Самоинсталиращи се програми, които не се премахват

21 август 201511 г.

Здравейте, не съм много на "Ти" с компютрите и днес успях да направя голяма беля. Изтеглих книга (поне така си мислех), която незнайно защо беше в .exe формат. Стартирах файла и започнаха да се инсталират няколко програми една след друга. Успях да деинсталирам някои от тях, но други останаха. Антивирусната също ги засича, но неуспява да ги премахне. Моля за малко помощ и благодаря!

Addition.txt

FRST.txt

21 август 201511 г.

Здравейте!

Като за начало, изпълнете този скрипт:

Изтеглете fixlist.txt и го запазете в папката от която стартирахте FRST.exe.

Стартирайте FRST.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

fixlist.txt

21 август 201511 г.

Автор

Здравейте, междувременно успях да деинсталирам още една от тези програми, мисля, че остана само една. Направих още веднъж сканиране, но излиза само един файл - FRST.

FRST 1.txt

21 август 201511 г.

Автор

Здравейте, междувременно успях да деинсталирам още една от лепкавите програми и мисля, че остана само една, която много прилича на антивирусна. Стартирах FRST отново и това е файла.

FRST 1.txt

21 август 201511 г.

Автор

Незнам дали е нужен файла или направо да изпълня посочените от вас стъпки?Мисля, че деинсталирах вече всички нежелани програми. Да направя ли отново сканиране?

Редактирано 21 август 201511 г. от Sneji_B (преглед на промените)

23 август 201511 г.

Ако желаете да работим заедно е необходимо да следвате моите инструкции. В случая аз не знам какво сте правили по машината и прочие. Решението е напълно ваше.

23 август 201511 г.

Автор

Здравейте!

Това, което направих е, че успях да деинсталирам въпросните програми, те бяха 5 или 6 някой от тях с интерфейс на китайски. В момента Касперски и Malwarebytes Anti-Malware намират злонамерен софтуер и аз незнам как да го изчистя. След направените от мен промени, актуални ли са посочените от Вас по-горе стъпки или трябва да Ви предоставя някаква информация и да изчакам отговорът Ви?

23 август 201511 г.

Изтрийте FRST.exe и логовете към нея. След това изтеглете този инструмент отново и генерирайте нови лог файлове, които да публикувате тук. След това следвайте само моите инструкции. Ако решите да действате по ваше усмотрение, моля да ме уведомите, защото тогава няма как да работим съвместно.

23 август 201511 г.

Автор

Разбрах грешката си и няма да се повтори.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:23-08-2015

Ran by user (administrator) on USER-PC (23-08-2015 17:46:25)

Running from C:\Users\user\Downloads\FRST

Loaded Profiles: user (Available Profiles: user)

Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Английски (Съединени щати)

Internet Explorer Version 11 (Default browser: Opera)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\avp.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Firebird Project) C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe

() C:\Program Files\igfx32\igfx32.exe

(XTab system) C:\Program Files\MiniLite\ProtectService.exe

() C:\Program Files\4C4C4544-1440146753-5710-804D-B5C04F4B344A\hnskCB49.tmp

(Google Inc.) C:\Program Files\Google\Update\1.3.28.1\GoogleCrashHandler.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

() C:\Users\user\AppData\Local\Subelectrics.exe

(Rosetta Stone Ltd.) C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe

(Firebird Project) C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\avpui.exe

(Opera Software) C:\Program Files\Opera\31.0.1889.174_0\opera.exe

(Opera Software) C:\Program Files\Opera\31.0.1889.174_0\opera_crashreporter.exe

(Opera Software) C:\Program Files\Opera\31.0.1889.174_0\opera.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2010-09-23] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-09-21] (Adobe Systems Incorporated)

HKLM\...\Run: [bCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKU\S-1-5-21-2224806993-1213079895-3238273190-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)

HKU\S-1-5-21-2224806993-1213079895-3238273190-1000\...\Run: [apphide] => C:\Program Files\baidu\pps.exe

HKU\S-1-5-21-2224806993-1213079895-3238273190-1000\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [53729824 2015-08-07] (Skype Technologies S.A.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

HKU\S-1-5-21-2224806993-1213079895-3238273190-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=dspp&ts=1424900084&from=kmp&uid=WDCXWD6400AAKS-65A7B0_WD-WMASY177346573465&q={searchTerms}

HKU\S-1-5-21-2224806993-1213079895-3238273190-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=dspp&ts=1424900084&from=kmp&uid=WDCXWD6400AAKS-65A7B0_WD-WMASY177346573465&q={searchTerms}

SearchScopes: HKU\S-1-5-21-2224806993-1213079895-3238273190-1000 -> DefaultScope {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2224806993-1213079895-3238273190-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2224806993-1213079895-3238273190-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxps://www.google.com/search?q={searchTerms}

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22] (Adobe Systems Incorporated)

BHO: У¦УГ±¦Т»јь°ІЧ°Іејю -> {50F4150A-48B2-417A-BE4C-C83F580FB904} -> C:\Program Files\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)

BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation)

BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\OnlineBanking\online_banking_bho.dll No File

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)

BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation)

Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)

Toolbar: HKU\S-1-5-21-2224806993-1213079895-3238273190-1000 -> Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0

Tcpip\..\Interfaces\{2DC80576-CEF8-4FA6-8457-D515F67C0FD7}: [NameServer] 208.67.222.222,8.8.4.4

Tcpip\..\Interfaces\{2DC80576-CEF8-4FA6-8457-D515F67C0FD7}: [DhcpNameServer] 192.168.1.1 0.0.0.0

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://istart.webssearches.com/?type=sc&ts=1424900022&from=kmp&uid=WDCXWD6400AAKS-65A7B0_WD-WMASY177346573465

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll [2015-02-25] ()

FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [No File]

FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin: @qq.com/npAndroidAssistant -> C:\Program Files\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [2014-05-30] (腾讯公司)

FF Plugin: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [No File]

FF Plugin: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [No File]

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-08-22] (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-08-22] (Google Inc.)

FF Plugin HKU\S-1-5-21-2224806993-1213079895-3238273190-1000: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll No File

FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\FFExt\light_plugin_firefox

FF Extension: Kaspersky Protection - C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\FFExt\light_plugin_firefox [2015-08-21]

Chrome:

=======

CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-08-22]

CHR Extension: (Google Docs) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-08-22]

CHR Extension: (Google Drive) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-08-22]

CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-08-22]

CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-08-22]

CHR Extension: (Kaspersky Protection) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahebamiopdhefndnmappcihfajigkka [2015-08-22]

CHR Extension: (Google Sheets) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-08-22]

CHR Extension: (Skype Click to Call) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-08-22]

CHR Extension: (Chrome Web Store Payments) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-22]

CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-22]

CHR HKLM\...\Chrome\Extension: [dnligehkhogpcngalffdoomehjcbecna] - https://clients2.google.com/service/update2/crx

CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - https://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka

CHR HKLM\...\Chrome\Extension: [gehmndecgbcffhmfjkenpamdgechcgpe] - https://clients2.google.com/service/update2/crx

CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP16.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Total Security 16.0.0\avp.exe [194000 2015-08-21] (Kaspersky Lab ZAO)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)

R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe [98304 2010-09-17] (Firebird Project) [File not signed]

R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe [3735552 2010-09-17] (Firebird Project) [File not signed]

R2 igfx32; C:\Program Files\igfx32\igfx32.exe [379904 2015-08-19] () [File not signed] <==== ATTENTION

R2 IHProtect Service; C:\Program Files\MiniLite\ProtectService.exe [129688 2015-08-20] (XTab system)

R2 kefowydy; C:\Program Files\4C4C4544-1440146753-5710-804D-B5C04F4B344A\hnskCB49.tmp [137728 2015-08-21] () [File not signed]

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

R2 pcoductprocompyoduct; C:\Users\user\AppData\Local\Subelectrics.exe [47616 2015-08-21] () [File not signed]

R2 RosettaStoneDaemon; C:\Program Files\RosettaStoneLtdServices\RosettaStoneDaemon.exe [1646608 2012-06-19] (Rosetta Stone Ltd.)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2014-03-12] (Microsoft Corporation)

S2 ExtTag; C:\ProgramData\ExtTag\ExtTag.exe [X]

S2 globalUpdate; C:\Program Files\globalUpdate\Update\globalupdate.exe /svc [X] <==== ATTENTION

S3 globalUpdatem; C:\Program Files\globalUpdate\Update\globalupdate.exe /medsvc [X] <==== ATTENTION

S2 hyverumu; C:\Program Files\4C4C4544-1440146753-5710-804D-B5C04F4B344A\jnsvB326.tmp [X]

S2 tykulixo; C:\Program Files\4C4C4544-1440146753-5710-804D-B5C04F4B344A\knsa98BD.tmpfs [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [201912 2015-07-06] (Kaspersky Lab ZAO)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2015-02-25] (DT Soft Ltd)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [153784 2015-06-22] (Kaspersky Lab ZAO)

R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [46776 2015-06-06] (Kaspersky Lab ZAO)

R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [58224 2015-06-27] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [58040 2015-06-06] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [136888 2015-06-30] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [44728 2015-07-04] (AO Kaspersky Lab)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [773304 2015-06-30] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [33976 2015-06-11] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [37048 2015-06-06] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [38072 2015-06-07] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [28344 2015-06-08] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54328 2015-06-11] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [87736 2015-06-16] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [156856 2015-06-23] (Kaspersky Lab ZAO)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [98520 2015-08-23] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)

S3 TSSK; C:\Windows\System32\tssk.sys [67896 2015-08-21] (电脑管家)

S3 cpuz134; \??\C:\Users\user\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]

U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

S1 QMUdisk; \??\C:\Program Files\Tencent\QQPCMgr\10.11.16588.235\QMUdisk.sys [X]

S3 TS888; \??\C:\Program Files\Tencent\QQPCMgr\10.11.16588.235\TS888.sys [X]

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-23 17:38 - 2015-08-23 17:46 - 00000000 ____D C:\Users\user\Downloads\FRST

2015-08-22 16:17 - 2015-08-22 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

2015-08-22 16:16 - 2015-08-23 17:21 - 00000982 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-08-22 16:16 - 2015-08-23 16:21 - 00000978 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-08-22 16:15 - 2015-08-22 16:15 - 00931408 _____ (Google Inc.) C:\Users\user\Downloads\ChromeSetup.exe

2015-08-22 16:14 - 2015-08-22 16:14 - 00001097 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2015-08-22 16:13 - 2015-08-22 16:13 - 00703624 _____ (Opera Software) C:\Users\user\Downloads\Opera_NI_stable (1).exe

2015-08-22 16:11 - 2015-08-22 16:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2015-08-22 16:11 - 2015-08-22 16:11 - 00000000 ____D C:\Program Files\Common Files\Skype

2015-08-22 16:10 - 2015-08-22 16:10 - 01385504 _____ (Skype Technologies S.A.) C:\Users\user\Downloads\SkypeSetup (1).exe

2015-08-22 15:21 - 2015-08-22 15:21 - 00000000 ____D C:\ProgramData\ExtTag

2015-08-21 21:28 - 2015-08-21 22:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

2015-08-21 20:59 - 2015-08-21 22:04 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件

2015-08-21 16:32 - 2015-08-21 17:08 - 00000497 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website

2015-08-21 15:27 - 2015-08-23 17:46 - 00000000 ____D C:\FRST

2015-08-21 15:13 - 2015-08-21 15:13 - 00063323 _____ C:\malware.txt

2015-08-21 15:01 - 2015-08-23 12:31 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-08-21 14:59 - 2015-08-21 14:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-08-21 14:59 - 2015-08-21 14:59 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-08-21 14:59 - 2015-08-21 14:59 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware

2015-08-21 14:59 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-08-21 14:59 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-08-21 14:59 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-08-21 14:48 - 2015-08-21 14:49 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\user\Downloads\mbam-setup-2.1.8.1057.exe

2015-08-21 14:25 - 2015-08-21 14:25 - 00000000 ____D C:\Windows\system32\appmgmt

2015-08-21 14:00 - 2015-08-21 14:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Total Security

2015-08-21 13:59 - 2015-08-23 16:11 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-08-21 13:59 - 2015-08-21 13:59 - 00000000 ____D C:\Windows\ELAMBKUP

2015-08-21 13:59 - 2015-08-21 13:59 - 00000000 ____D C:\Program Files\Kaspersky Lab

2015-08-21 13:59 - 2015-07-04 02:18 - 00044728 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys

2015-08-21 13:59 - 2015-06-30 01:05 - 00773304 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys

2015-08-21 13:59 - 2015-06-30 01:05 - 00136888 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys

2015-08-21 13:48 - 2015-08-21 17:38 - 00030392 _____ (Tencent) C:\Windows\system32\Drivers\TS888.sys

2015-08-21 13:19 - 2015-08-21 17:52 - 00000064 _____ C:\Windows\QMNetworkMgr.ini

2015-08-21 13:11 - 2015-08-21 21:25 - 00000000 ____D C:\QMDownload

2015-08-21 13:02 - 2015-08-21 13:02 - 00000000 ____D C:\Users\user\AppData\Roaming\ppslog

2015-08-21 13:02 - 2015-08-21 13:02 - 00000000 ____D C:\Users\user\.android

2015-08-21 12:55 - 2015-08-21 12:55 - 00000000 ____D C:\ProgramData\TXQMPC

2015-08-21 12:53 - 2015-08-21 21:08 - 00000000 ____D C:\Users\user\AppData\Roaming\Tencent

2015-08-21 12:53 - 2015-08-21 20:59 - 00000000 ____D C:\Program Files\Common Files\Tencent

2015-08-21 12:53 - 2015-08-21 12:55 - 00000000 ____D C:\ProgramData\Tencent

2015-08-21 12:53 - 2015-08-21 12:53 - 00067896 _____ (电脑管家) C:\Windows\system32\TSSK.sys

2015-08-21 12:53 - 2015-08-21 12:53 - 00000000 ____D C:\Program Files\Tencent

2015-08-21 12:52 - 2015-08-21 13:47 - 00000366 _____ C:\Windows\Tasks\APSnotifierPP1.job

2015-08-21 12:52 - 2015-08-21 13:47 - 00000364 _____ C:\Windows\Tasks\APSnotifierPP3.job

2015-08-21 12:52 - 2015-08-21 13:47 - 00000364 _____ C:\Windows\Tasks\APSnotifierPP2.job

2015-08-21 12:51 - 2015-08-21 12:51 - 00000000 ____D C:\Windows\system32\Flash

2015-08-21 12:50 - 2015-08-21 12:50 - 00613255 _____ (CMI Limited) C:\Users\user\AppData\Local\nszB6C5.tmp

2015-08-21 12:50 - 2015-08-21 12:50 - 00000000 __SHD C:\Users\user\AppData\Roaming\AnyProtectEx

2015-08-21 12:49 - 2015-07-02 14:14 - 00018200 _____ () C:\Windows\system32\roboot.exe

2015-08-21 12:48 - 2015-08-21 13:09 - 00000000 ____D C:\Users\user\AppData\Roaming\systweak

2015-08-21 12:47 - 2015-08-21 12:47 - 01732208 _____ (Kaspersky Lab) C:\Users\user\Downloads\kts16.0.0.614en_8207.exe

2015-08-21 12:20 - 2015-08-23 12:20 - 00000990 _____ C:\Windows\Tasks\5UQtIkbPTkE.job

2015-08-21 12:20 - 2015-08-21 12:20 - 00000000 ____D C:\Users\user\AppData\Local\SysassistByHotWheel

2015-08-21 12:19 - 2015-08-21 13:51 - 00000000 ____D C:\Program Files\78e22e6c-867a-4197-926e-bd9c802e0473

2015-08-21 12:19 - 2015-08-21 13:42 - 00000000 ____D C:\Users\user\AppData\Local\Unity

2015-08-21 12:19 - 2015-08-21 13:28 - 00000000 ____D C:\Users\user\AppData\Roaming\IQIYI Video

2015-08-21 12:19 - 2015-08-21 13:28 - 00000000 ____D C:\ProgramData\IQIYI Video

2015-08-21 12:19 - 2015-08-21 13:28 - 00000000 ____D C:\IQIYI Video

2015-08-21 12:19 - 2015-08-21 12:19 - 00000000 ____D C:\Users\Public\QiYi

2015-08-21 12:17 - 2015-08-23 17:37 - 00000000 ____D C:\ProgramData\update

2015-08-21 12:17 - 2015-08-21 13:07 - 00000000 ____D C:\ProgramData\QWinManProQ

2015-08-21 12:17 - 2015-08-21 13:02 - 00000000 ____D C:\Program Files\baidu

2015-08-21 12:17 - 2015-08-21 12:17 - 00000217 _____ C:\task.vbs

2015-08-21 12:17 - 2015-08-21 12:17 - 00000000 ____D C:\Program Files\MiniLite

2015-08-21 12:17 - 2015-08-21 12:17 - 00000000 _____ C:\Windows\prleth.sys

2015-08-21 12:17 - 2015-08-21 12:17 - 00000000 _____ C:\Windows\hgfs.sys

2015-08-21 11:51 - 2015-08-21 12:54 - 00000148 _____ C:\Windows\Reimage.ini

2015-08-21 11:47 - 2015-08-23 11:47 - 00000984 _____ C:\Windows\Tasks\3QfIPPiT.job

2015-08-21 11:46 - 2015-08-23 12:54 - 00000924 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job

2015-08-21 11:46 - 2015-08-23 12:54 - 00000920 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

2015-08-21 11:46 - 2015-08-21 14:41 - 00000000 ____D C:\Users\user\AppData\Local\4C4C4544-1440157596-5710-804D-B5C04F4B344A

2015-08-21 11:46 - 2015-08-21 12:49 - 00000004 _____ C:\Windows\system32\029B560A371F4E00AB32838EBC01B9E7

2015-08-21 11:46 - 2015-08-21 11:46 - 00000000 ____D C:\Users\user\AppData\Local\globalUpdate

2015-08-21 11:46 - 2015-08-21 11:46 - 00000000 ____D C:\Program Files\globalUpdate

2015-08-21 11:46 - 2009-06-11 00:39 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak

2015-08-21 11:45 - 2015-08-21 22:05 - 00000000 ____D C:\Program Files\4C4C4544-1440146753-5710-804D-B5C04F4B344A

2015-08-21 11:45 - 2015-08-21 13:45 - 00000000 ____D C:\Program Files\igfx32

2015-08-21 11:45 - 2015-08-21 11:49 - 00000000 ____D C:\ProgramData\CismaUva

2015-08-21 11:45 - 2015-08-21 11:45 - 00047616 _____ C:\Users\user\AppData\Local\Subelectrics.exe

2015-08-21 11:45 - 2015-08-21 11:45 - 00000187 _____ C:\Users\user\AppData\Local\Subelectrics.exe.config

2015-08-20 12:53 - 2015-08-20 12:53 - 00018296 _____ C:\Users\user\Downloads\Beauty.and.the.Beast.2012.S03E11.HDTV.x264-KILLERS.torrent

2015-08-14 14:17 - 2015-08-14 23:28 - 00013003 _____ C:\Users\user\Documents\уМНОЖЕНИЕ.xlsx

2015-08-14 11:08 - 2015-08-14 11:08 - 00335360 _____ C:\Users\user\Downloads\uroc2_corel.ppt

2015-08-12 12:13 - 2015-08-12 12:13 - 00007168 _____ C:\Users\user\Downloads\Billing_Information.xls

2015-08-12 00:33 - 2015-08-12 00:34 - 00000000 ____D C:\Users\user\Downloads\relaxa fr

2015-08-11 23:40 - 2015-08-11 23:40 - 00011319 _____ C:\Users\user\Downloads\Relaxa - french 2.torrent

2015-08-11 23:39 - 2015-08-11 23:39 - 00011357 _____ C:\Users\user\Downloads\Relaxa - french.torrent

2015-08-03 02:19 - 2015-08-02 15:44 - 00000000 ____D C:\Windows\Panther

2015-08-02 15:46 - 2015-08-02 15:46 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf

2015-08-02 15:44 - 2015-08-21 16:59 - 00001417 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-08-02 15:44 - 2015-08-02 15:44 - 00000020 ___SH C:\Users\user\ntuser.ini

2015-08-02 15:44 - 2015-08-02 15:44 - 00000000 ____D C:\Users\user\AppData\Local\VirtualStore

2015-08-02 15:44 - 2015-02-25 21:08 - 00000000 ____D C:\Users\user\AppData\Roaming\Adobe

2015-08-02 15:44 - 2014-12-23 01:50 - 00249488 _____ (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2015-08-02 15:44 - 2009-07-14 07:42 - 00000000 ___RD C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-02 15:44 - 2009-07-14 07:37 - 00000000 ___RD C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-08-02 15:43 - 2015-08-02 15:43 - 00000000 __SHD C:\Recovery

2015-08-02 15:43 - 2015-01-29 18:49 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-08-02 15:43 - 2014-05-14 19:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-08-02 15:43 - 2014-05-14 19:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-08-02 15:43 - 2014-05-14 19:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-08-02 15:43 - 2014-05-14 19:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2015-08-02 15:43 - 2014-05-14 19:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2015-08-02 15:43 - 2014-05-14 19:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-08-02 15:43 - 2014-05-14 19:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-08-02 15:43 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-08-02 15:43 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-08-02 15:23 - 2015-08-02 15:23 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

2015-08-02 15:22 - 2015-08-21 16:10 - 01678915 _____ C:\Windows\WindowsUpdate.log

2015-08-02 15:22 - 2015-08-02 15:22 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

2015-08-02 15:20 - 2015-08-02 15:22 - 00001355 _____ C:\Windows\TSSysprep.log

2015-07-29 15:55 - 2015-07-29 15:55 - 00013926 _____ C:\Users\user\Downloads\Grafik LC Waikiki 08.2015.xlsx

2015-07-28 15:19 - 2015-07-28 15:19 - 01000574 _____ C:\Users\user\Downloads\ABV_Attachments (2).zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-23 17:31 - 2015-02-25 20:15 - 00000000 ____D C:\Users\user\AppData\Roaming\Skype

2015-08-23 15:22 - 2015-06-24 19:44 - 00000000 ____D C:\Users\user\Documents\Файлове на Outlook

2015-08-23 15:16 - 2009-07-14 07:39 - 00206959 _____ C:\Windows\setupact.log

2015-08-23 13:02 - 2015-05-07 13:02 - 00000328 _____ C:\Windows\Tasks\Bidaily Synchronize Task.job

2015-08-23 11:12 - 2009-07-14 07:34 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-23 11:12 - 2009-07-14 07:34 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-23 11:10 - 2010-11-21 00:01 - 00785302 _____ C:\Windows\system32\PerfStringBackup.INI

2015-08-23 11:07 - 2015-02-25 19:14 - 00000266 _____ C:\Windows\Tasks\AutoKMS.job

2015-08-23 11:07 - 2015-02-25 19:13 - 00109672 _____ C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

2015-08-23 11:05 - 2010-11-21 00:48 - 00034932 _____ C:\Windows\PFRO.log

2015-08-23 11:05 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-08-23 11:05 - 2009-07-14 07:33 - 00408752 _____ C:\Windows\system32\FNTCACHE.DAT

2015-08-22 20:08 - 2015-02-25 19:01 - 00000000 ____D C:\Users\user\AppData\Local\Google

2015-08-22 17:11 - 2015-02-25 19:10 - 00013030 _____ C:\PDOXUSRS.NET

2015-08-22 16:16 - 2015-05-17 18:49 - 00000000 ____D C:\Program Files\Google

2015-08-22 16:14 - 2015-02-25 19:43 - 00000000 ____D C:\Program Files\Opera

2015-08-22 16:11 - 2015-02-25 20:15 - 00000000 ___RD C:\Program Files\Skype

2015-08-22 16:11 - 2015-02-25 20:15 - 00000000 ____D C:\ProgramData\Skype

2015-08-21 16:17 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\NDF

2015-08-21 13:46 - 2009-07-14 05:37 - 00000000 ___RD C:\Users\Public

2015-08-16 21:04 - 2015-02-26 00:35 - 00000000 ____D C:\KMPlayer

2015-08-16 21:04 - 2015-02-25 19:14 - 00000000 ____D C:\Users\user\AppData\Roaming\uTorrent

2015-08-14 14:01 - 2015-02-25 19:04 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-03 02:18 - 2009-07-14 07:57 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG

2015-08-03 02:18 - 2009-07-14 07:52 - 00028672 _____ C:\Windows\system32\config\BCD-Template

2015-08-02 15:43 - 2009-07-14 07:52 - 00000000 ____D C:\Windows\system32\restore

2015-08-02 15:43 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\Recovery

2015-08-02 15:22 - 2009-07-14 07:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-08-02 15:22 - 2009-07-14 05:37 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-02 15:20 - 2010-11-21 03:46 - 00000000 ____D C:\Windows\CSC

2015-08-02 15:20 - 2009-07-14 07:34 - 00002790 _____ C:\Windows\DtcInstall.log

2015-07-31 17:48 - 2015-06-19 10:26 - 00000000 ____D C:\ProgramData\firebird

2015-07-31 07:51 - 2009-07-14 07:53 - 00032534 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-07-28 15:53 - 2015-03-04 03:10 - 00000000 ____D C:\Users\user\Documents\client X

==================== Files in the root of some directories =======

2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 ____N () C:\Users\user\AppData\Roaming\3QfIPPiT

2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 ____N () C:\Users\user\AppData\Roaming\5UQtIkbPTkE

2015-08-21 12:50 - 2015-08-21 12:50 - 0613255 _____ (CMI Limited) C:\Users\user\AppData\Local\nszB6C5.tmp

2015-08-21 11:45 - 2015-08-21 11:45 - 0047616 _____ () C:\Users\user\AppData\Local\Subelectrics.exe

2015-08-21 11:45 - 2015-08-21 11:45 - 0000187 _____ () C:\Users\user\AppData\Local\Subelectrics.exe.config

Some files in TEMP:

====================

C:\Users\user\AppData\Local\Temp\3280.exe

C:\Users\user\AppData\Local\Temp\9569.exe

C:\Users\user\AppData\Local\Temp\amisetup7124__13312.exe

C:\Users\user\AppData\Local\Temp\bitool.dll

C:\Users\user\AppData\Local\Temp\FD4.exe

C:\Users\user\AppData\Local\Temp\InitBDE.exe

C:\Users\user\AppData\Local\Temp\install1215124.exe

C:\Users\user\AppData\Local\Temp\[email protected]

C:\Users\user\AppData\Local\Temp\jre-8u40-windows-au.exe

C:\Users\user\AppData\Local\Temp\jre-8u45-windows-au.exe

C:\Users\user\AppData\Local\Temp\KMPAddedCode_KMP_adpageopen_Step1.exe

C:\Users\user\AppData\Local\Temp\KMP_3.9.1.135.exe

C:\Users\user\AppData\Local\Temp\ose00000.exe

C:\Users\user\AppData\Local\Temp\qqpcmgr_v10.11.16588.235_72898_Silence.exe

C:\Users\user\AppData\Local\Temp\ReimagePackage.exe

C:\Users\user\AppData\Local\Temp\ReimageRepair.exe

C:\Users\user\AppData\Local\Temp\ReimageRepairTemp.exe

C:\Users\user\AppData\Local\Temp\setup3.exe

C:\Users\user\AppData\Local\Temp\SkypeSetup.exe

C:\Users\user\AppData\Local\Temp\Uninstall.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-08-22 18:02

==================== End of log ============================

Addition.txt

23 август 201511 г.

Изтеглете fixlist.txt и го запазете в папката от която стартирахте FRST.exe.

Стартирайте FRST.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

fixlist.txt

23 август 201511 г.

Автор

Не поиска рестарт.

Fix result of Farbar Recovery Scan Tool (x86) Version:23-08-2015

Ran by user (2015-08-23 18:14:08) Run:1

Running from C:\Users\user\Downloads\FRST

Loaded Profiles: user (Available Profiles: user)

Boot Mode: Normal

==============================================

fixlist content:

*****************

Start

globalupdate Helper (Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ATTENTION

End

*****************

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}\\SystemComponent => value removed successfully.

==== End of Fixlog 18:14:08 ====

23 август 201511 г.

Стъпка 1

Моля, деинсталирайте тази програма: globalupdate Helper

Стъпка 2

Изтеглете fixlist.txt и го запазете в папката от която стартирахте FRST.exe.

Стартирайте FRST.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Стъпка 3

Моля, изтеглете Malwarebytes Anti-Malware 2.1.8.1057 и я запазете на вашия десктоп.

Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи се уверете че сте сложили отметка пред:
Launch Malwarebytes Anti-Malware
Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
Натиснете бутона Finish.
Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
Ще започне проверка за зловреден софтуер.
При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи натиснете бутона Apply Actions.
Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
Отидете то табът History > Application Logs.
Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

В следващия си коментар в тази тема, включете следните лог файлове:

Лог файл от FRST Fix
Лог файл от Malwarebytes Anti-Malware

fixlist.txt

23 август 201511 г.

Автор

1.Деинсталирах globalupdate Helper

2.Fix result of Farbar Recovery Scan Tool (x86) Version:23-08-2015

Ran by user (2015-08-23 19:00:07) Run:2

Running from C:\Users\user\Downloads\FRST

Loaded Profiles: user (Available Profiles: user)

Boot Mode: Normal

==============================================

fixlist content:

*****************

Start

CloseProcesses:

CreateRestorePoint:

CustomCLSID: HKU\S-1-5-21-2224806993-1213079895-3238273190-1000_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\user\Downloads\Download.exe No File

CustomCLSID: HKU\S-1-5-21-2224806993-1213079895-3238273190-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\user\AppData\Local\Google\Update\1.3.21.111\psuser.dll No File

Task: {1A54EF3F-C616-422C-8158-D124908CC9F9} - System32\Tasks\APSnotifierPP2 => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: {2EE0D0D1-AE10-47FC-96CD-570356E522B8} - \5UQtIkbPTkE -> No File <==== ATTENTION

Task: {36D35795-0D73-46B3-8245-D1DFF1A83385} - \Bidaily Synchronize Task -> No File <==== ATTENTION

Task: {462E7650-2ECF-4785-8AF0-7CDD03F5BB40} - System32\Tasks\APSnotifierPP3 => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: {46EEE308-A6B6-4108-8CAF-B4B39E9345D1} - \APSnotifierPP1 -> No File <==== ATTENTION

Task: {5E9C99C5-4A31-490F-8250-695A55CE8392} - \globalUpdateUpdateTaskMachineUA -> No File <==== ATTENTION

Task: {840CCEC0-527C-4649-83B7-F9302CAC5E4C} - System32\Tasks\{CC239300-BBBA-4584-B7C7-A620D77EE165} => pcalua.exe -a C:\Users\user\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cmi

Task: {D58FA173-2182-4143-88C3-0DCF6C615AD2} - \3QfIPPiT -> No File <==== ATTENTION

Task: {D741A716-82A1-4ED8-B35D-76F574E574DE} - System32\Tasks\ASP => C:\Program Files\RCP\systweakasp.exe

Task: C:\Windows\Tasks\3QfIPPiT.job => C:\Users\user\AppData\Roaming\3QfIPPiT.exe <==== ATTENTION

Task: C:\Windows\Tasks\5UQtIkbPTkE.job => C:\Users\user\AppData\Roaming\5UQtIkbPTkE.exe <==== ATTENTION

Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\Windows\Tasks\Bidaily Synchronize Task.job => C:\ProgramData\{0b3ab1ba-05b5-b5a3-0b3a-ab1ba05bc6e8}\Download.exe <==== ATTENTION

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files\globalUpdate\Update\globalupdate.exe <==== ATTENTION

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files\globalUpdate\Update\globalupdate.exe <==== ATTENTION

2015-08-21 11:46 - 2015-08-21 11:46 - 00137728 ____N () C:\Program Files\4C4C4544-1440146753-5710-804D-B5C04F4B344A\hnskCB49.tmp

2015-08-21 11:45 - 2015-08-21 11:45 - 00047616 _____ () C:\Users\user\AppData\Local\Subelectrics.exe

Google Update Helper (Version: 1.3.28.1 - Google Inc.) Hidden