Аз също имам проблем: https://www.kaldata.com/forums/topic/209734-mozilla-firefox-въпроси-и-проблеми-част-3/?page=47

Само да спомена, че след като изчистих регистрите и т. н. последния път, вече мина седмица. За миналите 3-4 месеца се случва 4-5 пъти. Не е голям проблем, но ми се иска да го разреша.

Прилагам изискуемата инфмация от Farbar Recovery Scan Tool:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:07-11-2015
Ran by Chavdar (administrator) on PC (08-11-2015 15:28:11)
Running from F:\
Loaded Profiles: Chavdar & UpdatusUser (Available Profiles: Chavdar & UpdatusUser)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe
(Universitat Jaume I) C:\Program Files\Universitat Jaume I\Projecte Clauer\clos-win.exe
(ACD Systems) C:\Program Files\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\UdaterUI.exe
(tsvr.com) C:\Users\Chavdar\AppData\Roaming\TSv\TSvr.exe
(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\McTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TODO: <公司名>) C:\Program Files\SFK\SSFK.exe
(DTools LIMITED) C:\ProgramData\4WMiniPro4\WMiniPro.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(TODO: <公司名>) C:\Program Files\SFK\SSFK.exe
(XTab system) C:\Program Files\XTab\ProtectService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_19_0_0_226.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ACPW05EN] => C:\Program Files\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-09-20] (ACD Systems)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [AppJavaCertStore] => C:\Program Files\Universitat Jaume I\Projecte Clauer\AppJavaCertStore.exe [81920 2007-07-19] ()
HKLM\...\Run: [McAfeeUpdaterUI] => C:\Program Files\McAfee\Common Framework\udaterui.exe [333416 2012-09-05] (McAfee, Inc.)
HKLM\...\Run: [ShStatEXE] => C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [215656 2012-08-14] (McAfee, Inc.)
HKU\S-1-5-21-437281819-2859081409-1786923208-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-437281819-2859081409-1786923208-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Mystify.scr [221184 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2015-01-02] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2011-02-04] (Autodesk, Inc.)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 217.18.242.74 217.18.242.146
Tcpip\..\Interfaces\{7A137A24-DC71-490D-A773-ADDC9ACC3229}: [DhcpNameServer] 217.18.242.74 217.18.242.146
Tcpip\..\Interfaces\{A1E8EB20-F962-4711-B381-6F2063E6626C}: [DhcpNameServer] 172.17.2.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1420028643&from=smt&uid=395049983_397234_40D5CDCA&q={searchTerms}
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> {67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\XTab\SupTab.dll [2015-05-29] (Thinknice Co. Limited)
BHO: Microsoft Web Test Recorder 12.0 Helper -> {432dd630-7e03-4c97-9d62-b99f52df4fc2} -> C:\Program Files\Microsoft Visual Studio 12.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll [2013-10-05] (Microsoft Corporation)
BHO: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files\XTab\SupTab.dll [2015-05-29] (Thinknice Co. Limited)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20150118164752.dll [2015-01-18] (McAfee, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/1.4/jinstall-14_07-windows-i586.cab
DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/1.4/jinstall-14_07-windows-i586.cab
StartMenuInternet: IEXPLORE.EXE - c:\program files\internet explorer\iexplore.exe hxxp://www.delta-homes.com/?type=sc&ts=1445855041&z=5c5003e29b587126e47dbccg4z0z3wcbdw8wce5z0e&from=ient07031&uid=395049983_397234_40D5CDCA

FireFox:
========
FF ProfilePath: C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\n97th0fm.default-1445855884078
FF Homepage: hxxps://www.google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-23] ()
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-02-11] (Foxit Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2013-03-21] (Adobe Systems)
FF Extension: Yahoo Mail Hide Ad Panel - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\n97th0fm.default-1445855884078\Extensions\{c37bac34-849a-4d28-be41-549b2c76c64e}.xpi [2015-10-26]
FF HKLM\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files\Common Files\McAfee\SystemCore
FF Extension: IDS_SS_NAME - C:\Program Files\Common Files\McAfee\SystemCore [2015-11-08] [not signed]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\fikfrl6q.default-1430893955195\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\fikfrl6q.default-1430893955195\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\cmfqjeh9.default-1443165845272\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\7fef6e1h.default\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\7fef6e1h.default\extensions\[email protected] => not found

Chrome:
=======
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [15768 2010-02-03] (Microsoft Corporation)
R2 CLOS; C:\Program Files\Universitat Jaume I\Projecte Clauer\clos-win.exe [102400 2008-04-30] (Universitat Jaume I) [File not signed]
S3 CoordinatorServiceHost; C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [89192 2012-10-06] (Dassault Systèmes SolidWorks Corp.)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2015-01-04] (Flexera Software, Inc.)
S3 fussvc; C:\Program Files\Windows Kits\8.1\App Certification Kit\fussvc.exe [140800 2013-08-21] (Microsoft Corporation) [File not signed]
R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [152576 2015-10-26] (XTab system) [File not signed]
R2 IhPul; C:\Users\Chavdar\AppData\Roaming\TSv\TSvr.exe [396944 2015-10-26] (tsvr.com)
R2 McAfeeFramework; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [132712 2012-09-05] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [167344 2015-01-18] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe [210056 2012-08-14] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [159640 2015-01-18] (McAfee, Inc.)
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2799808 2005-09-23] (Microsoft Corporation)
R2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2253120 2011-10-15] (NVIDIA Corporation)
S3 Remote Solver for Flow Simulation 2012; C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe [95368 2012-08-09] (Mentor Graphics Corporation) [File not signed]
S3 SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2015-01-04] (SolidWorks) [File not signed]
R2 SSFK; C:\Program Files\SFK\SSFK.exe [169632 2015-10-10] (TODO: <公司名>)
S3 Te.Service; C:\Program Files\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [91136 2013-08-21] (Microsoft Corporation) [File not signed]
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [71344 2013-10-05] (Microsoft Corporation)
R2 WdsManPro; C:\ProgramData\4WMiniPro4\WMiniPro.exe [294912 2015-10-26] (DTools LIMITED) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S2 Update SourceApp; "C:\Program Files\SourceApp\updateSourceApp.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 athur; C:\Windows\System32\DRIVERS\athur.sys [1570304 2013-06-28] (Atheros Communications, Inc.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-12-31] (Disc Soft Ltd)
S3 gdrv; C:\Windows\gdrv.sys [17488 2014-12-31] (Windows (R) 2000 DDK provider)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [121544 2015-01-18] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [215024 2015-01-18] (McAfee, Inc.)
R3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [59616 2015-01-18] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [477584 2015-01-18] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [87816 2015-01-18] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [180720 2015-01-18] (McAfee, Inc.)
R1 {073f2b9a-2357-4614-b174-3fc1afffe941}Gw; C:\Windows\System32\drivers\{073f2b9a-2357-4614-b174-3fc1afffe941}Gw.sys [43152 2014-12-30] (StdLib)
U3 mfeavfk01; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-08 15:28 - 2015-11-08 15:28 - 00000000 ____D C:\FRST
2015-11-08 14:53 - 2015-11-08 14:53 - 00000001 _____ C:\Windows\system32\en.html
2015-11-03 22:57 - 2015-11-04 06:55 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-10-27 07:07 - 2015-10-27 07:07 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-10-27 07:07 - 2015-10-27 07:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-10-26 12:30 - 2015-10-26 12:31 - 00000000 ____D C:\ProgramData\4WMiniPro4
2015-10-26 12:30 - 2015-10-26 12:30 - 00000098 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-24 10:13 - 2015-10-24 10:13 - 00000889 _____ C:\Users\Chavdar\Desktop\Cool Reader.lnk
2015-10-24 10:12 - 2015-10-24 10:13 - 00000000 ____D C:\Program Files\Cool Reader
2015-10-23 10:05 - 2015-10-23 10:05 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-10-23 10:05 - 2015-10-23 10:05 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-10-22 17:58 - 2015-10-24 10:30 - 00000000 ____D C:\Users\Chavdar\cr3
2015-10-22 16:44 - 2015-10-22 17:39 - 00000000 ____D C:\Users\Chavdar\.cr3
2015-10-22 14:51 - 2015-10-22 17:36 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\CoolReader
2015-10-21 15:22 - 2015-11-04 20:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-10-21 15:22 - 2015-10-26 12:34 - 00001161 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-10-21 15:22 - 2015-10-26 12:33 - 00001149 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-10-21 15:22 - 2015-10-21 15:22 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\Mozilla
2015-10-21 14:35 - 2015-10-21 14:35 - 00002091 _____ C:\Users\Public\Desktop\Foxit Reader.lnk
2015-10-21 14:35 - 2015-10-21 14:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2015-10-21 14:35 - 2015-10-21 14:35 - 00000000 ____D C:\Program Files\Foxit Software
2015-10-19 09:23 - 2015-10-22 13:58 - 00000000 ____D C:\Users\Chavdar\Desktop\manual
2015-10-11 21:07 - 2015-10-11 21:07 - 00000000 ____D C:\TeenLine.1-Gagtastic-IPT

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-08 12:58 - 2009-07-14 06:34 - 00025600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-08 12:58 - 2009-07-14 06:34 - 00025600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-08 12:57 - 2014-12-31 13:33 - 00797866 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-08 12:56 - 2014-12-31 13:28 - 01646425 _____ C:\Windows\WindowsUpdate.log
2015-11-08 12:53 - 2015-08-01 08:56 - 00000266 _____ C:\Windows\Tasks\AutoKMS.job
2015-11-08 12:52 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-08 12:52 - 2009-07-14 06:39 - 00080817 _____ C:\Windows\setupact.log
2015-11-08 06:50 - 2015-01-02 17:40 - 00000000 ____D C:\Users\Chavdar\AppData\Local\Adobe
2015-11-04 20:33 - 2014-12-31 14:17 - 00020238 _____ C:\Windows\PFRO.log
2015-11-02 07:33 - 2014-12-31 14:52 - 00000000 ____D C:\KMPlayer
2015-10-31 17:38 - 2014-12-31 13:56 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\uTorrent
2015-10-31 17:11 - 2015-09-18 22:22 - 00000000 ____D C:\Users\Chavdar\AppData\LocalLow\uTorrent
2015-10-28 09:15 - 2015-05-29 15:49 - 00000000 ____D C:\Program Files\WinZipper
2015-10-26 12:30 - 2015-09-25 08:50 - 00000000 ____D C:\Program Files\SFK
2015-10-26 12:30 - 2015-05-06 07:05 - 00000000 ____D C:\Program Files\XTab
2015-10-26 12:29 - 2015-09-25 08:50 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\TSv
2015-10-25 19:22 - 2013-07-01 09:53 - 00000000 ____D C:\Users\Chavdar\Documents\Visual Studio 2013
2015-10-25 18:43 - 2015-01-04 19:22 - 00000000 ____D C:\Users\Chavdar\AppData\Local\TempSWBackupDirectory
2015-10-25 17:58 - 2015-01-04 19:18 - 00000000 ____D C:\Temp
2015-10-25 17:53 - 2015-01-04 11:21 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\SolidWorks
2015-10-22 17:58 - 2014-12-31 13:28 - 00000000 ____D C:\Users\Chavdar
2015-10-22 11:07 - 2015-01-04 20:00 - 00000000 ____D C:\Users\Chavdar\AppData\Local\cache
2015-10-21 14:47 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2015-10-21 14:36 - 2015-01-02 16:54 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\Foxit Software

==================== Files in the root of some directories =======

2015-10-26 12:30 - 2015-10-26 12:30 - 0000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Files to move or delete:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Some files in TEMP:
====================
C:\Users\Chavdar\AppData\Local\Temp\AcDeltree.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-09-12 17:54

==================== End of FRST.txt ============================

Addition.txt

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST64.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете дали има подобрение.

Здравейте,

Благодаря за отзивчивостта! Утре ще свърша тази работа, тъй като сега се налага да излезна. Аз в момента нямам проблем (след като го чистих за последно) и затова не съм особено припрян. Тъй като файловете FRST.txt и Addition.txt бяха създадени върху устройство F: - там ли да поместя fixlist.txt или на декстопа? А, може би на двете места за по-сигурно, ако самата програма не дава да се укаже пътя до файла? Още веднъж - благодаря за съдействието!

Ако FRST.exe се намира на флашката ви тогава трябва да го преместите на десктопа и след това да свалите fixlist.txt на десктопа и да стартирате FRST.exe и да натиснете бутона Fix веднъж.

Или просто запазете fixlist.txt на флашката, където се намира FRST.exe и стартирайте инструмента директно от флашката.

 

Поздрави!

Здравейте,

Изпълних инструкциите, а това е съдържанието на fixlog.txt:

Fix result of Farbar Recovery Scan Tool (x86) Version:07-11-2015
Ran by Chavdar (2015-11-13 11:24:23) Run:1
Running from C:\Users\Chavdar\Desktop
Loaded Profiles: Chavdar & UpdatusUser (Available Profiles: Chavdar & UpdatusUser)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
(tsvr.com) C:\Users\Chavdar\AppData\Roaming\TSv\TSvr.exe
(TODO: <公司名>) C:\Program Files\SFK\SSFK.exe
(TODO: <公司名>) C:\Program Files\SFK\SSFK.exe
(XTab system) C:\Program Files\XTab\ProtectService.exe
File: C:\Program Files\Universitat Jaume I\Projecte Clauer\AppJavaCertStore.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1420028643&from=smt&uid=395049983_397234_40D5CDCA&q={searchTerms}
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com?type=hp&ts=1436188969&from=mych123&uid=395049983_397234_40d5cdca&z=5ccb562b21e40421187b730gfzcc6q0g9b7b6t2qbt
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-437281819-2859081409-1786923208-1000 -> {67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\XTab\SupTab.dll [2015-05-29] (Thinknice Co. Limited)
BHO: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files\XTab\SupTab.dll [2015-05-29] (Thinknice Co. Limited)
StartMenuInternet: IEXPLORE.EXE - c:\program files\internet explorer\iexplore.exe hxxp://www.delta-homes.com/?type=sc&ts=1445855041&z=5c5003e29b587126e47dbccg4z0z3wcbdw8wce5z0e&from=ient07031&uid=395049983_397234_40D5CDCA
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\fikfrl6q.default-1430893955195\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\fikfrl6q.default-1430893955195\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\cmfqjeh9.default-1443165845272\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\7fef6e1h.default\extensions\[email protected] => not found
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Users\Chavdar\AppData\Roaming\Mozilla\Firefox\Profiles\7fef6e1h.default\extensions\[email protected] => not found
R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [152576 2015-10-26] (XTab system) [File not signed]
R2 IhPul; C:\Users\Chavdar\AppData\Roaming\TSv\TSvr.exe [396944 2015-10-26] (tsvr.com)
R2 SSFK; C:\Program Files\SFK\SSFK.exe [169632 2015-10-10] (TODO: <公司名>)
S2 Update SourceApp; "C:\Program Files\SourceApp\updateSourceApp.exe" [X]
R1 {073f2b9a-2357-4614-b174-3fc1afffe941}Gw; C:\Windows\System32\drivers\{073f2b9a-2357-4614-b174-3fc1afffe941}Gw.sys [43152 2014-12-30] (StdLib)
2015-10-26 12:30 - 2015-10-26 12:31 - 00000000 ____D C:\ProgramData\4WMiniPro4
2015-10-26 12:30 - 2015-10-26 12:30 - 00000098 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-28 09:15 - 2015-05-29 15:49 - 00000000 ____D C:\Program Files\WinZipper
2015-10-26 12:30 - 2015-09-25 08:50 - 00000000 ____D C:\Program Files\SFK
2015-10-26 12:30 - 2015-05-06 07:05 - 00000000 ____D C:\Program Files\XTab
2015-10-26 12:29 - 2015-09-25 08:50 - 00000000 ____D C:\Users\Chavdar\AppData\Roaming\TSv
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
Hosts:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
C:\Users\Chavdar\AppData\Roaming\TSv\TSvr.exe
C:\Users\Chavdar\AppData\Roaming\TSv\TSvr.exe => No running process found
C:\Program Files\SFK\SSFK.exe
[2664] C:\Program Files\SFK\SSFK.exe => process closed successfully.
C:\Program Files\SFK\SSFK.exe
[2428] C:\Program Files\SFK\SSFK.exe => process closed successfully.
C:\Program Files\XTab\ProtectService.exe
C:\Program Files\XTab\ProtectService.exe => No running process found

========================= File: C:\Program Files\Universitat Jaume I\Projecte Clauer\AppJavaCertStore.exe ========================

File not signed
MD5: 20F7F69E7837030C5AEE7770A11EB2EE
Creation and modification date: 2007-07-19 - 2007-07-19
Size: 0081920
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page => value removed successfully.
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value removed successfully.
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page => value removed successfully.
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value removed successfully.
HKU\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
"HKU\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKU\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}" => key removed successfully.
HKCR\CLSID\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} => key not found.
"HKU\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252}" => key removed successfully.
HKCR\CLSID\{67C334C0-408D-4E6D-B5A7-0ADD6AFFA252} => key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => key removed successfully.
"HKCR\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}" => key removed successfully.
"HKCR\CLSID\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}" => key removed successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => value restored successfully
HKLM\Software\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully.
IHProtect Service => service removed successfully.
IhPul => service removed successfully.
SSFK => Unable to stop service.
SSFK => service removed successfully.
Update SourceApp => service removed successfully.
{073f2b9a-2357-4614-b174-3fc1afffe941}Gw => Service stopped successfully.
{073f2b9a-2357-4614-b174-3fc1afffe941}Gw => service removed successfully.
C:\ProgramData\4WMiniPro4 => moved successfully
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat => moved successfully
C:\Program Files\WinZipper => moved successfully
C:\Program Files\SFK => moved successfully
C:\Program Files\XTab => moved successfully
C:\Users\Chavdar\AppData\Roaming\TSv => moved successfully

=========  bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

=========  netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

=========  ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.

========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 867.5 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 11:28:38 ====

За подобрение още не мога да кажа, защото за последно бях отстранил този ефект, който се проявява периодично. Ако не се появи пак, значи всичко е било успешно. Още веднъж - благодаря!

Привет,

Само сте си мислели, че сте го отстранили. Премахнахме доста неща със скрипта отгоре, включително зловредни добавки за Firefox, услуги, променени настройки в браузърите, сменени начални страници и т.н..

За да проверим за остатъци направете следното:

СТЪПКА 1

 

• Изтеглете и стартирайтe AdwCleaner.exe.
• От Options => сложете всички отметки (без последната).
• Натиснете бутона Scan.
• AdwCleaner ще започне да проверява компютъра.
• След като проверката приключи натиснете бутона Clean.
• Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
• Ще се появи автоматично лог файл с името (AdwCleaner[C0].txt) в C:\Adwcleaner
• Публикувайте съдържанието му в следващия си коментар.

 

 

СТЪПКА 2

 

 

Моля изтеглете Junkware Removal Tool на вашия десктоп.

• Спрете временно работата на защитните програми.
• Стартирайте инструмента JRT.exe
• Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
• Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
• Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
• Моля копирайте съдържанието на лог файла в следващия си пост.

 

Поздрави!

Здравейте,

Изпълних Вашите инструкции.

AdwCleaner[C1].txt:

# AdwCleaner v5.020 - Logfile created 14/11/2015 at 18:29:41
# Updated 13/11/2015 by Xplode
# Database : 2015-11-13.3 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Chavdar - PC
# Running from : F:\adwcleaner_5.020.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : WdsManPro

***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\IePluginServices
[-] Folder Deleted : C:\ProgramData\WindowsMangerProtect
[-] Folder Deleted : C:\ProgramData\IHProtectUpDate
[-] Folder Deleted : C:\Users\Chavdar\SupTab
[-] Folder Deleted : C:\Users\Chavdar\AppData\Roaming\OpenCandy
[-] Folder Deleted : C:\Users\Chavdar\AppData\Roaming\WinZipper
[-] Folder Deleted : C:\Users\Chavdar\AppData\Roaming\RHEng

***** [ Files ] *****

[-] File Deleted : C:\Windows\system32\drivers\{073f2b9a-2357-4614-b174-3fc1afffe941}Gw.sys

***** [ DLLs ] *****

***** [ Shortcuts ] *****

[-] Shortcut Disinfected : C:\Users\Chavdar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
[-] Key Deleted : HKCU\Software\Mozilla\Extends
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E49F0B41-3322-11D4-AEFE-00C04F61025C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}]
[-] Key Deleted : HKCU\Software\SupHpUISoft
[-] Key Deleted : HKCU\Software\V9
[-] Key Deleted : HKLM\SOFTWARE\delta-homesSoftware
[-] Key Deleted : HKLM\SOFTWARE\hdcode
[-] Key Deleted : HKLM\SOFTWARE\SupDp
[-] Key Deleted : HKLM\SOFTWARE\SupTab
[-] Key Deleted : HKLM\SOFTWARE\supWindowsMangerProtect
[-] Key Deleted : HKLM\SOFTWARE\supWPM
[-] Key Deleted : HKLM\SOFTWARE\V9
[-] Key Deleted : HKLM\SOFTWARE\mystartsearchSoftware
[-] Key Deleted : HKLM\SOFTWARE\IHProtect
[-] Key Deleted : HKLM\SOFTWARE\FFPluginHp
[-] Key Deleted : HKLM\SOFTWARE\PicexaSvc
[-] Key Deleted : HKLM\SOFTWARE\TSv

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed
:: Proxy settings cleared
:: Winsock settings cleared
:: TCP/IP settings cleared
:: Firewall settings cleared
:: IPSec settings cleared
:: BITS queue cleared
:: Chrome policies deleted

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [4101 bytes] ##########

JRT.txt:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Professional x86
Ran by Chavdar on 14-Nov-15 at 18:36:47.40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Tasks

 

~~~ Registry Values

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update SourceApp

 

~~~ Files

 

~~~ Folders

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14-Nov-15 at 18:39:23.07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Файлът по-горе е AdwCleaner[C1].txt, т. е. не е AdwCleaner[C0].txt (не намерих последния). Мога ли вече да изтрия директорията C:\Adwcleaner? Не, че е голяма по размер, но вероятно не е нужна...

Благодаря още веднъж за съдействието!

Привет,

Папката ще я изтрием след като приключим. Идеята на подобни папки е да бъдат върнати изтритите файлове или записи в регистрите в случай на проблем (като фалшиви засичания и т.н.). Не бързайте да ги триете.

Също така не бързайте и да бягате, защото липсата на симптоми, не означава, че системата е чиста. Ние премахнахме зареждащите се точки на malware-a, но е добре да проверим и с програми работещи с дефиниции за да бъдем сигурни, че всичко е ок. Почти сме готови.

 

СТЪПКА 1

 

Моля изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

• Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
• След като инсталацията приключи се уверете че сте сложили отметка пред:
• Launch Malwarebytes Anti-Malware
• Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

• Натиснете бутона Finish.
• Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
• Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
• Ще започне проверка за зловреден софтуер.
• При някои инфекции можете да видите съобщението:
• "Could not load DDA driver"
• Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
• Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
• След като проверката приключи натиснете бутона Apply Actions.
• Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
• След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
• Отидете то табът History > Application Logs.

• Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
• Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

СТЪПКА 2

 

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 

 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

 

СТЪПКА 3

 

• Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
• Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
• Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

• След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
• Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
• Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
• Натиснете Next за да започне проверката.
• Когато проверката приключи натиснете бутона View Report.
• Копирайте съдържанието на лог файла в следващия си коментар.

 

Поздрави!

Здравейте,

Изпълних последните Ви наставления:

Scan Log.txt:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 15-Nov-15
Scan Time: 10:10
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.11.15.01
Rootkit Database: v2015.11.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Chavdar

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 376792
Time Elapsed: 30 min, 40 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.OpenCandy, C:\Users\Chavdar\Downloads\DAEMON Tools Lite 4.49.1.0356.exe, Quarantined, [53fa136bfb90171f830f630673916e92],

Physical Sectors: 0
(No malicious items detected)

(end)

scan_151115-111713.txt:

Emsisoft Emergency Kit - Version 10.0
Last update: 15-Nov-15 11:15:46
User account: PC\Chavdar

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:    15-Nov-15 11:17:13
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR     detected: Setting.DisableTaskMgr (A)
Value: HKEY_USERS\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR     detected: Setting.DisableTaskMgr (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS     detected: Setting.DisableRegistryTools (A)
Value: HKEY_USERS\S-1-5-21-437281819-2859081409-1786923208-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS     detected: Setting.DisableRegistryTools (A)
C:\AdwCleaner\Quarantine\C\Users\Chavdar\AppData\Roaming\WinZipper\update\zip_update_v1.5.113.exe.vir     detected: Gen:Variant.Mikey.27807 (B)
C:\AdwCleaner\Quarantine\C\ProgramData\IHProtectUpDate\update\UpDateProcess.exe.vir     detected: Gen:Variant.Adware.Graftor.253007 (B)
C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\update\update.exe.vir     detected: Trojan.GenericKD.2451623 (B)
C:\AdwCleaner\Quarantine\C\Windows\system32\drivers\{073f2b9a-2357-4614-b174-3fc1afffe941}Gw.sys.vir     detected: Adware.BrowseFox.V (B)
C:\FRST\Quarantine\C\Program Files\SFK\SSFK.exe     detected: Adware.Agent.QAB (B)
C:\FRST\Quarantine\C\Program Files\XTab\ffsearch_toolbar!1.0.0.1031.xpi     detected: Application.Win32.InstallTool (A)
C:\FRST\Quarantine\C\Program Files\XTab\ProtectService.exe     detected: Gen:Variant.Kazy.733370 (B)
C:\FRST\Quarantine\C\Program Files\XTab\SupTab.dll     detected: Gen:Variant.Application.Jatif.390 (B)
C:\FRST\Quarantine\C\Program Files\XTab\SupTab_Bak.dll     detected: Gen:Variant.Application.Jatif.390 (B)
C:\FRST\Quarantine\C\ProgramData\4WMiniPro4\WMiniPro.exe     detected: Trojan.GenericKD.2826407 (B)

Scanned    270316
Found    14

Scan end:    15-Nov-15 12:37:24
Scan time:    1:20:11

 

Според първия доклад бе намерен проблем в инсталационния файл за DAEMON Tools и аз позволих на програмата да го изтрие. Но, направената от него инсталация я запазих. Да я премахна ли, като си потърся подобна програма отново?

Поздрави!

HitmanPro_20151115_1107.log

Няма нужда да деинсталирате Daemon Tools. То и самия инсталатор не е опасен, ако се внимава с отметките по времето на инсталацията на програмата за да не инсталирате нежелани добавки, ленти със задачи и прочие боклуци.

А иначе сме готови...не мисля, че има нужда да ви прекарвам през последните стъпки и сканиране със zhpcleaner, zoek, eset online scanner и securitycheck.

За да премахнем последните остатъци от нежеланите програми в лога на HitmanPro направете следното:

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST64.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Финалните инструкции можете да видите тук => https://www.kaldata.com/forums/topic/247339-след-старт-hdd-работи-на-100/?do=findComment&comment=3236795

Ще маркирам случая като решен. Поздрави и приятен неделен ден!

Здравейте,

Съжалявам, че се забавих, но имах някои ангажименти. Изпълних последните Ви инструкции и публикувам Fixlog.txt (програмата не пожела да рестартирам компютъра):

Fix result of Farbar Recovery Scan Tool (x86) Version:20-11-2015
Ran by Chavdar (2015-11-21 13:05:59) Run:2
Running from C:\Users\Chavdar\Desktop
Loaded Profiles: Chavdar & UpdatusUser (Available Profiles: Chavdar & UpdatusUser)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFENETFILTER
DeleteKey: HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\PicexaService
DeleteKey: HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\winzipersvc
end
*****************

Restore point was successfully created.
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ISAFENETFILTER => key removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\PicexaService => key removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\winzipersvc => key removed successfully.

==== End of Fixlog 13:06:21 ====

Сега да премина ли към финалните инструкции?

Желая Ви ползотворен ден!

Да, можете да преминете към финалните инструкции.

Хубав ден и на Вас!