Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Проблем с baidu,com

genia
в Премахване на зловреден софтуер

Featured Replies

Здравейте!

 

След като вчера се опитах да инсталирам една програма изтеглена от Интернет се сдобих с инсталирани 4-5 други програми, между които едната- изписана с китайски йероглифи. Веднага се опитах да ги деинсталирам от Add/remove programs, като започнах от последната-тази с йероглифите. Деинсталирането тръгна много бавно, като в един момент вече напълно спря и аз се отказах от този начин. 

В същото време в долния десен ъгъл на монитора ми започнаха да се появяват картинки с китайски надписи.

При опит да отворя Google Chrome установих, че търсачката ми е заменена с Oursearch. Намерих инфо в мрежата, че това е зловреден софтуер и може да се премахне с Adwcleaner. След като го използвах, наистина се премахна oursearch, както и в Add/remove programs вече не се показваше китайската програма. Реших че съм се справила с проблема, но днес, отново ми се появяват същите реклами в долния десен ъгъл и компютъра ми става все по-бавен.

Надявам се на вашата помощ, сканирах с FRST и ето резултата:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:15-09-2015
Ran by Ilina (administrator) on ILINA-PC (17-09-2015 00:48:30)
Running from C:\Users\Ilina\Desktop
Loaded Profiles: Ilina (Available Profiles: Ilina)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
(wgj) C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [wenguanjia] => C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe [417168 2015-09-16] (wgj)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\...\Run: [GoogleChromeAutoLaunch_4D8A87DFFE326BA33880769D34275BC4] => "C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-06-13]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: 0.0.0.1 mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{B745321B-C57C-4A6B-8266-F44D2B627EA1}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {ielnksrch} URL = 
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
 
FireFox:
========
FF ProfilePath: C:\Users\Ilina\AppData\Roaming\Mozilla\Firefox\Profiles\7373my6g.default-1440716467483
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_160.dll [2015-06-13] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Extension: CinemaPlus-3.3c - C:\Users\Ilina\AppData\Roaming\Mozilla\Firefox\Profiles\7373my6g.default-1440716467483\Extensions\[email protected] [2015-09-17]
 
Chrome: 
=======
CHR StartupUrls: Default -> "hxxps://www.google.bg/"
CHR Profile: C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Презентации) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-04]
CHR Extension: (Google Документи) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Диск) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-04]
CHR Extension: (YouTube) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-04]
CHR Extension: (Google Търсене) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-04]
CHR Extension: (Електронни таблици от Google) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-04]
CHR Extension: (Google Документи офлайн) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-04]
CHR Extension: (AdBlock) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-09-15]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-04]
CHR Extension: (Gmail) - C:\Users\Ilina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-04]
 
Opera: 
=======
OPR Extension: (CinemaP-1.9cV15.09) - C:\Users\Ilina\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi [2015-09-16]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe [235696 2015-07-31] (McAfee, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-09-17 00:48 - 2015-09-17 00:52 - 00008310 _____ C:\Users\Ilina\Desktop\FRST.txt
2015-09-17 00:48 - 2015-09-17 00:48 - 00000000 ____D C:\FRST
2015-09-17 00:45 - 2015-09-17 00:45 - 01695232 _____ (Farbar) C:\Users\Ilina\Desktop\FRST.exe
2015-09-17 00:44 - 2015-09-17 00:45 - 01695232 _____ (Farbar) C:\Users\Ilina\Downloads\FRST.exe
2015-09-16 22:45 - 2015-09-17 00:46 - 00000000 ___HD C:\Windows\AxInstSV
2015-09-16 01:00 - 2015-09-16 01:00 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-09-16 01:00 - 2015-09-16 01:00 - 00001991 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-09-16 01:00 - 2015-09-16 01:00 - 00000000 ____D C:\ProgramData\Adobe
2015-09-16 00:59 - 2015-09-16 01:00 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-09-16 00:59 - 2015-09-16 00:59 - 00000000 ____D C:\Program Files\Adobe
2015-09-16 00:56 - 2015-09-16 00:58 - 141015434 _____ C:\Users\Ilina\Downloads\AdbeRdr11000_mui_Std.zip
2015-09-16 00:44 - 2015-09-16 00:44 - 00001206 _____ C:\Users\Ilina\Desktop\adwcleaner_5.007 - Shortcut.lnk
2015-09-16 00:38 - 2015-09-16 22:40 - 00000000 ____D C:\AdwCleaner
2015-09-16 00:37 - 2015-09-16 00:37 - 01660416 _____ C:\Users\Ilina\Downloads\adwcleaner_5.007.exe
2015-09-16 00:15 - 2015-09-16 00:16 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\WB_CFG
2015-09-16 00:14 - 2015-09-17 00:14 - 00001006 _____ C:\Windows\Tasks\iOHeFGMVmxHNW4h8d.job
2015-09-16 00:14 - 2015-09-17 00:14 - 00001006 _____ C:\Windows\Tasks\cBXS26Twel2xsqqMZ.job
2015-09-16 00:13 - 2015-09-16 00:13 - 00000004 _____ C:\Windows\system32\029B560A371F4E00AB32838EBC01B9E7
2015-09-16 00:12 - 2015-09-16 00:12 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\Opera Software
2015-09-16 00:12 - 2015-09-16 00:12 - 00000000 ____D C:\ProgramData\adb
2015-09-16 00:11 - 2015-09-17 01:00 - 00000458 _____ C:\Windows\Tasks\AdobeoaUpdate Ver 2015915.job
2015-09-16 00:11 - 2015-09-16 01:06 - 00000000 ____D C:\Users\Ilina\AppData\Local\Unity
2015-09-16 00:11 - 2015-09-16 00:11 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\wenguanjia
2015-09-16 00:11 - 2015-09-16 00:11 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\文管家(915)
2015-09-16 00:11 - 2015-09-16 00:11 - 00000000 ____D C:\ppsfile
2015-09-16 00:10 - 2015-09-16 00:10 - 00000000 ____D C:\Users\Public\QiYi
2015-09-16 00:09 - 2015-09-16 00:09 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-09-16 00:08 - 2015-09-16 00:08 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\WinRAR
2015-09-16 00:06 - 2015-09-16 00:06 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-09-16 00:06 - 2015-09-16 00:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-09-16 00:06 - 2015-09-16 00:06 - 00000000 ____D C:\Program Files\WinRAR
2015-09-16 00:05 - 2015-09-16 00:05 - 01758688 _____ C:\Users\Ilina\Downloads\wrar521.exe
2015-09-16 00:02 - 2015-09-16 00:02 - 00000376 _____ C:\Windows\ODBC.INI
2015-09-16 00:02 - 2003-06-18 17:31 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\mdimon.dll
2015-09-16 00:01 - 2015-09-16 00:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-09-16 00:01 - 2015-09-16 00:01 - 00000000 ____D C:\Program Files\Microsoft ActiveSync
2015-09-16 00:01 - 2015-09-16 00:01 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2015-09-16 00:00 - 2015-09-16 00:01 - 00000000 ____D C:\Program Files\Microsoft Office
2015-09-16 00:00 - 2015-09-16 00:00 - 00000000 ____D C:\Windows\PCHEALTH
2015-09-09 21:10 - 2015-09-02 05:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 21:10 - 2015-09-02 05:48 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 21:10 - 2015-09-02 05:48 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 21:10 - 2015-09-02 05:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 21:10 - 2015-09-02 04:36 - 02384896 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 21:10 - 2015-09-02 04:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 02953728 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 02061824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 21:10 - 2015-08-26 20:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 21:10 - 2015-08-26 20:55 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 21:10 - 2015-08-26 20:55 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 21:10 - 2015-08-26 20:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 21:10 - 2015-08-26 20:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 21:10 - 2015-08-18 04:14 - 00344168 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-09 21:10 - 2015-08-15 09:06 - 19856896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-09 21:10 - 2015-08-15 08:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-09 21:10 - 2015-08-15 08:53 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-09 21:10 - 2015-08-15 08:40 - 00504832 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-09 21:10 - 2015-08-15 08:40 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-09 21:10 - 2015-08-15 08:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-09 21:10 - 2015-08-15 08:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-09 21:10 - 2015-08-15 08:38 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-09 21:10 - 2015-08-15 08:35 - 02279424 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-09 21:10 - 2015-08-15 08:33 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-09 21:10 - 2015-08-15 08:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-09 21:10 - 2015-08-15 08:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-09 21:10 - 2015-08-15 08:29 - 00665600 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-09 21:10 - 2015-08-15 08:29 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-09 21:10 - 2015-08-15 08:29 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-09 21:10 - 2015-08-15 08:29 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-09 21:10 - 2015-08-15 08:24 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-09 21:10 - 2015-08-15 08:21 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-09 21:10 - 2015-08-15 08:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 21:10 - 2015-08-15 08:14 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-09 21:10 - 2015-08-15 08:12 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-09 21:10 - 2015-08-15 08:11 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-09 21:10 - 2015-08-15 08:10 - 04520448 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-09 21:10 - 2015-08-15 08:04 - 12857344 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-09 21:10 - 2015-08-15 08:02 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-09 21:10 - 2015-08-15 08:02 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-09 21:10 - 2015-08-15 08:01 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-09 21:10 - 2015-08-15 08:01 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-09 21:10 - 2015-08-15 07:43 - 01951232 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-09 21:10 - 2015-08-15 07:39 - 01310720 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-09 21:10 - 2015-08-15 07:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-09 21:10 - 2015-08-05 20:41 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 21:10 - 2015-08-05 20:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 21:10 - 2015-08-05 20:40 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 21:10 - 2015-08-04 20:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 21:10 - 2015-08-04 20:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 21:10 - 2015-08-04 20:47 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 21:10 - 2015-08-04 20:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 21:10 - 2015-08-04 20:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 21:10 - 2015-08-04 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 21:09 - 2015-07-15 05:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-05 11:43 - 2015-09-05 11:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2015-09-05 11:42 - 2015-09-05 11:43 - 00000000 ____D C:\Program Files\McAfee Security Scan
2015-08-28 01:59 - 2015-08-28 02:01 - 00000000 ____D C:\Users\Ilina\Desktop\Стари данни Firefox
2015-08-28 00:17 - 2015-08-28 01:20 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-20 23:37 - 2015-08-20 23:37 - 00000464 __RSH C:\ProgramData\ntuser.pol
2015-08-20 22:47 - 2015-08-20 22:47 - 1364161491 _____ (Igor Pavlov) C:\Users\Ilina\Downloads\Office_2013_EN.exe
2015-08-20 22:40 - 2015-08-20 22:40 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\MailProducts
2015-08-20 22:39 - 2015-08-20 23:34 - 00000000 ____D C:\ProgramData\Tristip
2015-08-20 22:39 - 2015-08-20 22:39 - 00002377 _____ C:\Windows\system32\findit.xml
2015-08-20 22:39 - 2015-08-20 22:39 - 00000000 ____D C:\ProgramData\Tristips
2015-08-20 22:38 - 2015-08-20 22:38 - 00884744 _____ (Program ) C:\Users\Ilina\Downloads\Malavida_Download_Manager(1).exe
2015-08-20 22:37 - 2015-08-20 22:37 - 00884744 _____ (Program ) C:\Users\Ilina\Downloads\Malavida_Download_Manager.exe
2015-08-18 22:41 - 2015-08-18 22:41 - 202055480 _____ C:\Windows\MEMORY.DMP
2015-08-18 22:41 - 2015-08-18 22:41 - 00145920 _____ C:\Windows\Minidump\081815-18844-01.dmp
2015-08-18 22:41 - 2015-08-18 22:41 - 00000000 ____D C:\Windows\Minidump
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2015-09-17 00:42 - 2015-02-04 01:21 - 00000986 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-17 00:41 - 2009-07-14 07:34 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-17 00:41 - 2009-07-14 07:34 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-17 00:01 - 2015-02-02 22:48 - 01166972 _____ C:\Windows\WindowsUpdate.log
2015-09-16 23:33 - 2015-06-13 21:32 - 00000000 ____D C:\Users\Ilina\AppData\Local\Adobe
2015-09-16 23:33 - 2015-02-04 06:03 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\Adobe
2015-09-16 22:44 - 2015-02-04 01:22 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-16 22:42 - 2015-02-04 01:21 - 00000982 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-16 22:41 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-16 22:41 - 2009-07-14 07:39 - 00042178 _____ C:\Windows\setupact.log
2015-09-16 00:42 - 2009-07-14 07:33 - 00357832 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-16 00:41 - 2010-11-21 00:48 - 00017324 _____ C:\Windows\PFRO.log
2015-09-16 00:40 - 2015-04-02 12:56 - 00001021 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-09-16 00:40 - 2015-04-02 12:56 - 00001009 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-09-16 00:40 - 2015-02-04 01:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-16 00:10 - 2009-07-14 05:37 - 00000000 ___RD C:\Users\Public
2015-09-16 00:02 - 2009-07-14 05:04 - 00000499 _____ C:\Windows\win.ini
2015-09-16 00:01 - 2010-11-21 03:46 - 00000000 ____D C:\Windows\ShellNew
2015-09-16 00:01 - 2009-07-14 05:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-09-16 00:00 - 2015-02-04 06:09 - 00000000 ____D C:\Program Files\Microsoft.NET
2015-09-16 00:00 - 2009-07-14 05:37 - 00000000 ____D C:\Program Files\Common Files\System
2015-09-15 23:56 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system
2015-09-13 14:46 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\rescache
2015-09-11 22:23 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\Microsoft.NET
2015-09-11 20:12 - 2015-02-04 01:21 - 00000000 ____D C:\Users\Ilina\AppData\Local\Google
2015-09-10 22:53 - 2009-07-14 07:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-10 22:51 - 2010-11-21 03:46 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-10 22:51 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\bg-BG
2015-09-10 00:10 - 2010-11-21 00:01 - 00732070 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-05 11:43 - 2015-06-13 21:34 - 00002009 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2015-08-28 01:20 - 2015-04-02 12:55 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-08-20 22:40 - 2015-02-02 23:34 - 00001415 _____ C:\Users\Ilina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-20 22:40 - 2009-07-14 05:37 - 00000000 ___HD C:\Windows\system32\GroupPolicy
 
==================== Files in the root of some directories =======
 
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ
2015-04-20 17:05 - 2015-04-20 17:05 - 1579520 _____ () C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ.exe
2015-04-14 19:28 - 2015-04-14 19:28 - 0004387 _____ () C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d
2015-04-20 17:05 - 2015-04-20 17:05 - 1246720 _____ () C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d.exe
2015-09-16 00:09 - 2015-09-16 00:09 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
 
Some files in TEMP:
====================
C:\Users\Ilina\AppData\Local\Temp\setup3.exe
C:\Users\Ilina\AppData\Local\Temp\sqlite3.dll
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-09-11 22:32
 
==================== End of FRST.txt ============================

 

 

Addition.txt

  • Автор

Пропуснах да кажа, че на изскачащите реклами между китайските букви се вижда надпис на латиница baidu.com.

Здравейте!

Стъпка 1

Моля, деинсталирайте тази програма: McAfee Security Scan Plus

Стъпка 2

Изтеглете fixlist.txt и го запазете в папката от която стартирахте FRST.exe.

Стартирайте FRST.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

 

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Стъпка 3

Моля, изтеглете Malwarebytes Anti-Malware 2.1.8.1057 и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката.
  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.
  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.
В следващия си коментар в тази тема, включете следните лог файлове:
  • Лог файл от FRST скрипта
  • Лог файл от Malwarebytes Anti-Malware

fixlist.txt

  • Автор

Благодaря Maniac, че ми отговорихте  толкова бързо, изпълних описаните стъпки и вече не виждам досадните китайски реклами. Ще публикувам получените резултати :

 

1.Лог файл от FRST скрипта 

 

Fix result of Farbar Recovery Scan Tool (x86) Version:15-09-2015
Ran by Ilina (2015-09-17 22:09:45) Run:1
Running from C:\Users\Ilina\Desktop
Loaded Profiles: Ilina (Available Profiles: Ilina)
Boot Mode: Normal
 
==============================================
 
fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
Task: {3677766F-D67A-4A93-87F4-CC666B7635E9} - System32\Tasks\cBXS26Twel2xsqqMZ => C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ.exe [2015-04-20] () <==== ATTENTION
Task: {8D5BC03D-0762-416D-A283-E09535345122} - System32\Tasks\AdobeoaUpdate Ver 2015915 => C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe [2015-09-16] (wgj)
Task: {CDB27B0A-F13E-4C85-9A1D-0E77EA9E2B84} - System32\Tasks\iOHeFGMVmxHNW4h8d => C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d.exe [2015-04-20] () <==== ATTENTION
Task: C:\Windows\Tasks\AdobeoaUpdate Ver 2015915.job => C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe/check_update C:\Users\Ilina\AppData\Roaming\wenguanjia\Ilina(This task detect has update.Ver
Task: C:\Windows\Tasks\cBXS26Twel2xsqqMZ.job => C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ.exe <==== ATTENTION
Task: C:\Windows\Tasks\iOHeFGMVmxHNW4h8d.job => C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d.exe <==== ATTENTION
2015-09-16 00:11 - 2015-09-16 00:11 - 00564112 _____ () C:\Users\Ilina\AppData\Roaming\wenguanjia\gjui.dll
2015-09-16 00:11 - 2015-09-16 00:11 - 01616272 _____ () C:\Users\Ilina\AppData\Roaming\wenguanjia\wgjui.dll
FirewallRules: [{E4052CAB-70D8-4F3D-9F38-3D28B4A92C67}] => (Allow) C:\Users\Ilina\AppData\Roaming\IQIYI Video\LStyle\GpUpdate.exe
FirewallRules: [{971343D6-C75F-4FC8-8A82-7FB4172B1FA6}] => (Allow) C:\IQIYI Video\GeePlayer\GeePlayer.exe
FirewallRules: [{A107A9DB-CA7C-4F1C-B5EE-AE4584C4AAA1}] => (Allow) C:\Users\Ilina\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe
FirewallRules: [{89DAF168-A7CC-495D-8E66-82812CE29D3C}] => (Allow) C:\IQIYI Video\LStyle\QyClient.exe
FirewallRules: [{FC385DC6-9D48-4AC8-BC82-79C448592E2F}] => (Allow) C:\IQIYI Video\LStyle\QyWebPlayer.exe
FirewallRules: [{B074639C-0CA0-4DBC-A21D-EBFC52A5BAEA}] => (Allow) C:\IQIYI Video\Common\QyKernel.exe
FirewallRules: [{DBC660A1-E840-4349-889A-DDABEC2EED19}] => (Allow) C:\IQIYI Video\LStyle\QyPlayer.exe
FirewallRules: [{63D4C600-9E81-4503-A6B6-5DA436F2E5C7}] => (Allow) C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
HKLM\...\Run: [wenguanjia] => C:\Users\Ilina\AppData\Roaming\wenguanjia\papertex.exe [417168 2015-09-16] (wgj)
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\...\Run: [GoogleChromeAutoLaunch_4D8A87DFFE326BA33880769D34275BC4] => "C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {ielnksrch} URL = 
FF Extension: CinemaPlus-3.3c - C:\Users\Ilina\AppData\Roaming\Mozilla\Firefox\Profiles\7373my6g.default-1440716467483\Extensions\[email protected] [2015-09-17]
OPR Extension: (CinemaP-1.9cV15.09) - C:\Users\Ilina\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi [2015-09-16]
2015-09-16 00:14 - 2015-09-17 00:14 - 00001006 _____ C:\Windows\Tasks\iOHeFGMVmxHNW4h8d.job
2015-09-16 00:14 - 2015-09-17 00:14 - 00001006 _____ C:\Windows\Tasks\cBXS26Twel2xsqqMZ.job
2015-09-16 00:11 - 2015-09-17 01:00 - 00000458 _____ C:\Windows\Tasks\AdobeoaUpdate Ver 2015915.job
2015-09-16 00:11 - 2015-09-16 00:11 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\wenguanjia
2015-09-16 00:11 - 2015-09-16 00:11 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\文管家(915)
2015-09-16 00:10 - 2015-09-16 00:10 - 00000000 ____D C:\Users\Public\QiYi
2015-09-16 00:09 - 2015-09-16 00:09 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-08-20 22:47 - 2015-08-20 22:47 - 1364161491 _____ (Igor Pavlov) C:\Users\Ilina\Downloads\Office_2013_EN.exe
2015-08-20 22:40 - 2015-08-20 22:40 - 00000000 ____D C:\Users\Ilina\AppData\Roaming\MailProducts
2015-08-20 22:39 - 2015-08-20 23:34 - 00000000 ____D C:\ProgramData\Tristip
2015-08-20 22:39 - 2015-08-20 22:39 - 00000000 ____D C:\ProgramData\Tristips
2015-08-20 22:38 - 2015-08-20 22:38 - 00884744 _____ (Program ) C:\Users\Ilina\Downloads\Malavida_Download_Manager(1).exe
2015-08-20 22:37 - 2015-08-20 22:37 - 00884744 _____ (Program ) C:\Users\Ilina\Downloads\Malavida_Download_Manager.exe
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ
2015-04-20 17:05 - 2015-04-20 17:05 - 1579520 _____ () C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ.exe
2015-04-14 19:28 - 2015-04-14 19:28 - 0004387 _____ () C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d
2015-04-20 17:05 - 2015-04-20 17:05 - 1246720 _____ () C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d.exe
2015-09-16 00:09 - 2015-09-16 00:09 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\Users\Ilina\AppData\Roaming\IQIYI Video
C:\IQIYI Video
C:\Program Files\Crossbrowse
CMD: bitsadmin /reset /allusers
Hosts:
EmptyTemp:
end
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3677766F-D67A-4A93-87F4-CC666B7635E9}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3677766F-D67A-4A93-87F4-CC666B7635E9}" => key removed successfully.
C:\Windows\System32\Tasks\cBXS26Twel2xsqqMZ => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\cBXS26Twel2xsqqMZ" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8D5BC03D-0762-416D-A283-E09535345122}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D5BC03D-0762-416D-A283-E09535345122}" => key removed successfully.
C:\Windows\System32\Tasks\AdobeoaUpdate Ver 2015915 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeoaUpdate Ver 2015915" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CDB27B0A-F13E-4C85-9A1D-0E77EA9E2B84}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CDB27B0A-F13E-4C85-9A1D-0E77EA9E2B84}" => key removed successfully.
C:\Windows\System32\Tasks\iOHeFGMVmxHNW4h8d => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iOHeFGMVmxHNW4h8d" => key removed successfully.
C:\Windows\Tasks\AdobeoaUpdate Ver 2015915.job => moved successfully
C:\Windows\Tasks\cBXS26Twel2xsqqMZ.job => moved successfully
C:\Windows\Tasks\iOHeFGMVmxHNW4h8d.job => moved successfully
C:\Users\Ilina\AppData\Roaming\wenguanjia\gjui.dll => moved successfully
C:\Users\Ilina\AppData\Roaming\wenguanjia\wgjui.dll => moved successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E4052CAB-70D8-4F3D-9F38-3D28B4A92C67} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{971343D6-C75F-4FC8-8A82-7FB4172B1FA6} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A107A9DB-CA7C-4F1C-B5EE-AE4584C4AAA1} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{89DAF168-A7CC-495D-8E66-82812CE29D3C} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{FC385DC6-9D48-4AC8-BC82-79C448592E2F} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B074639C-0CA0-4DBC-A21D-EBFC52A5BAEA} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DBC660A1-E840-4349-889A-DDABEC2EED19} => value removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{63D4C600-9E81-4503-A6B6-5DA436F2E5C7} => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\wenguanjia => value removed successfully.
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_4D8A87DFFE326BA33880769D34275BC4 => value removed successfully.
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully.
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKU\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Microsoft\Internet Explorer\Main\\SearchAssistant => value removed successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
C:\Users\Ilina\AppData\Roaming\Mozilla\Firefox\Profiles\7373my6g.default-1440716467483\Extensions\[email protected] => moved successfully
C:\Users\Ilina\AppData\Roaming\Mozilla\Firefox\Profiles\7373my6g.default-1440716467483\Extensions\[email protected] => path removed successfully.
C:\Users\Ilina\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi => moved successfully
"C:\Windows\Tasks\iOHeFGMVmxHNW4h8d.job" => File/Folder not found.
"C:\Windows\Tasks\cBXS26Twel2xsqqMZ.job" => File/Folder not found.
"C:\Windows\Tasks\AdobeoaUpdate Ver 2015915.job" => File/Folder not found.
C:\Users\Ilina\AppData\Roaming\wenguanjia => moved successfully
C:\Users\Ilina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\文管家(915) => moved successfully
C:\Users\Public\QiYi => moved successfully
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat => moved successfully
C:\Users\Ilina\Downloads\Office_2013_EN.exe => moved successfully
C:\Users\Ilina\AppData\Roaming\MailProducts => moved successfully
C:\ProgramData\Tristip => moved successfully
C:\ProgramData\Tristips => moved successfully
C:\Users\Ilina\Downloads\Malavida_Download_Manager(1).exe => moved successfully
C:\Users\Ilina\Downloads\Malavida_Download_Manager.exe => moved successfully
C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ => moved successfully
C:\Users\Ilina\AppData\Roaming\cBXS26Twel2xsqqMZ.exe => moved successfully
C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d => moved successfully
C:\Users\Ilina\AppData\Roaming\iOHeFGMVmxHNW4h8d.exe => moved successfully
"C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat" => File/Folder not found.
"C:\Users\Ilina\AppData\Roaming\IQIYI Video" => File/Folder not found.
"C:\IQIYI Video" => File/Folder not found.
"C:\Program Files\Crossbrowse" => File/Folder not found.
 
=========  bitsadmin /reset /allusers =========
 
 
BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.
 
BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
 
0 out of 0 jobs canceled.
 
========= End of CMD: =========
 
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 1.4 GB temporary data Removed.
 
 
The system needed a reboot.
 
==== End of Fixlog 22:14:05 ====
 
2.Лог файл от Malwarebytes Anti-Malware: 
 
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 17.9.2015 г.
Scan Time: 22:56 ч.
Logfile: 
Administrator: Yes
 
Version: 2.1.8.1057
Malware Database: v2015.09.17.05
Rootkit Database: v2015.08.16.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Ilina
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 299101
Time Elapsed: 7 min, 1 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 6
PUP.Optional.Cinema, HKLM\SOFTWARE\CinemaP-1.9cV15.09-nv, Quarantined, [60990a267318de588751d2b6dc2847b9], 
PUP.Optional.Cinema, HKLM\SOFTWARE\CinemaP-1.9cV15.09-nv-ie, Quarantined, [31c882ae7b1052e46e6aed9b9c68b749], 
PUP.Optional.WdsManPro, HKLM\SOFTWARE\WdsManPro, Quarantined, [fbfe230dc7c4dc5a48fe35978480629e], 
PUP.Optional.ApplicationHosting, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\Application Hosting.exe, Quarantined, [28d147e90685f93dff7fdda553b119e7], 
PUP.Optional.Cinema, HKU\S-1-5-21-941662184-2812432805-2835303074-1000\SOFTWARE\CinemaP-1.9cV15.09-nv, Quarantined, [8e6b49e71d6e77bfe0ef394f966ecf31], 
PUP.Optional.Cinema, HKU\S-1-5-21-941662184-2812432805-2835303074-1000\SOFTWARE\CinemaP-1.9cV15.09-nv-ie, Quarantined, [e910dd53a2e961d50fc092f6867e3bc5], 
 
Registry Values: 6
PUP.Optional.CrossBrowse, HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS, Crossbrowse, Quarantined, [6891f53bf398df573dfa5e2f2adaa25e]
PUP.Optional.CrossBrowse, HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS|StubPath, "C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level, Quarantined, [a6532c04addef44256e18ffe48bcc937]
PUP.Optional.CrossBrowse, HKLM\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS|Localized Name, Crossbrowse, Quarantined, [37c2c070f596b482092e315c8183e41c]
PUP.Optional.CrossBrowse, HKU\S-1-5-21-941662184-2812432805-2835303074-1000\SOFTWARE\CLIENTS\STARTMENUINTERNET, Crossbrowse, Quarantined, [9762e05004873204cf612d6054b07a86]
 
Registry Data: 2
PUP.Optional.Linkury.ShrtCln, HKU\S-1-5-21-941662184-2812432805-2835303074-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms},'>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}, Good: (www.google.com), Bad: (http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}),Replaced,[11e848e86c1fe056f7a5006e689db14f]
PUP.Optional.Linkury.ShrtCln, HKU\S-1-5-21-941662184-2812432805-2835303074-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms},'>http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}, Good: (www.google.com), Bad: (http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ-5h_glLHU9dUGvte9aFG6f36rUTWSvvd77tog-45A0xEOS3EyydV_8bUvEldZ6egMMArAejVyRQFzwVOQOHpIAfz_2rCmi8-FO0mRrobOWr8z7ByNo3naGt5xcBuKjqo_sxxCLN1t51U1fKRHmH4M186Vg,,&q={searchTerms}),Replaced,[d227dc5413782a0cf7a7620cd72ea15f]
 
Folders: 0
(No malicious items detected)
 
Files: 5
Worm.AutoIt, C:\Win\lsass.exe, Quarantined, [2bcece622764d2643c1e93e97193ff01], 
Worm.AutoIt, C:\Win\names.txt, Quarantined, [9f5a0b25d0bb191de873a8d44bb92cd4], 
PUP.Optional.IQIYI, C:\Windows\Fonts\iqiyi_logo.ttf, Quarantined, [bd3c76ba6b20f73f63599806e71df010], 
PUP.Optional.Linkury.Gen, C:\Windows\System32\findit.xml, Quarantined, [b841250b830853e3b7aa5a4725dff808], 
PUP.Optional.CrossRider, C:\Users\Ilina\AppData\Roaming\Mozilla\Firefox\Profiles\7373my6g.default-1440716467483\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "14fd81658a0c3784ca69bb14bc9dd485");), Replaced,[c33689a7a3e8dc5a9f64c6e12bda33cd]
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
  • Автор

Какво става Maniac, изпълнила съм вашите указания още преди празниците, нямам никакъв отговор.

Не ми стана ясно дали съм успяла да изчистя системата си или трябва да направя още нещо?

 

Прощавайте, изгубил съм темата от поглед!

Стъпка 1

Моля изтеглете icon1351185104.pngJunkware Removal Tool на вашия десктоп.

 

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

Стъпка 2

Изтеглете и стартирайте 6sv1DN9.jpgAdwCleaner.exe.

  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[S0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието му в следващия си коментар.

Стъпка 3

icon_zps423a0d9f.jpgМоля изтеглете ZHPCleaner и я запазете на вашия десктоп.

 

  • Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
  • Кликнете върху Ashampoo_Snap_20140819_13h09m50s_001__zp за да се съгласите с лицензионното споразумение.
  • Изберете бутона y3pI4LR.png.
  • Браузърите ще бъдат затворени автоматично.
  • Ще се отвори лог файл след приключването на проверката.
  • Публикувайте лог файла в следващия си коментар.

 

В следващия си коментар в тази тема, включете следните лог файлове:

 

  • Лог файл от Junkware Removal Tool
  • Лог файл от AdwCleaner
  • Лог файл от ZHPCleaner

Редактирано от Maniac (преглед на промените)

  • Автор

Ето и новите логове от мен:

  • Лог файл от Junkware Removal Tool

Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.3 (09.21.2015:1)
OS: Windows 7 Ultimate x86
Ran by Ilina on бкЎ 26.09.2015 Ј. at 17:24:55,10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 


~~~ Services

 

~~~ Tasks

Successfully deleted: [Task] C:\Windows\System32\tasks\DriverNavigator Scheduled Scan
Successfully deleted: [Task] C:\Windows\Tasks\DriverNavigator Scheduled Scan.job

 

~~~ Registry Values

 

~~~ Registry Keys

Successfully deleted: [Registry Key] (Default)    REG_SZ    Crossbrowse

 

~~~ Files

 

~~~ Folders

 

~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted the following from C:\Users\Ilina\AppData\Roaming\mozilla\firefox\profiles\7373my6g.default-1440716467483\prefs.js

user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.ptid, amt);
user_pref(browser.search.searchengine.uid, SAMSUNGXHM321HI_S265J90B416438416438);
user_pref(extensions.aAVJYFVOD75109374HCDE39471360com72895.72895.internaldb.__ICM_LITE__blacklist_domain.value, %7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%
user_pref(extensions.aAVJYFVOD75109374HCDE39471360com72895.72895.internaldb.__ICM_LITE__fifty_test_rules.value, %7B%22DE%22%3A%7B%22ALL%22%3A%5B%22anastasiadate.com%22%2C%2
user_pref(extensions.aAVJYFVOD75109374HCDE39471360com72895.72895.internaldb.monetization_plugin_bundledUrls.value, %7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22

 

~~~ Chrome


[C:\Users\Ilina\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Ilina\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Ilina\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Ilina\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on бкЎ 26.09.2015 Ј. at 17:27:36,83
End of JRT log

 

  • Автор
  • Лог файл от AdwCleaner

# AdwCleaner v5.008 - Logfile created 26/09/2015 at 17:34:58
# Updated 18/09/2015 by Xplode
# Database : 2015-09-23.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x86)
# Username : Ilina - ILINA-PC
# Running from : C:\Users\Ilina\Desktop\adwcleaner_5.008.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\ppsfile

***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\CLASSES\GEEPLAYER.DIR
[-] Key Deleted : HKLM\SOFTWARE\CLASSES\APPLICATIONS\GEEPLAYER.EXE
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PPStream.exe
[-] Key Deleted : HKCU\Software\PPStream
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPStream

***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C6].txt - [995 bytes] ##########

 

 

 

  • Лог файл от ZHPCleaner

~ ZHPCleaner v2015.9.24.356 by Nicolas Coolman (2015/09/24)
~ Run by Ilina (Administrator)  (26/09/2015 17:49:59)
~ Site : http://www.nicolascoolman.fr
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Scan
~ Report : C:\Users\Ilina\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Ilina\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Ultimate, 32-bit Service Pack 1 (Build 7601)


---\\  Services (0)
~ No malicious or unnecessary items found.


---\\  Browser internet (0)
~ No malicious or unnecessary items found.


---\\  Hosts file (1)
~ The hosts file is legitimate (1)


---\\  Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.


---\\  Explorer ( File, Folder) (0)
~ No malicious or unnecessary items found.


---\\  Registry ( Key, Value, Data) (10)
FOUND data: HKCR\.html\\Default [Bad : CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND data: HKLM\SOFTWARE\Classes\.html\\Default [Bad : CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND key: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.htm [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND key: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.html [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND key: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.shtml [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND key: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.xht [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND key: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.xhtml [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
FOUND key: HKLM\SOFTWARE\Classes\ppsmb [C:\IQIYI Video\LStyle\ppsmb.dll (Not File)]  =>PUP.Optional.IQIYIVideo
FOUND key: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro []  =>PUP.Optional.WdsManPro
FOUND key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\GeePlayer.exe [C:\IQIYI Video\GeePlayer\GeePlayer.exe (Not File)]  =>PUP.Optional.IQIYIVideo


---\\ Result of repair
~ Any repair made


---\\ Statistics
~ Items scanned : 45819
~ Items found : 10
~ Items cancelled : 0
~ Items repaired : 0


~ End of search in 3 minutes
===================
ZHPCleaner--26092015-17_53_50.txt

  • Сега стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"[/*]
  • Кликнете върху Ashampoo_Snap_20140819_13h09m50s_001__zp за да се съгласите с лицензионното споразумение.[/*]
  • Направете нова проверка и след като приключи натиснете бутона slm23Pe.png[/*]
  • Браузърите ще бъдат затворени автоматично.[/*]
  • Ще се отвори лог файл след приключването на проверката.[/*]
  • Публикувайте лог файла в следващия си коментар.[/*]
  • Автор

Ето и резултата който се получи от ZHPCleaner...

~ ZHPCleaner v2015.9.24.356 by Nicolas Coolman (2015/09/24)
~ Run by Ilina (Administrator)  (28/09/2015то 21:34:03)
~ Site : http://www.nicolascoolman.fr
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Repair
~ Report : C:\Users\Ilina\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Ilina\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Ultimate, 32-bit Service Pack 1 (Build 7601)


---\\  Services (0)
~ No malicious or unnecessary items found.


---\\  Browser internet (0)
~ No malicious or unnecessary items found.


---\\  Hosts file (1)
~ The hosts file is legitimate (1)


---\\  Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.


---\\  Explorer ( File, Folder) (0)
~ No malicious or unnecessary items found.


---\\  Registry ( Key, Value, Data) (10)
DELETED data: HKCR\.html\\Default [Bad : CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED data: HKLM\SOFTWARE\Classes\.html\\Default [Bad : CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED key*: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.htm [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED key*: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.html [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED key*: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.shtml [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED key*: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.xht [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED key*: HKEY_USERS\S-1-5-21-941662184-2812432805-2835303074-1000\Software\Classes\.xhtml [CRSBRWSHTML]  =>PUP.Optional.CrossBrowse
DELETED key*: HKLM\SOFTWARE\Classes\ppsmb [C:\IQIYI Video\LStyle\ppsmb.dll (Not File)]  =>PUP.Optional.IQIYIVideo
DELETED key*: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro []  =>PUP.Optional.WdsManPro
DELETED key*: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\GeePlayer.exe [C:\IQIYI Video\GeePlayer\GeePlayer.exe (Not File)]  =>PUP.Optional.IQIYIVideo


---\\ Result of repair
~ Repair carried out successfully


---\\ Statistics
~ Items scanned : 650
~ Items found : 0
~ Items cancelled : 0
~ Items repaired : 10


~ End of clean in 0 minutes
===================
ZHPCleaner-[R]-28092015-21_34_19.txt
ZHPCleaner--26092015-17_53_50.txt
ZHPCleaner--28092015-21_32_57.txt

Супер!


  2. Моля изтеглете и стартирайте изпълнимия файл от линка отдолу:
    ESET OnlineScan[/*]
  3. Сложете отметката предesetAcceptTerms.png[/*]
  4. Натиснете бутона esetStart.png.[/*]
  5. Сложете отметката пред Enable detection of potentially unwanted applications.[/*]
  6. Сега кликнете на Advanced Settings и се уверете, че опцията Remove found threats не е маркирана, а следните са маркирани:

  7. Scan for potentially unsafe applications[/*]
  8. Enable Anti-Stealth Technology[/*]
  9. Изберете сега бутона Change и изберете само Operating memory и дял C:\[/*]

    [/*]

    fhSji42.png
  10. Scan archives[/*]


[*]ESET ще започне да сваля и инсталира актуализации за вирусните дефиниции и след това ще започне да сканира компютъра. Бъдете търпеливи, защото процеса е бавен и може да отнеме доста време.[/*]
[*]След като проверката приключи натиснете бутонаesetListThreats.png[/*]
[*]Сега натиснете бутона esetExport.png, и запазете файла на десктопа с име по избор като например (ESETScan.txt). Копирайте резултата в следващия си коментар.[/*]
[*]Натиснете бутона esetBack.png и след това натиснете бутона esetFinish.png за да затворите приложението.[/*]

  • Натиснете бутона Start.[/*]
  • Автор

Добро утро!

Най-накрая приключих със сканирането с ESETOnlineScan.

Прикачвам получения резултат.

ESETScan.txt

  • Автор

Здравейте, направих отново сканирането, като маркирах и Remove found threats.

Не сте ми писали дали да прилагам файл, но ще приложа получения LIST , макар че на пръв поглед не намирам разлика с приложения при предишния ми пост.

 

ESET Scan-2.txt

  • Автор

Всъщност сега поогледах файловете, има промяна, извинявам се! 

Също така няма някакви забележими проблеми със системата, всичко изглежда добре, няма забавяне или други видими проблеми.

 

Радвам се, че е така! :)

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

  • Автор

При опит за изтегляне на Delfix,exe получавам  предупреждение, което ще прикача като файл. Мислите ли че ще е безопасно да продължа ?

предупреждение 1.doc

  • Автор

Благодаря, този път се получиха нещата с Delfix  и той си свърши работата - изтри каквото трябваше.

Благодаря много за помощта и са отделеното време Maniac.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.