Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Пакет вируси, спасяване на windows

danchobg
в Премахване на зловреден софтуер

Featured Replies

Здравейте, рещих да инсталирам подозрителен торент без да прегледам коментарите и си получих няколко вируса. Започнаха да се отварят инсталатори и да се инсталират програми на заден фон, при което влязох в safe mode и започнах да трия с hitman pro и UnHackMe. Изтрих доста работи, но не съм сигурен дали съм премахнал всичко и ме е страх да изляза от safe mode. Разполагам с "точка/дял на вузтановяване", който връща лаптопа в заводски вид и форматира харда (оставя само windows + драйвери), но ми е като най-последен вариант. Всичко това е от преди няколко часа, от по-рано няма никакви проблеми.
  

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-10-2015
Ran by Dancho (administrator) on NOTEBOOK-PC (02-11-2015 17:01:26)
Running from C:\Users\Dancho\Desktop
Loaded Profiles: Dancho (Available Profiles: Dancho & Administrator)
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [179288 2014-04-17] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [354144 2013-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296008 2013-10-21] (TOSHIBA Corporation)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3239096 2014-11-24] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [517536 2014-04-07] (TOSHIBA)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-15] (Raptr, Inc)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [523144 2015-09-07] (Autodesk Inc.)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [937592 2015-10-09] (BlueStack Systems, Inc.)
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7451928 2015-03-13] (Piriform Ltd)
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2895552 2015-07-10] (Valve Corporation)
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Run: [f.lux] => C:\Users\Dancho\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Dancho\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Policies\Explorer: [] 
AppInit_DLLs: C:\ProgramData\Medlight\MedStock.dll => C:\ProgramData\Medlight\MedStock.dll [518656 2015-11-02] ()
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2015-02-06] (Autodesk, Inc.)
Startup: C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2015-07-17]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
BootExecute: autocheck autochk * Partizan

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1 activation.cloud.techsmith.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5956C6F3-3A34-4419-BA69-356CD127C256}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5E471CB6-AF22-4A46-A8A8-7B7951DDC8B0}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C0B04515-47D1-47B0-877F-4AD8F4332055}: [DhcpNameServer] 85.118.197.4 85.118.197.68

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://toshiba.eu/symbaloo_c
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://toshiba.eu/symbaloo_c
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2264977531-2208132923-2952205938-1001 -> DefaultScope {E50B0BF1-FF98-4D27-B2D7-C9648BF279EE} URL = 
SearchScopes: HKU\S-1-5-21-2264977531-2208132923-2952205938-1001 -> {E50B0BF1-FF98-4D27-B2D7-C9648BF279EE} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll [2015-09-30] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-09-30] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-13] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-13] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Dancho\AppData\Roaming\Mozilla\Firefox\Profiles\rxeptaj1.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-16] ()
FF Plugin: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-09-30] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-09-30] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-16] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)
FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [No File]
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-13] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-13] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2264977531-2208132923-2952205938-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Dancho\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-12-05] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2264977531-2208132923-2952205938-1001: SkypePlugin -> C:\Users\Dancho\AppData\Local\SkypePlugin\7.3.0.501\npGatewayNpapi.dll [2015-06-05] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-2264977531-2208132923-2952205938-1001: SkypePlugin64 -> C:\Users\Dancho\AppData\Local\SkypePlugin\7.3.0.501\npGatewayNpapi-x64.dll [2015-06-05] (Skype Technologies S.A.)

Chrome: 
=======
CHR Profile: C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Презентации) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-02]
CHR Extension: (Google Документи) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-02]
CHR Extension: (Google Диск) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-02]
CHR Extension: (YouTube) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-02]
CHR Extension: (Google Търсене) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-02]
CHR Extension: (Електронни таблици от Google) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-02]
CHR Extension: (Google Документи офлайн) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-02]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-02]
CHR Extension: (Gmail) - C:\Users\Dancho\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-02]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [1136520 2015-09-07] (Autodesk Inc.)
S2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)
S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [441976 2015-10-09] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [421496 2015-10-09] (BlueStack Systems, Inc.)
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [867960 2015-10-09] (BlueStack Systems, Inc.)
S3 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [21840 2014-06-30] ()
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [135352 2014-11-13] (ELAN Microelectronics Corp.)
S2 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [121288 2014-08-22] (Intel Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344168 2015-08-11] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
S3 IntelUSBoverIP; C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe [395744 2015-01-14] (Intel)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [178312 2015-09-25] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268192 2015-03-19] ()
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2078216 2015-10-11] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1007344 2015-10-15] (Overwolf LTD)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2014-08-05] (Toshiba Europe GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3820960 2015-03-19] (Intel® Corporation)
S2 PerfTraceService; "C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AIDA64Driver; C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Portable\aida64business400\kerneld.x64 [33112 2015-07-10] ()
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
S2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146040 2015-10-09] (BlueStack Systems)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 BthMtpEnum; C:\Windows\system32\DRIVERS\BthMtpEnum.sys [62976 2013-08-22] (Microsoft Corporation)
R0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S2 EnergyDriver; C:\Program Files\Intel\Power Gadget 3.0\EnergyDriver.sys [14224 2014-08-21] ()
S3 ETDSMBus; C:\Windows\system32\DRIVERS\ETDSMBus.sys [23816 2014-04-10] (ELAN Microelectronic Corp.)
R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [41080 2015-11-02] ()
S3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [222152 2014-08-22] (Intel Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2015-11-02] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
S3 NANMp50; C:\Windows\System32\Drivers\NANMp50.sys [46776 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
S3 NANSp50; C:\Windows\System32\Drivers\NANSp50.sys [45752 2010-03-25] (Printing Communications Assoc., Inc. (PCAUSA))
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3497240 2015-03-23] (Intel Corporation)
U0 Partizan; C:\Windows\SysWOW64\drivers\Partizan.sys [40304 2015-11-02] (Greatis Software)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [293592 2014-04-17] (Realtek Semiconductor Corp.)
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-01-23] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [27136 2014-03-24] (Windows (R) Win 7 DDK provider)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [212056 2015-01-14] (Windows (R) Win 7 DDK provider)
S2 uxstyle; C:\Windows\system32\Drivers\uxstyle.sys [31440 2013-09-23] (The Within Network, LLC)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 XSplit_Dummy; C:\Windows\system32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-02 17:01 - 2015-11-02 17:02 - 00018461 _____ C:\Users\Dancho\Desktop\FRST.txt
2015-11-02 17:00 - 2015-11-02 17:01 - 00000000 ____D C:\FRST
2015-11-02 16:59 - 2015-11-02 17:00 - 02198016 _____ (Farbar) C:\Users\Dancho\Desktop\FRST64.exe
2015-11-02 16:34 - 2015-11-02 16:34 - 00041080 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2015-11-02 16:34 - 2015-11-02 16:34 - 00019268 _____ C:\Windows\SysWOW64\PARTIZAN.TXT
2015-11-02 16:34 - 2015-11-02 16:34 - 00007264 _____ C:\Windows\PFRO.log
2015-11-02 16:10 - 2015-11-02 16:10 - 00037678 _____ C:\Windows\system32\.crusader
2015-11-02 15:47 - 2015-11-02 15:47 - 00000000 ____D C:\Program Files\HitmanPro
2015-11-02 15:46 - 2015-11-02 16:10 - 00000000 ____D C:\ProgramData\HitmanPro
2015-11-02 15:46 - 2015-11-02 15:46 - 11336600 _____ (SurfRight B.V.) C:\Users\Dancho\Downloads\HitmanPro_x64.exe
2015-11-02 15:15 - 2015-11-02 15:15 - 00040304 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\Partizan.sys
2015-11-02 15:08 - 2015-11-02 15:08 - 00000000 ____D C:\@RestoreQuarantine
2015-11-02 14:56 - 2015-11-02 15:15 - 00000000 ____D C:\ProgramData\RegRun
2015-11-02 14:55 - 2015-11-02 15:16 - 00000000 ____D C:\Users\Public\Documents\regruninfo
2015-11-02 14:55 - 2015-11-02 15:15 - 00000000 ____D C:\Users\Dancho\Documents\RegRun2
2015-11-02 14:55 - 2015-11-02 14:55 - 00001034 _____ C:\Users\Dancho\Desktop\UnHackMe.lnk
2015-11-02 14:55 - 2015-11-02 14:55 - 00000418 _____ C:\Windows\Tasks\UnHackMe Task Scheduler.job
2015-11-02 14:55 - 2015-11-02 14:55 - 00000002 RSHOT C:\Windows\winstart.bat
2015-11-02 14:55 - 2015-11-02 14:55 - 00000002 RSHOT C:\Windows\SysWOW64\CONFIG.NT
2015-11-02 14:55 - 2015-11-02 14:55 - 00000002 RSHOT C:\Windows\SysWOW64\AUTOEXEC.NT
2015-11-02 14:55 - 2015-11-02 14:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UnHackMe
2015-11-02 14:55 - 2015-11-02 14:55 - 00000000 ____D C:\Program Files (x86)\UnHackMe
2015-11-02 14:55 - 2015-10-09 14:02 - 00012800 _____ (Greatis Software, LLC.) C:\Windows\SysWOW64\Drivers\UnHackMeDrv.sys
2015-11-02 14:55 - 2015-09-17 13:47 - 00047920 _____ (Greatis Software) C:\Windows\system32\partizan.exe
2015-11-02 14:21 - 2015-11-02 14:21 - 00002250 _____ C:\Users\Dancho\Desktop\QQ浏览器.lnk
2015-11-02 14:21 - 2015-11-02 14:21 - 00002116 _____ C:\Users\Dancho\Desktop\上网导航.lnk
2015-11-02 14:20 - 2015-11-02 14:20 - 00001729 _____ C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺PPS影音.lnk
2015-11-02 14:20 - 2015-11-02 14:20 - 00001695 _____ C:\Users\Dancho\Desktop\爱奇艺PPS 影音.lnk
2015-11-02 14:20 - 2015-11-02 14:20 - 00000000 ____D C:\Users\Dancho\AppData\LocalLow\Unity
2015-11-02 14:20 - 2015-11-02 14:20 - 00000000 ____D C:\Users\Dancho\AppData\Local\Unity
2015-11-02 14:15 - 2015-11-02 15:10 - 00000000 ____D C:\ProgramData\Medlight
2015-11-02 14:15 - 2015-11-02 15:05 - 00000000 ____D C:\ProgramData\ApplicationHosting
2015-11-02 14:15 - 2015-11-02 14:15 - 00001148 _____ C:\Users\Dancho\Desktop\Continue Keep%20Talking%20and%20Nobody%20Explod Installation.lnk
2015-11-02 14:14 - 2015-11-02 14:14 - 00002524 _____ C:\Users\Dancho\Desktop\SevenZip.lnk
2015-11-02 14:02 - 2015-11-02 14:02 - 00000000 ____D C:\Users\Dancho\Documents\Paradox Interactive
2015-11-02 13:59 - 2015-11-02 13:59 - 00001563 _____ C:\Users\Public\Desktop\Europa Universalis IV Common Sense.lnk
2015-11-02 13:59 - 2015-11-02 13:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive
2015-11-02 13:50 - 2015-11-02 13:50 - 00000000 ____D C:\Program Files (x86)\Paradox Interactive
2015-11-01 09:51 - 2015-11-02 14:20 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\Earth Alerts
2015-11-01 09:48 - 2015-11-01 09:48 - 00001937 _____ C:\Users\Public\Desktop\Earth Alerts.lnk
2015-11-01 09:48 - 2015-11-01 09:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Earth Alerts
2015-11-01 09:48 - 2015-11-01 09:48 - 00000000 ____D C:\Program Files (x86)\Earth Alerts
2015-10-30 20:17 - 2015-11-02 14:12 - 00000000 ____D C:\Program Files (x86)\R.G. BoxPack
2015-10-28 00:35 - 2015-10-28 00:35 - 00000000 ____D C:\Users\Dancho\Documents\CPY_SAVES
2015-10-28 00:34 - 2015-10-28 00:34 - 00002065 _____ C:\Users\Dancho\Desktop\Life Is Strange.lnk
2015-10-28 00:34 - 2015-10-28 00:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Life Is Strange
2015-10-28 00:30 - 2015-10-28 00:30 - 00000000 ____D C:\R.G. Revenants
2015-10-24 12:19 - 2015-10-24 12:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AIMP3
2015-10-24 11:00 - 2015-11-01 11:09 - 00000000 ____D C:\Program Files (x86)\CABAL2 (US)
2015-10-22 14:20 - 2015-10-22 18:59 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\RIFT
2015-10-22 14:20 - 2015-10-22 14:20 - 00000000 ____D C:\Users\Dancho\Documents\RIFT
2015-10-22 13:48 - 2015-10-23 16:19 - 00000000 ____D C:\Users\Dancho\AppData\Local\Glyph
2015-10-22 13:48 - 2015-10-23 14:52 - 00000000 ____D C:\Program Files (x86)\Glyph
2015-10-22 13:48 - 2015-10-22 13:50 - 00000000 ____D C:\ProgramData\Glyph
2015-10-22 13:48 - 2015-10-22 13:48 - 00001024 _____ C:\Users\Dancho\Desktop\Glyph.lnk
2015-10-22 13:48 - 2015-10-22 13:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glyph
2015-10-15 00:05 - 2015-11-02 13:09 - 02004478 ____N C:\Windows\WindowsUpdate.log
2015-10-14 17:02 - 2015-10-14 17:02 - 00000000 ____D C:\Users\Dancho\.android
2015-10-14 16:58 - 2015-10-14 16:58 - 00001724 _____ C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\BlueStacks.lnk
2015-10-14 16:58 - 2015-10-14 16:58 - 00001700 _____ C:\Users\Public\Desktop\BlueStacks.lnk
2015-10-14 16:58 - 2015-10-14 16:58 - 00000000 ____D C:\ProgramData\BlueStacksGameManager
2015-10-14 16:55 - 2015-10-14 16:57 - 00000000 ____D C:\Program Files (x86)\BlueStacks
2015-10-14 16:55 - 2015-10-14 16:55 - 00000000 ____D C:\ProgramData\BlueStacks
2015-10-14 16:54 - 2015-10-14 23:14 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2015-10-14 16:54 - 2015-10-14 16:54 - 00000000 ____D C:\Users\Dancho\AppData\Local\Bluestacks
2015-10-13 12:24 - 2015-10-13 12:24 - 04587520 _____ (Google Inc.) C:\Windows\SysWOW64\GPhotos.scr
2015-10-11 14:06 - 2015-10-11 14:06 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\java
2015-10-11 14:05 - 2015-10-11 14:05 - 00002152 _____ C:\Users\Dancho\Desktop\Minecraft.lnk
2015-10-11 14:05 - 2015-10-11 14:05 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft
2015-10-11 14:04 - 2015-10-11 14:10 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\.minecraft
2015-10-11 13:22 - 2015-10-11 13:22 - 00000000 ____D C:\Program Files (x86)\Origin Games
2015-10-11 11:37 - 2015-10-11 11:39 - 00000000 ____D C:\Users\Dancho\Documents\STAR WARS Battlefront Beta
2015-10-07 11:51 - 2015-10-07 11:58 - 00000000 ____D C:\Users\Dancho\AppData\Local\UNDERTALE
2015-10-05 21:32 - 2015-10-05 21:32 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\LibreOffice
2015-10-05 19:12 - 2015-10-05 19:12 - 00001420 _____ C:\Users\Public\Desktop\LibreOffice 5.0.lnk
2015-10-05 19:12 - 2015-10-05 19:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.0
2015-10-05 19:09 - 2015-10-05 19:11 - 00000000 ____D C:\Program Files (x86)\LibreOffice 5
2015-10-04 10:09 - 2015-10-04 10:09 - 00000000 ____D C:\Users\Dancho\AppData\Local\Smellyriver
2015-10-03 23:40 - 2015-10-03 23:40 - 00000000 ____D C:\ProgramData\FLEXnet
2015-10-03 23:34 - 2015-10-03 23:34 - 00002291 _____ C:\Users\Dancho\Desktop\Install Now Autodesk® AutoCAD® 2016.lnk
2015-10-03 23:34 - 2015-10-03 23:34 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Autodesk
2015-10-03 23:33 - 2015-10-03 23:33 - 00000000 ____D C:\Users\Dancho\Documents\Autodesk Application Manager
2015-10-03 23:32 - 2015-10-03 23:32 - 00000000 ____D C:\ProgramData\FARO
2015-10-03 23:31 - 2015-10-03 23:31 - 00002111 _____ C:\Users\Public\Desktop\Autodesk ReCap 2016.lnk
2015-10-03 23:31 - 2015-10-03 23:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk ReCap 2016
2015-10-03 23:27 - 2015-10-03 23:27 - 00000000 ____D C:\Program Files (x86)\Autodesk
2015-10-03 23:26 - 2015-10-03 23:46 - 00000000 ____D C:\Users\Dancho\AppData\Local\Autodesk
2015-10-03 23:26 - 2015-10-03 23:26 - 00002125 _____ C:\Users\Public\Desktop\AutoCAD 2016 - English.lnk
2015-10-03 23:26 - 2015-10-03 23:26 - 00000000 ____D C:\Users\Public\Documents\Autodesk
2015-10-03 23:26 - 2015-10-03 23:26 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared
2015-10-03 23:25 - 2015-10-03 23:25 - 00000000 ____D C:\Users\Dancho\Documents\Inventor Server SDK ACAD 2016
2015-10-03 23:23 - 2015-10-03 23:23 - 00000133 _____ C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2015-10-03 23:15 - 2015-10-03 23:33 - 00000000 ____D C:\Program Files\Common Files\Autodesk Shared
2015-10-03 23:15 - 2015-10-03 23:31 - 00000000 ____D C:\Program Files\Autodesk
2015-10-03 23:13 - 2015-10-03 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2015-10-03 23:04 - 2015-10-04 00:20 - 00000000 ____D C:\ProgramData\Autodesk
2015-10-03 23:04 - 2015-10-03 23:42 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\Autodesk
2015-10-03 23:03 - 2015-10-03 23:04 - 00000000 ____D C:\Users\Dancho\AppData\Local\Akamai
2015-10-03 23:02 - 2015-10-03 23:03 - 00000000 ____D C:\Autodesk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-02 16:45 - 2015-03-26 17:01 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\ClassicShell
2015-11-02 16:07 - 2015-03-26 15:49 - 00000000 ____D C:\Windows\pss
2015-11-02 15:19 - 2015-03-26 16:02 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\AIMP3
2015-11-02 14:53 - 2015-03-26 15:58 - 00000000 ____D C:\DATA
2015-11-02 14:47 - 2015-04-13 20:59 - 00000000 ____D C:\Users\Dancho\AppData\Local\CrashDumps
2015-11-02 14:32 - 2015-03-29 16:27 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-02 14:31 - 2015-03-26 14:05 - 00000000 ____D C:\Users\Dancho
2015-11-02 14:29 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-02 14:23 - 2013-08-22 16:44 - 00464392 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-02 14:21 - 2015-07-15 09:06 - 00001030 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-02 14:21 - 2015-03-26 14:39 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\Skype
2015-11-02 14:16 - 2015-03-29 11:09 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\qBittorrent
2015-11-02 14:02 - 2015-04-19 19:01 - 00000000 ____D C:\Users\Dancho\AppData\Local\SKIDROW
2015-11-02 14:02 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-11-02 14:01 - 2014-03-18 11:47 - 00865408 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-02 13:59 - 2015-08-23 14:17 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-02 12:42 - 2015-01-13 03:16 - 00006469 _____ C:\Windows\SysWOW64\Gms.log
2015-11-02 12:40 - 2015-07-15 09:06 - 00001026 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-02 12:39 - 2015-03-29 11:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-02 01:09 - 2015-01-13 03:52 - 10698572 _____ C:\Users\Public\CAFADEBUG.log
2015-11-01 09:40 - 2015-03-29 11:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-31 15:36 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-10-29 17:46 - 2015-03-29 11:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
2015-10-29 00:50 - 2013-08-22 15:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2015-10-28 00:34 - 2015-04-13 11:46 - 00000000 ___HD C:\Windows\msdownld.tmp
2015-10-28 00:34 - 2015-04-13 11:46 - 00000000 ____D C:\Windows\SysWOW64\directx
2015-10-26 20:27 - 2015-09-20 13:50 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\TS3Client
2015-10-26 15:35 - 2015-06-28 18:00 - 00000000 ____D C:\Users\Dancho\AppData\Roaming\vlc
2015-10-25 13:58 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2015-10-25 13:54 - 2015-03-26 14:08 - 00000000 ____D C:\Users\Dancho\AppData\Local\Packages
2015-10-24 21:27 - 2015-07-15 09:06 - 00002212 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-10-24 12:19 - 2015-07-09 22:58 - 00000932 _____ C:\Users\Public\Desktop\AIMP3.lnk
2015-10-24 12:19 - 2015-03-26 16:02 - 00000000 ____D C:\Program Files (x86)\AIMP3
2015-10-24 11:01 - 2015-06-27 13:57 - 00001089 _____ C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\CABAL2 (US).lnk
2015-10-24 11:01 - 2015-06-27 13:57 - 00001065 _____ C:\Users\Dancho\Desktop\CABAL2 (US).lnk
2015-10-23 15:16 - 2015-09-20 21:16 - 00000000 ____D C:\Program Files (x86)\Overwolf
2015-10-18 22:44 - 2015-04-20 10:37 - 00000000 ____D C:\Users\Dancho\Documents\MATLAB
2015-10-18 17:54 - 2015-05-10 09:57 - 00000000 __SHD C:\Users\Dancho\AppData\LocalLow\EmieBrowserModeList
2015-10-18 17:54 - 2015-03-26 14:18 - 00000000 __SHD C:\Users\Dancho\AppData\LocalLow\EmieUserList
2015-10-18 17:54 - 2015-03-26 14:18 - 00000000 __SHD C:\Users\Dancho\AppData\LocalLow\EmieSiteList
2015-10-16 20:59 - 2015-08-23 14:17 - 00003718 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-10-14 23:20 - 2015-03-29 19:51 - 00000000 ____D C:\AdwCleaner
2015-10-14 23:15 - 2015-03-29 16:27 - 00001129 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-10-14 23:15 - 2015-03-29 16:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-10-14 23:15 - 2015-03-29 16:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-10-14 16:57 - 2013-08-22 17:36 - 00000000 __RHD C:\Users\Public\Libraries
2015-10-11 11:36 - 2015-01-13 03:07 - 00000000 ____D C:\ProgramData\Package Cache
2015-10-11 10:43 - 2015-06-29 19:05 - 00000000 ____D C:\ProgramData\Origin
2015-10-11 10:36 - 2015-06-29 19:05 - 00000000 ____D C:\Program Files (x86)\Origin
2015-10-05 08:50 - 2015-03-29 16:27 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-10-05 08:50 - 2015-03-29 16:27 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-10-05 08:50 - 2015-03-29 16:27 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-10-04 13:50 - 2015-04-13 14:18 - 00000000 ____D C:\Users\Dancho\Documents\Camtasia Studio
2015-10-04 13:45 - 2015-04-13 14:23 - 00007168 _____ C:\Users\Dancho\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Files in the root of some directories =======

2015-04-13 14:23 - 2015-10-04 13:45 - 0007168 _____ () C:\Users\Dancho\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-21 23:13 - 2015-04-21 23:13 - 0000173 _____ () C:\Users\Dancho\AppData\Local\msmathematics.qat.Dancho
2015-04-19 14:27 - 2015-04-19 14:27 - 0000708 _____ () C:\Users\Dancho\AppData\Local\recently-used.xbel
2015-03-26 15:49 - 2015-08-28 15:10 - 0007590 _____ () C:\Users\Dancho\AppData\Local\Resmon.ResmonCfg
1999-07-07 02:00 - 1999-07-07 02:00 - 0000006 __RSH () C:\ProgramData\DE280AC2-0786-4476-96E5-D6E6370396FE
2015-10-03 23:23 - 2015-10-03 23:23 - 0000133 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


safeboot: {8ce62d78-9b08-11e4-abf4-2c600c470e8a} => The system is configured to boot to Safe Mode <===== ATTENTION


LastRegBack: 2015-01-13 11:45

==================== End of FRST.txt ============================

 

Addition.txt

Здравейте,

Не знам какво сте правили, но според лог файловете акаунта ви е повреден. Като цяло Unhackme и RegRun Reanimator са мощни програми, но ако не се използват внимателно и могат да причинят доста щети.

Цитат

 

Error: (11/02/2015 04:36:37 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
DETAIL - The configuration registry database is corrupt for C:\Users\Dancho\AppData\Local\Microsoft\Windows\\UsrClass.dat

Error: (11/02/2015 04:36:37 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1508) (User: NT AUTHORITY)
Description: Windows was unable to load the registry. This problem is often caused by insufficient memory or insufficient security rights.

 

Може да се наложи да направите нов потребителски акаунт:

http://www.howtogeek.com/226540/how-to-create-a-new-local-user-account-in-windows-10/

Аз написах скрипт за почистването на гадинките, но преди да продължим е желателно да се оправят поразиите по акаунта ви. Може да се наложи да използвате System Restore (не, това не е опцията, за която вие говорите в началото на темата за връщане на системата до фабричните настройки - тя се казва Factory Reset) и да проверите дали проблема с акаунта ви ще е още налице. И чак след това да продължим с чистенето. За момента имате само 2 точки на възстановяване и няма гаранция, че те ще съдържат читаво копие на настройките на акаунта ви:

Цитат

18-10-2015 22:27:57 OpenOffice 4.1.1 е премахнат
01-11-2015 09:47:38 Installed Earth Alerts.

Поздрави!

 

 

 

  • Автор

Искате да използвам System Restore и да пусна нови логове от Farbar Recovery Scan Tool? А в какво се изразяват тези повреди по акаунта? В момента съм буутнал нормално и не откривам явни проблеми по акаунта.

Според лог файловете имате повредени системни файлове (тези в които се съхранява информацията за акаунта ви) - UsrClass.dat.

Както и да е. Изтеглете edit-text.giffixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

  • Автор

Ето лог файла. 
  

Fix result of Farbar Recovery Scan Tool (x64) Version:31-10-2015
Ran by Dancho (2015-11-02 20:59:50) Run:1
Running from C:\Users\Dancho\Desktop
Loaded Profiles: Dancho (Available Profiles: Dancho & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\...\Policies\Explorer: [] 
AppInit_DLLs: C:\ProgramData\Medlight\MedStock.dll => C:\ProgramData\Medlight\MedStock.dll [518656 2015-11-02] ()
S2 PerfTraceService; "C:\Program Files (x86)\Tencent\QQBrowser\Service\PerfTraceService.exe" [X]
cmd: type C:\Windows\SysWOW64\PARTIZAN.TXT
2015-11-02 14:21 - 2015-11-02 14:21 - 00002250 _____ C:\Users\Dancho\Desktop\QQ浏览器.lnk
2015-11-02 14:21 - 2015-11-02 14:21 - 00002116 _____ C:\Users\Dancho\Desktop\上网导航.lnk
2015-11-02 14:20 - 2015-11-02 14:20 - 00001729 _____ C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺PPS影音.lnk
2015-11-02 14:20 - 2015-11-02 14:20 - 00001695 _____ C:\Users\Dancho\Desktop\爱奇艺PPS 影音.lnk
2015-11-02 14:15 - 2015-11-02 15:10 - 00000000 ____D C:\ProgramData\Medlight
2015-11-02 14:15 - 2015-11-02 15:05 - 00000000 ____D C:\ProgramData\ApplicationHosting
Task: {1B4D9FD3-8C2E-4756-9EF7-BAFDAD1ED857} - \Optimize Start Menu Cache Files-S-1-5-21-2264977531-2208132923-2952205938-500 -> No File <==== ATTENTION
Task: {4112CCE3-DCF5-4565-BF1E-DC23074674E4} - \QQBrowser Udpater Task -> No File <==== ATTENTION
Task: {513CA36C-71BC-46A1-9833-B716F150C30E} - \Optimize Start Menu Cache Files-S-1-5-21-2264977531-2208132923-2952205938-1001 -> No File <==== ATTENTION
Task: {5DB936F7-F801-4ADC-8DE2-AC327AADD43A} - \Optimize Start Menu Cache Files-S-1-5-21-2264977531-2208132923-2952205938-1002 -> No File <==== ATTENTION
Task: {94E47966-60D3-451A-AF1F-BF7BE21ADB92} - \Overwolf Updater Task -> No File <==== ATTENTION
Task: {A2E34D8B-95C8-4DE4-BD31-08CEB325655A} - \QQBrowser Udpater Task(Core) -> No File <==== ATTENTION
Reg: reg delete "HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder /v 爱奇艺PPS影音.lnk /f
FirewallRules: [{9DA50F28-E1A0-4C58-9C49-B5FC81989688}] => (Allow) C:\Users\Dancho\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe
FirewallRules: [{6490FFB2-F59A-4DF6-9324-7C990EFE6841}] => (Allow) C:\IQIYI Video\LStyle\QyClient.exe
FirewallRules: [{8968703A-B935-4A3B-814F-BE592A6334AF}] => (Allow) C:\IQIYI Video\LStyle\QyWebPlayer.exe
FirewallRules: [{B5BBD875-E401-4CB3-9DCA-D74B2C51C79F}] => (Allow) C:\IQIYI Video\Common\QyKernel.exe
FirewallRules: [{AF418F99-C63A-47E1-BA9A-CC2BBA6B9A36}] => (Allow) C:\IQIYI Video\LStyle\QyPlayer.exe
FirewallRules: [{256B1CFB-C438-4E53-B14F-7C287AC172B1}] => (Allow) C:\Program Files (x86)\Tencent\QQBrowser\QQBrowser.exe
FirewallRules: [{20347170-7A50-48A6-8B35-86EEB4CCA3FC}] => (Allow) C:\Program Files (x86)\Tencent\QQBrowser\BugReport.exe
FirewallRules: [{66F948E1-59BA-4821-B3BE-2639E8EB830D}] => (Allow) C:\Users\Dancho\AppData\Roaming\Tencent\QQBrowser\Liveup\Temp\QQBrowserLiveup.exe
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
EmptyTemp:
End
*****************

HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value removed successfully
"C:\ProgramData\Medlight\MedStock.dll" => Value data removed successfully.
PerfTraceService => service not found.

=========  type C:\Windows\SysWOW64\PARTIZAN.TXT =========

Partizan 2.1 started.
Day: 2. Month:11.2015 Time (GMT +0):16:56:9
Windows Version:6.3 Build:9600
Found 64-bit system.


========= End of CMD: =========

"C:\Users\Dancho\Desktop\QQ浏览器.lnk" => not found.
"C:\Users\Dancho\Desktop\上网导航.lnk" => not found.
"C:\Users\Dancho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺PPS影音.lnk" => not found.
"C:\Users\Dancho\Desktop\爱奇艺PPS 影音.lnk" => not found.
C:\ProgramData\Medlight => moved successfully
"C:\ProgramData\ApplicationHosting" => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1B4D9FD3-8C2E-4756-9EF7-BAFDAD1ED857}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1B4D9FD3-8C2E-4756-9EF7-BAFDAD1ED857}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-2264977531-2208132923-2952205938-500" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4112CCE3-DCF5-4565-BF1E-DC23074674E4} => key not found. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QQBrowser Udpater Task => key not found. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{513CA36C-71BC-46A1-9833-B716F150C30E} => key not found. 
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-2264977531-2208132923-2952205938-1001" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5DB936F7-F801-4ADC-8DE2-AC327AADD43A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5DB936F7-F801-4ADC-8DE2-AC327AADD43A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimize Start Menu Cache Files-S-1-5-21-2264977531-2208132923-2952205938-1002" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{94E47966-60D3-451A-AF1F-BF7BE21ADB92}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{94E47966-60D3-451A-AF1F-BF7BE21ADB92}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Overwolf Updater Task" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A2E34D8B-95C8-4DE4-BD31-08CEB325655A} => key not found. 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QQBrowser Udpater Task(Core) => key not found. 

========= reg delete "HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder /v 爱奇艺PPS影音.lnk /f =========



========= End of Reg: =========

HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{9DA50F28-E1A0-4C58-9C49-B5FC81989688} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6490FFB2-F59A-4DF6-9324-7C990EFE6841} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{8968703A-B935-4A3B-814F-BE592A6334AF} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B5BBD875-E401-4CB3-9DCA-D74B2C51C79F} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{AF418F99-C63A-47E1-BA9A-CC2BBA6B9A36} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{256B1CFB-C438-4E53-B14F-7C287AC172B1} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{20347170-7A50-48A6-8B35-86EEB4CCA3FC} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{66F948E1-59BA-4821-B3BE-2639E8EB830D} => value removed successfully

=========  bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.7.9600 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========


=========  netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========

EmptyTemp: => 852.4 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 21:01:21 ====

всъщност имам един дребен проблем, от около месец е, paint не се стартира, това може ли да се дължи на онези грешки за акаунта?

Редактирано от danchobg (преглед на промените)

Всичко е възможно. Нека да проверим за остатъци:

 

СТЪПКА 1

 

  • Изтеглете и стартирайтe 6sv1DN9.jpgAdwCleaner.exe.
  • От Options => сложете всички отметки (без последната).
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[C0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието му в следващия си коментар.

 

 

СТЪПКА 2

 

 

Моля изтеглете icon1351185104.png Junkware Removal Tool на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

 

СТЪПКА 3

 

 

Направете нова проверка с FRST като се уверите, че има отметка пред Addition.txt преди да натиснете бутона SCAN.

Прикачете новите два лог файла - FRST.txt и Addition.txt в следващия си коментар.

 

Поздрави! ;)

  • Автор

 

 

Ще обновявам поста с всеки нов лог. 
ADW Cleaner (Не откри файлове, за които да слагам отметки)
  

# AdwCleaner v5.016 - Logfile created 02/11/2015 at 21:57:02
# Updated 01/11/2015 by Xplode
# Database : 2015-11-01.2 [Server]
# Operating system : Windows 8.1  (x64)
# Username : Dancho - NOTEBOOK-PC
# Running from : C:\Users\Dancho\Downloads\adwcleaner_5.016 (1).exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Proxy settings cleared
:: Winsock settings cleared
:: TCP/IP settings cleared
:: Firewall settings cleared
:: IPSec settings cleared
:: BITS queue cleared
:: Chrome policies deleted

########## EOF - C:\AdwCleaner\AdwCleaner[C5].txt - [829 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 8.1 x64
Ran by Dancho on Ї®­ 02.11.2015 Ј. at 22:04:43,60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\Windows\SysWOW64\ai_recyclebin



~~~ Chrome


[C:\Users\Dancho\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Dancho\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Dancho\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Dancho\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Ї®­ 02.11.2015 Ј. at 22:07:49,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

Addition.txt

FRST.txt

Редактирано от danchobg (преглед на промените)

На този етап системата изглежда чиста, но продължава да генерира грешки свързани с профила.

А иначе какво се случва при опит за стартиране на mspaint.exe? Изобщо файла има ли го в C:\Windows\System32\mspaint.exe ?

 

СТЪПКА 1

 

Проверете дяла и за грешки и лоши сектори и да поправим някои от проблемите с файловата система.

В полето за търсене CMD => кликнете върху файла CMD.exe и изберете Run as administrator => въведете командата: chkdsk c: /x /f /r => натиснете Enter

Съгласете се с Y на диалоговия прозорец. Рестартирайте компютъра и би трябвало проверката да започне.След това вижте какви са били резултатите.

Рапорта от проверката ще намерите тук: В полето за търсене въведете eventvwr.msc => Аpplications => събитие WinInit Event ID 1001. Kопирайте рапорта в следващия си пост.

Ето как да намерите лог файла.

Ако с командата ви е трудно просто отворете My Computer => кликнете с десен бутон на дял C:\ и изберете Properties => отидете на Tools => Check Now... => сложете двете отметки и натиснете бутона Start. Рестартирайте системата и изчакайте проверката да приключи (може да мине над час). След това проверете отново и публикувайте лог файла от последната дата.

 

СТЪПКА 2

 

В полето за търсене на Windows въведете CMD => кликнете с десен бутон върху CMD.exe и изберете Run as administrator.

След това с копи/пейст изпълнете една по една командите и след всяка натиснете Enter

sfc /scannow

findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"

Сега трябва да се появи sfcdetails.txt на десктопа. Прикачете файла, който ще се появи на десктопа - sfcdetails.txt в следващия си коментар и пишете дали има промяна.

 

СТЪПКА 3

 

Изтеглете и стартирайте файла SFCFix.exe.с десен клик на мишката => Run as administraror.

Следвайте инструкциите, които ще се появят подканващи ви да натиснете произволен клавиш от клавиатурата.

Ако ви поиска инсталационния диск на места, го поставете в оптичното устройство преди да натиснете ОК.

Публикувайте лог файла, който ще се появи.

 

Поздрави!

  • Автор

Да, файла го има. При стартиране дава индикация за зареждане за част от секундата и нищо повече, няма и процес в taskm.
Ще пусна проверката на диска, но относно СТЪПКА 3, нямам диск или флашка с оригиналното копие на Windows. Лаптопа дойде с инсталиран Win 8.1 (дори няма cd устройство).

Нищо и без диск програмата е достатъчно умна за да извърши редица диагностики използвайте вградените възможности на Windows 8 в лицето на DISM. :)

  • Автор
Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          3.11.2015 г. 3:27:37
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      NOTEBOOK-PC
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is TI31419900A.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  851712 file records processed.                                                        

File verification completed.
  13165 large file records processed.                                   

  0 bad file records processed.                                     


Stage 2: Examining file name linkage ...
  1063134 index entries processed.                                                       

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      


Stage 3: Examining security descriptors ...
Cleaning up 2421 unused index entries from index $SII of file 0x9.
Cleaning up 2421 unused index entries from index $SDH of file 0x9.
Cleaning up 2421 unused security descriptors.
Security descriptor verification completed.
  105712 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37208152 USN bytes processed.                                                           

Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  851696 files processed.                                                               

File data verification completed.

Stage 5: Looking for bad, free clusters ...
  50973024 free clusters processed.                                                       

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.

Windows has made corrections to the file system.
No further action is required.

 963575807 KB total disk space.
 758355628 KB in 652906 files.
    339168 KB in 105713 indexes.
         0 KB in bad sectors.
    988911 KB in use by the system.
     65536 KB occupied by the log file.
 203892100 KB available on disk.

      4096 bytes in each allocation unit.
 240893951 total allocation units on disk.
  50973025 allocation units available on disk.

Internal Info:
00 ff 0c 00 62 93 0b 00 4a 94 15 00 00 00 00 00  ....b...J.......
e4 03 00 00 42 00 00 00 00 00 00 00 00 00 00 00  ....B...........

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-11-03T01:27:37.000000000Z" />
    <EventRecordID>50241</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>NOTEBOOK-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is TI31419900A.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  851712 file records processed.                                                        

File verification completed.
  13165 large file records processed.                                   

  0 bad file records processed.                                     


Stage 2: Examining file name linkage ...
  1063134 index entries processed.                                                       

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      


Stage 3: Examining security descriptors ...
Cleaning up 2421 unused index entries from index $SII of file 0x9.
Cleaning up 2421 unused index entries from index $SDH of file 0x9.
Cleaning up 2421 unused security descriptors.
Security descriptor verification completed.
  105712 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37208152 USN bytes processed.                                                           

Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  851696 files processed.                                                               

File data verification completed.

Stage 5: Looking for bad, free clusters ...
  50973024 free clusters processed.                                                       

Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.

Windows has made corrections to the file system.
No further action is required.

 963575807 KB total disk space.
 758355628 KB in 652906 files.
    339168 KB in 105713 indexes.
         0 KB in bad sectors.
    988911 KB in use by the system.
     65536 KB occupied by the log file.
 203892100 KB available on disk.

      4096 bytes in each allocation unit.
 240893951 total allocation units on disk.
  50973025 allocation units available on disk.

Internal Info:
00 ff 0c 00 62 93 0b 00 4a 94 15 00 00 00 00 00  ....b...J.......
e4 03 00 00 42 00 00 00 00 00 00 00 00 00 00 00  ....B...........

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

 

 

sfcdetails.txt

  

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-11-03 08:47:00.214
Microsoft Windows 8.1 Update 3 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-11-03 08:47:26.358
----------------------EOF-----------------------

 

Редактирано от danchobg (преглед на промените)

Chkdsk е поправил някои грешки с файловата система, а sfc е възстановил един файл от ribbon интерфейса. Той се използва и в Paint-a. Пробвайте отново да стартирате програмата и вижте дали е успешно.

  • Автор

Да! Paint стартира! Повреден файл е бил проблема? Благодаря!

Да, явно повредения файл е бил проблема:

Цитат

2015-11-03 08:27:21, Info                  CSI    000005ca [SR] Beginning Verify and Repair transaction
2015-11-03 08:27:26, Info                  CSI    000005d0 [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:24{12}]"UIRibbon.dll" from store

Друга опция за която се сетих бе зловреден софтуер да е добавил Image File Execution Options в регистрите и да възпрепятства стартирането на инструмента, но явно не е от това.

Други проблеми останаха ли? Да направим финални проверки и да приключваме. Все пак не е зле да си създадете втори профил и при тотална повреда на текущия да използвате новия (но той ще е без никакви персонални настройки, все едно току що сте преинсталирали Windows-a).

СТЪПКА 1

 

Моля изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

DkgJ7Zr.png

  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.

65ZBqkR.jpg

  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

СТЪПКА 2

 

1.Изтеглете Hitman Pro.

За 32-битова система - dEMD6.gif.
За 64-битова система - Download-button3.gif

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 
6-scanfin-choose.jpg
 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар. :)

 

СТЪПКА 3

 

emsisoft_emergency_kit.pnglogo.png

  • Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
  • Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
  • Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

EKK.gif

  • След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
  • Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
  • Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
  • Натиснете Next за да започне проверката.
  • Когато проверката приключи натиснете бутона View Report.
  • Копирайте съдържанието на лог файла в следващия си коментар.

 

Поздрави!

  • Автор
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3.11.2015 г.
Scan Time: 9:05
Logfile: 
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.11.03.02
Rootkit Database: v2015.10.28.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Dancho

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 404337
Time Elapsed: 24 min, 18 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.ChinAd, HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}, Quarantined, [7c226019aeddb482ca57338d38cbd22e], 
PUP.Optional.ChinAd, HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}, Quarantined, [9806ec8d94f7ca6c7da48937bb48847c], 

Registry Values: 2
PUP.Optional.ChinAd, HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}|AppPath, C:\IQIYI Video\LStyle\, Quarantined, [7c226019aeddb482ca57338d38cbd22e]
PUP.Optional.ChinAd, HKU\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}|AppPath, C:\IQIYI Video\LStyle\, Quarantined, [9806ec8d94f7ca6c7da48937bb48847c]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.IQIYI, C:\Windows\Fonts\iqiyi_logo.ttf, Quarantined, [dac48fea8704bf7774331854e122d42c], 

Physical Sectors: 0
(No malicious items detected)


(end)
!!!! не ми поиска рестарт

 

HitmanPro_20151103_0944.rar

  

Emsisoft Emergency Kit - Version 10.0
Last update: 3.11.2015 г. 10:04:00
User account: NOTEBOOK-PC\Dancho

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:	3.11.2015 г. 10:04:48
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AC3\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AMR\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AMV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.APE\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.BIK\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.CSF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.F4V\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.FLAC\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.FLV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.GPLF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.IDX\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MKV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP5\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPC\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.OGG\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.OGM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PFV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PMF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PMP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PVA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.QSV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.QT\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RAM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RMVB\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SRT\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SSA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SUB\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TTA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3G2\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GP2\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GPP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AAC\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AIF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AIFF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASX\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AVI\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.CDA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.DVR-MS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M2TS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4A\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4B\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4P\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4V\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MID\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MIDI\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MOD\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MOV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP2\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP3\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP4\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPE\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPEG\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPG\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RMI\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.VOB\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WMA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WMV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Value: HKEY_USERS\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR 	detected: Setting.DisableTaskMgr (A)
Value: HKEY_USERS\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS 	detected: Setting.DisableRegistryTools (A)
C:\DATA\AutoHotkey112202_Install.exe -> (7z o) -> Compiler/ANSI 32-bit.bin 	detected: Gen:Variant.Mikey.27128 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Keygen-CHiLi\Keygen-CHiLi.rar -> chili-keygen.exe 	detected: Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Keygen-CHiLi\chili-keygen.exe 	detected: Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Portable\Keygen-CHiLi.rar -> chili-keygen.exe 	detected: Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\Malwarebytes Anti-Malware Premium v2.1.4.1018 Final\Keygen.rar -> Keygen.exe 	detected: Trojan.GenericKD.2795078 (B)
C:\DATA\PROGRAMS\OpenCanvas 6.0.12.zip -> OpenCanvas 6.0.12/openCanvas.6.0.Patch-MPT/opencanvas.6.0.[x64]-MPT.exe 	detected: Gen:Variant.Application.Kazy.133014 (B)
C:\DATA\PROGRAMS\OpenCanvas 6.0.12.zip -> OpenCanvas 6.0.12/openCanvas.6.0.Patch-MPT/opencanvas.6.0.[x86]-MPT.exe 	detected: Dropped:Trojan.Generic.13186901 (B)
C:\DATA\PROGRAMS\WinRAR v5.21 Final (x32-x64) BG\KEYGEN-FFF.exe 	detected: Riskware.Win32.Keygen (A)
C:\DATA\Unlocker1.9.2.exe 	detected: Application.Win32.InstallTool (A)
C:\Users\Dancho\Downloads\Core-Temp-installer (1).exe 	detected: Application.InstallAd (A)
C:\Users\Dancho\Downloads\Core-Temp-installer.exe 	detected: Application.InstallAd (A)

Scanned	800077
Found	78

Scan end:	3.11.2015 г. 12:18:02
Scan time:	2:13:14

 

Редактирано от danchobg (преглед на промените)

Повторете проверката с EmsisoftEmergencyKit и този път изберете Quarantine Selected.

След това публикувайте новия лог файл.

Пишете после и как е положението.

 

Поздрави!

  • Автор
Emsisoft Emergency Kit - Version 10.0
Last update: 3.11.2015 г. 10:04:00
User account: NOTEBOOK-PC\Dancho

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:	3.11.2015 г. 23:30:11
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AC3\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AMR\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AMV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.APE\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.BIK\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.CSF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.F4V\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.FLAC\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.FLV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.GPLF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.IDX\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MKV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP5\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPC\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.OGG\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.OGM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PFV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PMF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PMP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PVA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.QSV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.QT\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RAM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RMVB\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SRT\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SSA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SUB\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TTA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3G2\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GP2\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GPP\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AAC\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AIF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AIFF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASF\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASX\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AVI\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.CDA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.DVR-MS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M2TS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4A\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4B\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4P\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4V\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MID\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MIDI\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MOD\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MOV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP2\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP3\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP4\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPE\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPEG\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPG\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RMI\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TS\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.VOB\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WM\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WMA\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WMV\OPENWITHLIST\GEEPLAYER.EXE 	detected: Application.Toolbar (A)
Value: HKEY_USERS\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR 	detected: Setting.DisableTaskMgr (A)
Value: HKEY_USERS\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS 	detected: Setting.DisableRegistryTools (A)
C:\DATA\AutoHotkey112202_Install.exe -> (7z o) -> Compiler/ANSI 32-bit.bin 	detected: Gen:Variant.Mikey.27128 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Keygen-CHiLi\Keygen-CHiLi.rar -> chili-keygen.exe 	detected: Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Keygen-CHiLi\chili-keygen.exe 	detected: Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Portable\Keygen-CHiLi.rar -> chili-keygen.exe 	detected: Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\Malwarebytes Anti-Malware Premium v2.1.4.1018 Final\Keygen.rar -> Keygen.exe 	detected: Trojan.GenericKD.2795078 (B)
C:\DATA\PROGRAMS\OpenCanvas 6.0.12.zip -> OpenCanvas 6.0.12/openCanvas.6.0.Patch-MPT/opencanvas.6.0.[x64]-MPT.exe 	detected: Gen:Variant.Application.Kazy.133014 (B)
C:\DATA\PROGRAMS\OpenCanvas 6.0.12.zip -> OpenCanvas 6.0.12/openCanvas.6.0.Patch-MPT/opencanvas.6.0.[x86]-MPT.exe 	detected: Dropped:Trojan.Generic.13186901 (B)
C:\DATA\PROGRAMS\WinRAR v5.21 Final (x32-x64) BG\KEYGEN-FFF.exe 	detected: Riskware.Win32.Keygen (A)
C:\DATA\Unlocker1.9.2.exe 	detected: Application.Win32.InstallTool (A)
C:\Users\Dancho\Downloads\Core-Temp-installer.exe 	detected: Application.InstallAd (A)
C:\Users\Dancho\Downloads\Core-Temp-installer (1).exe 	detected: Application.InstallAd (A)

Scanned	800710
Found	78

Scan end:	4.11.2015 г. 1:58:06
Scan time:	2:27:55

C:\Users\Dancho\Downloads\Core-Temp-installer (1).exe	Quarantined Application.InstallAd (A)
C:\Users\Dancho\Downloads\Core-Temp-installer.exe	Quarantined Application.InstallAd (A)
C:\DATA\Unlocker1.9.2.exe	Quarantined Application.Win32.InstallTool (A)
C:\DATA\PROGRAMS\WinRAR v5.21 Final (x32-x64) BG\KEYGEN-FFF.exe	Quarantined Riskware.Win32.Keygen (A)
C:\DATA\PROGRAMS\OpenCanvas 6.0.12.zip	Quarantined Dropped:Trojan.Generic.13186901 (B)
C:\DATA\PROGRAMS\Malwarebytes Anti-Malware Premium v2.1.4.1018 Final\Keygen.rar	Quarantined Trojan.GenericKD.2795078 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Portable\Keygen-CHiLi.rar	Quarantined Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Keygen-CHiLi\chili-keygen.exe	Quarantined Trojan.Generic.11222520 (B)
C:\DATA\PROGRAMS\AIDA64 Business Edition 4.00.2700 Final\Keygen-CHiLi\Keygen-CHiLi.rar	Quarantined Trojan.Generic.11222520 (B)
C:\DATA\AutoHotkey112202_Install.exe	Quarantined Gen:Variant.Mikey.27128 (B)
Value: HKEY_USERS\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS	Quarantined Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-2264977531-2208132923-2952205938-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR	Quarantined Setting.DisableTaskMgr (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WMV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WMA\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.WM\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.VOB\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TS\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RMI\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPG\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPEG\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPE\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP4\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP3\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP2\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MOV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MOD\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MIDI\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MID\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4V\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4P\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4B\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M4A\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.M2TS\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.DVR-MS\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.CDA\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AVI\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASX\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASF\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AIFF\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AIF\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AAC\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GPP\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GP2\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3GP\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.3G2\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TTA\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.TP\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SUB\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SSA\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.SRT\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RMVB\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RM\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RAM\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.RA\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.QT\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.QSV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PVA\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PMP\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PMF\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.PFV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.OGM\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.OGG\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MPC\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MP5\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.MKV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.IDX\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.GPLF\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.FLV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.FLAC\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.F4V\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.CSF\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.BIK\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.ASS\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.APE\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AMV\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AMR\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\.AC3\OPENWITHLIST\GEEPLAYER.EXE	Quarantined Application.Toolbar (A)

Quarantined	77

Не забелязвам никакви проблеми със системата. (няма товар в idle по cpu/hdd). Като производителност си е нормално, даже малко по-бързо стартира. И Paint-а ми работи. :D 

Ето и няколко финални препоръки:

1. Проверете за стари приложения с помощта на PatchMyPC или с програмата Secunia Personal Software Inspector.

2. Инсталирайте Unchecky за да се предпазите от адуер по време на инсталацията на даден софтуер.

3. За да почистим използваните от нас инструменти направете следното:

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и Purge system restore (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

Ако има папки, които не са се изтрили след гореспоменатите процедури пишете и ще ги премахнем ръчно.

4. За защита от криптовирусите, освен обновяване на ОС и антивирусната програма е добре да имунизирате системата си с CryptoPrevent и профила Maximum Protection: (Не използвайте последната опция, защото още е бъгава и не работи коректно, но на ваш риск може да я пробвате да видите как ще се държи системата и с последната опция).

mtBkCIZ.jpg

Ако имате проблеми с инсталацията на програми след използването на CryptoPrevent вижте следните съвети, както и тези

Можете да погледнете и новата програма CryptoMonitor (но инструмента още се разработва и е леко бъгав) и безплатната версия е доста орязана, но в момента пълната версия е достъпна безплатно, защото скоро се очаква нова версия на програмата, която пак ще е платена.

Не забравяйте да изключите и Autorun в Windows, защото криптовирусите могат да се настанят и на външните дискове и флашки и да заразят информацията на тези носители при свързването им с инфектирана система и след това да заразят и други системи при свързването на външните дискове към други компютри (и така да го предадете и на тях). Microsoft са създали автоматичен инструмент за целта => MSFixIt. Добре е също така след като вкарате външния диск дори и при спрян Autorun просто да сканирате буквата на устройството с обновена антивирусна програма преди да започнете да прехвърляте данни от и към външния диск.

Има и други програми, но са главно за напреднали потребители и няма да се спирам много задълбочено на тях, защото са сравнително по-сложни за употреба на средностатистическите потребители.. Затова ще ги пропусна. Добре е да не се спира System Restore (и File History в Windows 8), да не се спира UAC - User Account Control (даже да се направи на максималното ниво на защита), да не се спира SmartScreen (наличен само в Windows 8 и 10), да се внимава с прикачените файлове към електронната поща. Добра идея е и да забраните скриптовете, ако не използвате такива с помощта на инструмента - Noscript.exe. Стартирайте го и изберете Disable. Ако ви потрябва да стартирате някога (js или vbs файлове, просто стартирайте инструмента и го направете на Enable). Добре е да се внимава и с PDF файловете (повечето програми позволяват да се изключи java script в PDF четците, да се забрани на PDF файловете да стартират външни програми и да комуникират с интернет и прочие), да се внимава с офис файловете за макрос експлоити (пак може да се затегне сигурността от настройките на офис пакетите), добре е да се внимава за файлове с двойни разширения (например ако в My Computer => Tools => Folder Options => не е премахната отметката пред "Hide extensions for known file types" ако свалите даден файл от интернет с името image.exe.jpg, вие ще го видите като image.jpg, но всъщност файла ще е image.exe и щом го стартирате това ще задейства и вируса). Добра идея е да инсталирате Malwarebytes Anti-Exploit за да си осигурите спокойствие при сърфиране. Трудничко е, но просто няма как. Потребителите трябва да се научат да проявяват бдителност и хигиена при сърфиране.

5. За подобряване на производителността (ако системата ви се вижда мудна) вижте следните няколко теми:

Оптимизиране на Windows с цел по-добра производителност

Ръководство за поддръжка на Windows (XP, Vista и 7) [Revision 2.0]

Какво да направя, ако компютърът ми работи бавно

6. Проверете системата си актуални драйвери от сайтовете на производителите на компонентите ако ви се занимава (не използвайте програми за автоматично обновяване на драйверите за да си спестите главоболията после) и направете пълна проверка за гадини с наличната ви антивирусна програма за всеки случай.

7. Винаги правете бекъп на важните си документи на външни носители и за не толкова ценните неща на cloud услуги. Научете се да не инсталирате програми от съмнителни източници. Добра идея е да се научите да си създавате огледални образи на текущото работещо състояние на дяла на който се намира Операционната Система. Възстановяването на такъв образ при нужда в пъти по-лесен и бърз начин за връщане на работещото състояние на системата от преинсталация или опит за ръчно премахване на даден проблем. Такъв образ може да се създаде с външна програма като Macrium Reflect Free. Можете да видите и тази тема

Поздрави и усмихната седмица! Ще маркирам случая като РЕШЕН! :bye1:

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.