass) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmiboiefncpfjihjdedpaoammipkilla [2015-04-05]
CHR Extension: (Google Wallet) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-30]
CHR Extension: (Gmail) - C:\Users\kalin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-30]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [15768 2010-02-03] (Microsoft Corporation)
R2 Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [217088 2015-01-29] (Connectify) [File not signed]
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2013-08-22] (Microsoft Corporation) [File not signed]
R2 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-06-08] (Nero AG)
R3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-06-24] (Nero AG)
R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [File not signed]
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87728 2013-10-05] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 bpenum; C:\Windows\System32\DRIVERS\bpenum.sys [84480 2012-07-03] (Intel Corporation) [File not signed]
R1 cnnctfy3; C:\Windows\System32\DRIVERS\cnnctfy3.sys [42152 2015-02-04] (Connectify)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2015-01-30] () [File not signed]
R3 VCSVADHWSer; C:\Windows\System32\DRIVERS\vcsvad.sys [21504 2008-12-26] (Avnex)
U3 ay7ovwhi; C:\Windows\System32\Drivers\ay7ovwhi.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WacHidRouter; system32\DRIVERS\wachidrouter.sys [X]
S3 wacomrouterfilter; system32\DRIVERS\wacomrouterfilter.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-05-19 19:40 - 2015-05-19 19:40 - 00014951 _____ () C:\Users\kalin\Downloads\FRST.txt
2015-05-19 19:40 - 2015-05-19 19:40 - 00000000 ____D () C:\FRST
2015-05-19 19:27 - 2015-05-19 19:27 - 02107392 _____ (Farbar) C:\Users\kalin\Downloads\FRST64.exe
2015-05-19 12:33 - 2015-05-19 12:33 - 00202953 _____ () C:\Users\kalin\Downloads\Sniper Elite & Nazi Zombie Army Franchise Pack.torrent
2015-05-19 10:10 - 2015-05-19 18:27 - 00003758 _____ () C:\Windows\System32\Tasks\AutoKMS
2015-05-18 20:33 - 2015-05-18 20:33 - 00109454 _____ () C:\Users\kalin\Downloads\6. Advanced-CSharp-Streams-And-Files-Exercises.zip
2015-05-18 18:56 - 2015-05-18 18:56 - 00012033 _____ () C:\Users\kalin\Downloads\Advanced-CSharp-Course-Program-May-2015 (1).xlsx
2015-05-18 13:19 - 2015-05-18 13:19 - 00073265 _____ () C:\Users\kalin\Downloads\GoT_05x06.(subs.sab.bz).rar
2015-05-18 13:18 - 2015-05-18 13:18 - 00011073 _____ () C:\Users\kalin\Downloads\Game.of.Thrones.S05E06.720p.HDTV.x264-IMMERSE.mkv.torrent
2015-05-18 11:27 - 2015-05-18 11:27 - 00098597 _____ () C:\Users\kalin\Downloads\sentinel (1).zip
2015-05-18 01:02 - 2015-05-18 01:02 - 00000000 ____D () C:\Users\kalin\Tracing
2015-05-16 13:40 - 2015-05-16 14:04 - 00000000 ____D () C:\Users\kalin\Desktop\New folder
2015-05-16 01:42 - 2015-05-16 01:42 - 00022019 _____ () C:\Users\kalin\Downloads\Heroes.S01.DVDRip.XviD.BGAUDiO-SiSO.torrent
2015-05-13 01:12 - 2015-05-18 18:43 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2015-05-13 01:12 - 2015-05-13 01:12 - 00001011 _____ () C:\Users\kalin\Desktop\SpeedFan.lnk
2015-05-13 01:12 - 2015-05-13 01:12 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2015-05-13 01:11 - 2015-05-13 01:11 - 00000919 _____ () C:\Users\kalin\Downloads\installspeedfan448.exe.torrent
2015-05-11 11:31 - 2015-05-11 11:31 - 00053035 _____ () C:\Users\kalin\Downloads\Game of Thrones - 05x05 - Kill the Boy.ASAP.colored.English.HI.C.orig.Addic7ed.com.srt
2015-05-11 11:31 - 2015-05-11 11:31 - 00047735 _____ () C:\Users\kalin\Downloads\Game of Thrones - 05x05 - Kill the Boy.INTERNAL.BATV.English.HI.C.orig.Addic7ed.com.srt
2015-05-11 11:30 - 2015-05-11 11:30 - 00050031 _____ () C:\Users\kalin\Downloads\Game of Thrones - 05x05 - Kill the Boy.ASAP.English.HI.C.orig.Addic7ed.com.srt
2015-05-11 11:19 - 2015-05-11 11:19 - 00012030 _____ () C:\Users\kalin\Downloads\game.of.thrones.s05e05.720p.hdtv.x264-0sec.mkv.torrent
2015-05-11 11:00 - 2015-05-11 11:00 - 00017840 _____ () C:\Users\kalin\Downloads\Pro Evolution Soccer 2015-RePack.iso.torrent
2015-05-10 12:32 - 2015-05-10 14:06 - 00000000 ____D () C:\Users\kalin\AppData\OICE_15_974FA576_32C1D314_F4D
2015-05-10 01:52 - 2015-05-10 02:05 - 00000000 ____D () C:\Users\kalin\Documents\GTA San Andreas User Files
2015-05-08 18:40 - 2015-05-08 18:49 - 00001439 _____ () C:\Users\kalin\Downloads\02. Instruction Set_Грешно решение.cs
2015-05-05 10:35 - 2015-05-05 10:35 - 00011194 _____ () C:\Users\kalin\Downloads\Match.Of.The.Day.Two.2015.05.03.HDTV.XviD-AFG.torrent
2015-04-30 21:05 - 2015-04-30 21:05 - 00011970 _____ () C:\Users\kalin\Downloads\Advanced-CSharp-Course-Program-May-2015.xlsx
2015-04-29 10:34 - 2015-04-29 10:35 - 20257008 _____ () C:\Users\kalin\Downloads\upd-ps-x64-6.0.0.18849.exe
2015-04-28 19:38 - 2015-04-28 19:38 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wacomrouterfilter_01009.Wdf
2015-04-28 19:38 - 2015-04-28 19:38 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wachidrouter_01009.Wdf
2015-04-28 19:38 - 2014-10-25 23:52 - 00014136 _____ (Windows ® Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys
2015-04-28 19:38 - 2012-12-12 01:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll
2015-04-27 22:45 - 2015-04-27 22:45 - 00043006 _____ () C:\Users\kalin\Downloads\GoT.s01e01.(subs.sab.bz).rar
2015-04-27 22:17 - 2015-04-27 22:17 - 00040595 _____ () C:\Users\kalin\Downloads\The Last Man On Earth - 01x12 - The Tandyman Can.LOL.English.HI.C.orig.Addic7ed.com.srt
2015-04-27 22:05 - 2015-04-27 22:05 - 00081077 _____ () C:\Users\kalin\Downloads\[kickass.to]the.last.man.on.earth.s01e12.720p.hdtv.x264.dimension.rartv.torrent
2015-04-27 21:36 - 2015-04-27 21:36 - 00044536 _____ () C:\Users\kalin\Downloads\[ArenaBG.com]-Game.of.Thrones.S01E01.HDTV.XviD-FEVER.torrent
2015-04-25 17:30 - 2015-04-25 17:30 - 00030231 _____ () C:\Users\kalin\Downloads\FF6.(subs.sab.bz).rar
2015-04-25 17:30 - 2015-04-25 17:30 - 00018514 _____ () C:\Users\kalin\Downloads\Fast.And.Furious.6.2013.EXTENDED.480p.BDRip.XviD.AC3-KiNGS.torrent
2015-04-24 02:00 - 2015-04-24 02:00 - 00011054 _____ () C:\Users\kalin\Downloads\Aly & Fila – Future Sound Of Egypt 388 (20-APR-2015) - SMG.torrent
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-05-19 19:28 - 2015-01-30 19:11 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-19 19:26 - 2015-01-30 21:47 - 00000000 ____D () C:\Users\kalin\AppData\Roaming\Skype
2015-05-19 19:05 - 2015-01-31 02:56 - 01760258 _____ () C:\Windows\WindowsUpdate.log
2015-05-19 18:32 - 2009-07-14 07:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-19 18:32 - 2009-07-14 07:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-19 18:26 - 2015-04-06 19:51 - 00000000 ____D () C:\Users\kalin\AppData\Roaming\ViberPC
2015-05-19 18:26 - 2015-04-06 19:51 - 00000000 ____D () C:\Users\kalin\AppData\Local\Viber
2015-05-19 18:26 - 2015-03-27 18:22 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-19 18:26 - 2015-01-30 19:11 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-19 18:26 - 2009-07-14 08:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-19 18:26 - 2009-07-14 07:51 - 00070988 _____ () C:\Windows\setupact.log
2015-05-19 15:49 - 2015-01-30 19:26 - 00000000 ____D () C:\Users\kalin\AppData\Roaming\BitComet
2015-05-19 15:39 - 2015-03-03 16:31 - 00004958 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for kalin-PC-kalin kalin-PC
2015-05-19 15:17 - 2015-01-30 19:35 - 00000000 ____D () C:\Users\kalin\AppData\Roaming\vlc
2015-05-18 20:37 - 2015-01-31 18:06 - 00000000 ____D () C:\Users\kalin\Documents\Visual Studio 2013
2015-05-18 01:02 - 2015-01-31 23:39 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-05-18 01:02 - 2015-01-31 23:39 - 00000000 ____D () C:\ProgramData\Skype
2015-05-18 01:02 - 2015-01-30 17:00 - 00000000 ____D () C:\Users\kalin
2015-05-17 10:23 - 2015-01-30 19:11 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-17 10:23 - 2015-01-30 19:11 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-15 18:51 - 2009-07-14 08:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-15 18:45 - 2015-03-29 09:12 - 00000000 ____D () C:\Users\kalin\Desktop\sentinel
2015-05-15 18:17 - 2015-01-31 20:06 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 11:22 - 2015-01-30 19:11 - 00002181 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-13 01:08 - 2015-02-01 23:22 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2015-05-12 10:31 - 2009-07-14 08:08 - 00032648 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-10 01:52 - 2015-03-05 13:47 - 00000000 ____D () C:\Users\kalin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-05-10 00:47 - 2015-01-30 17:12 - 00000000 ____D () C:\Users\kalin\AppData\Roaming\WinBatch
2015-04-28 20:11 - 2010-11-21 06:47 - 00187818 _____ () C:\Windows\PFRO.log
2015-04-22 18:47 - 2015-04-09 19:49 - 00000000 ____D () C:\Program Files (x86)\ AV Vcs 7.0 DIAMOND
 
Some content of TEMP:
====================
C:\Users\kalin\AppData\Local\Temp\GLF262F.tmp.dll
C:\Users\kalin\AppData\Local\Temp\Install.exe
C:\Users\kalin\AppData\Local\Temp\ose00000.exe
C:\Users\kalin\AppData\Local\Temp\Setup-Wacom.exe
C:\Users\kalin\AppData\Local\Temp\sfamcc00001.dll
C:\Users\kalin\AppData\Local\Temp\sfextra.dll
C:\Users\kalin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\kalin\AppData\Local\Temp\sp-downloader.exe
C:\Users\kalin\AppData\Local\Temp\Uninstall.exe
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-05-15 01:05
 
==================== End Of Log ============================

 

Addition.txt

Здравейте,

 

Имате си BitcoinMiner. Ще го премахнем.

 

 

СТЪПКА 1

 

 

Деинсталирайте следнata програмa от Control Panel-a:

 

DAEMON Tools Toolbar

 

 

СТЪПКА 2

 

Изтеглете KKdS6sj.pngfixlist.txt и го запазете в папката от която стартирахте FRST.exe.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

Пишете след това как е положението. :)

 

 

  • Автор

Много благодаря за ИЗКЛЮЧИТЕЛНО бързия отговор. Дано всичко вече да е наред защото много прегряваше процесора ето и лог фаила.

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-05-2015 02

Ran by kalin at 2015-05-19 20:42:13 Run:1
Running from C:\Users\kalin\Downloads
Loaded Profiles: kalin (Available profiles: kalin)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\...\Run: [Keyboard Inf.] => C:\Users\kalin\AppData\Roaming\WinBatch\msdn.exe [4538880 2015-05-10] ()
C:\Users\kalin\AppData\Roaming\WinBatch\msdn.exe
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trovi.com...SP22220TB_sp_ie
SearchScopes: HKU\S-1-5-21-2578847175-3493397444-3687562262-1000 -> DefaultScope {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com...SP22220TB_sp_ie
SearchScopes: HKU\S-1-5-21-2578847175-3493397444-3687562262-1000 -> {015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com...SP22220TB_sp_ie
C:\Users\kalin\AppData\Local\Temp
EmptyTemp:
reboot:
end
*****************
 
Restore point was successfully created.
Processes closed successfully.
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Keyboard Inf. => value deleted successfully.
C:\Users\kalin\AppData\Roaming\WinBatch\msdn.exe => Moved successfully.
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-2578847175-3493397444-3687562262-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}" => Key deleted successfully.
HKCR\CLSID\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} => Key not found. 
 
"C:\Users\kalin\AppData\Local\Temp" directory move:
 
Could not move "C:\Users\kalin\AppData\Local\Temp" directory. => Scheduled to move on reboot.
 
EmptyTemp: => Removed 4.7 GB temporary data.
 
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-05-19 20:45:33)<=
 
C:\Users\kalin\AppData\Local\Temp => Moved successfully.
 
==== End of Fixlog 20:45:33 ====

Как е сега положението? Нека да проверим за остатъци:

 

 

СТЪПКА 1

 

 

Моля изтеглете Malwarebytes Anti-Malware 2.1.6.1022 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-2.1.6.1022.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.
  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

СТЪПКА 2

 

 

1.Изтеглете Hitman Pro.
За 32-битова система - dEMD6.gif.
За 64-битова система - Download-button3.gif


2.Стартирайте програмата.

3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 
6-scanfin-choose.jpg
 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

 

 

Поздрави!

  • Автор

Доста стъпки за сега е добре лаптопа, утре ще направя проверката че стана късно.Мерси отново за бързите отговори.

  • 2 седмици по-късно...

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.