Профилактична проверка на лаптоп

11 ноември 201510 г.

Здравейте уважаеми съфорумци. Донесоха ми един лаптоп,който има нужда от обгрижване.Според хората много бавно започнал да работи,отваряли се хиляди прозорци в браузърите и други подобни неща.ОС е 7 Ултимът. Няма инсталационен диск или флашка.На пръв поглед забелязах една топличка машина,която и предстои да я отворя и почистя.А ето и логовете.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-11-2015
Ran by Данелия (administrator) on DANI-PC (11-11-2015 10:27:36)
Running from C:\Users\Данелия\Downloads
Loaded Profiles: Данелия & UpdatusUser (Available Profiles: Данелия & UpdatusUser)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Български (България)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.15\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.15\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
() C:\ProgramData\DataCardService\DCService.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DataCardService\DCSHelper.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
() C:\Windows\System32\hale.exe
(BitTorrent Inc.) C:\Users\Данелия\AppData\Roaming\uTorrent\uTorrent.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\PanProcess.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(BitTorrent Inc.) C:\Users\Данелия\AppData\Roaming\uTorrent\updates\3.4.5_41202\utorrentie.exe
(BitTorrent Inc.) C:\Users\Данелия\AppData\Roaming\uTorrent\updates\3.4.5_41202\utorrentie.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.3.0.0\Lightshot.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-05-26] (Alcor Micro Corp.)
HKLM\...\Run: [Chew7Hale] => C:\Windows\System32\hale.exe [2169856 2013-06-04] ()
HKLM-x32\...\Run: [TaskTray] => [X]
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4958320 2011-09-13] (VIA)
HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [326856 2012-06-04] (IVT Corporation)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [322208 2012-06-25] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174752 2012-06-19] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [ACMON] => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [102568 2012-02-21] (ASUS)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation)
HKLM-x32\...\Run: [Driver Genius] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-06-16] (Avast Software s.r.o.)
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [226560 2014-10-16] ()
HKLM-x32\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\258d706e-5bde-47ad-87ba-af05a1518919.exe [183232 2015-11-11] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\Run: [uTorrent] => C:\Users\Данелия\AppData\Roaming\uTorrent\uTorrent.exe [1822048 2015-10-12] (BitTorrent Inc.)
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [369200 2009-10-30] (DT Soft Ltd)
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20588704 2013-11-15] (Skype Technologies S.A.)
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\Run: [Facebook Update] => C:\Users\Данелия\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-08-28] (Facebook Inc.)
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\Run: [Viber] => C:\Users\Данелия\AppData\Local\Viber\Viber.exe [912904 2013-07-31] ()
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8551848 2015-10-19] (Piriform Ltd)
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: {199dabf7-68a9-11e3-a970-a4173137e00e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: {56f2a697-85d2-11e3-a098-a4173137e00e} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: {af5c7e1e-4de5-11e2-b956-a4173137e00e} - G:\SETUP.EXE
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: {cc528944-4e99-11e2-b80b-a4173137e00e} - F:\AutoRun.exe
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: {e66b06c2-4dc2-11e2-930d-a4173137e00e} - F:\AutoRun.exe
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\...\MountPoints2: {e66b06e8-4dc2-11e2-930d-a4173137e00e} - F:\AutoRun.exe
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [241664 2010-11-21] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [260968 2012-06-24] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [215400 2012-06-24] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-04-29] (Avast Software s.r.o.)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{0224EF6B-6AD0-464D-B5C0-24563075CEFA}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{3D286D48-D2B3-4986-80B6-3FFE904BEECD}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{59B0CF6D-8123-429E-B2C2-C3A915671C5E}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{75442894-E045-47C1-8964-6FC7EA328A8A}: [DhcpNameServer] 95.43.120.1 141.1.1.1

Internet Explorer:
==================
HKU\S-1-5-21-2187845750-4061225191-2299496136-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://eu.ask.com/?l=dis&o=15187
SearchScopes: HKU\S-1-5-21-2187845750-4061225191-2299496136-1000 -> {8760D5AC-F9DA-43E0-B6ED-47EB55161D4D} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=PTV&o=15184&src=kw&q={searchTerms}&locale=&apn_ptnrs=^RY&apn_dtid=^YYYYYY^V3^BG&apn_uid=c3eb6225-da65-4db8-bef7-3e317fec12de&apn_sauid=AE0A97C2-9F80-4233-B35E-40AB03D3A9B3
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12] (Microsoft Corporation)
BHO-x32: Profile Visitors Facebook -> {7AC63A3E-6F04-4710-B7B6-39BB32C625D8} -> C:\Program Files (x86)\Profile Visitors Facebook\fb_visit.dll [2013-04-22] ()
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Данелия\AppData\Roaming\Mozilla\Firefox\Profiles\q9uan22f.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-11-05] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-11-05] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-26] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-26] (Google Inc.)
FF Plugin HKU\S-1-5-21-2187845750-4061225191-2299496136-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Данелия\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Extension: Visitors Facebook - C:\Users\Данелия\AppData\Roaming\Mozilla\Firefox\Profiles\q9uan22f.default\Extensions\[email protected] [2014-08-15] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF => not found

Chrome:
=======
CHR HomePage: Default -> hxxp://www.ask.com/?l=dis&o=15187cr
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\pdf.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll => No File
CHR Profile: C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Диск) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-05]
CHR Extension: (YouTube) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-12]
CHR Extension: (Google Търсене) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-05]
CHR Extension: (Google Документи офлайн) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-12]
CHR Extension: (AdBlock) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-11-11]
CHR Extension: (Посетители за Facebook) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk [2015-06-16]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-02]
CHR Extension: (Gmail) - C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-23]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-29] (Avast Software s.r.o.)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1207520 2012-06-04] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [143968 2012-06-04] (IVT Corporation)
R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-05-08] () [File not signed]
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-28] (Pandora.TV)
S3 sppuinotify; C:\Windows\system32\sppuinotify.dll [65536 2013-06-04] (Microsoft Corporation) [File not signed]
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-09-07] (VIA Technologies, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-29] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-04-29] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-29] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-29] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-08-01] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-04-29] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-04-29] ()
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34880 2011-08-12] (Ralink Corporation.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23104 2011-08-12] (Ralink Corporation)
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [51776 2012-04-02] (Ralink Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48320 2012-03-05] (Ralink Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [252928 2010-04-30] (Huawei Technologies Co., Ltd.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [128200 2013-04-26] (Qualcomm Atheros Co., Ltd.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [675424 2012-06-01] (Ralink Technology, Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-12-24] () [File not signed]
U3 a5hof950; C:\Windows\System32\Drivers\a5hof950.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34880 2011-08-12] (Ralink Corporation.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-11 10:27 - 2015-11-11 10:28 - 00017878 _____ C:\Users\Данелия\Downloads\FRST.txt
2015-11-11 10:27 - 2015-11-11 10:27 - 00000000 ____D C:\FRST
2015-11-11 10:26 - 2015-11-11 10:26 - 02198528 _____ (Farbar) C:\Users\Данелия\Downloads\FRST64.exe
2015-11-11 10:25 - 2015-11-11 10:25 - 00000000 _____ C:\Windows\setuperr.log
2015-11-11 10:25 - 2015-11-11 10:25 - 00000000 _____ C:\Windows\setupact.log
2015-11-11 10:10 - 2015-11-11 10:10 - 00002792 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-11-11 10:10 - 2015-11-11 10:10 - 00000782 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-11-11 10:10 - 2015-11-11 10:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-11-11 10:10 - 2015-11-11 10:10 - 00000000 ____D C:\Program Files\CCleaner
2015-11-11 10:09 - 2015-11-11 10:09 - 00000756 _____ C:\Users\Public\Desktop\Speccy.lnk
2015-11-11 10:09 - 2015-11-11 10:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
2015-11-11 10:09 - 2015-11-11 10:09 - 00000000 ____D C:\Program Files\Speccy
2015-11-11 10:08 - 2015-11-11 10:09 - 06762072 _____ (Piriform Ltd) C:\Users\Данелия\Downloads\ccsetup511.exe
2015-11-11 10:08 - 2015-11-11 10:08 - 05127432 _____ (Piriform Ltd) C:\Users\Данелия\Downloads\spsetup128.exe
2015-11-11 10:00 - 2015-11-11 10:00 - 00000000 ____D C:\Users\Данелия\AppData\LocalLow\uTorrent
2015-10-12 13:15 - 2015-10-12 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-11 10:25 - 2012-12-24 17:21 - 00000000 ____D C:\Users\Данелия\AppData\Roaming\uTorrent
2015-11-11 10:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing
2015-11-11 10:18 - 2012-12-27 10:41 - 00000000 ____D C:\Users\Данелия\AppData\Roaming\Media Player Classic
2015-11-11 10:18 - 2012-12-24 18:16 - 00000000 ____D C:\Users\Данелия\AppData\Roaming\DAEMON Tools Lite
2015-11-11 10:17 - 2014-03-02 17:16 - 00000000 ____D C:\Windows\Minidump
2015-11-11 10:17 - 2012-12-25 02:54 - 00000000 ____D C:\Windows\Panther
2015-11-11 10:08 - 2009-07-14 06:45 - 00021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-11 10:08 - 2009-07-14 06:45 - 00021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-11 10:07 - 2012-12-24 16:58 - 02064644 ____N C:\Windows\WindowsUpdate.log
2015-11-11 10:06 - 2009-07-14 07:13 - 00726444 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-11 10:04 - 2014-01-29 17:29 - 00000392 _____ C:\Windows\Tasks\update-S-1-5-21-2187845750-4061225191-2299496136-1000.job
2015-11-11 10:02 - 2012-12-24 17:23 - 00000000 ____D C:\Users\Данелия\AppData\Roaming\Skype
2015-11-11 10:01 - 2012-12-24 17:39 - 00004263 _____ C:\Windows\SysWOW64\LOCALSERVICE.INI
2015-11-11 10:00 - 2012-12-24 17:39 - 00000387 _____ C:\Users\Данелия\AppData\Roaming\sp_data.sys
2015-11-11 09:59 - 2012-12-24 17:53 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-11 09:59 - 2012-12-24 17:39 - 00000061 _____ C:\Windows\SysWOW64\LOCALDEVICE.INI
2015-11-11 09:59 - 2012-06-04 09:35 - 00000780 _____ C:\Windows\SysWOW64\bscs.ini
2015-11-11 09:59 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-05 22:39 - 2012-12-24 17:53 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-05 22:38 - 2014-02-05 21:57 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-05 21:48 - 2013-08-28 20:43 - 00000936 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2187845750-4061225191-2299496136-1000UA.job
2015-11-05 21:48 - 2013-08-28 20:43 - 00000914 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2187845750-4061225191-2299496136-1000Core.job
2015-11-05 20:22 - 2014-01-29 17:29 - 00000392 _____ C:\Windows\Tasks\update-sys.job
2015-11-05 14:40 - 2012-12-24 17:01 - 00000000 ____D C:\Users\Данелия
2015-11-05 14:38 - 2014-02-05 21:57 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-11-05 14:38 - 2014-02-05 21:57 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-11-05 14:38 - 2014-02-05 21:57 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-11-05 14:15 - 2012-12-24 17:59 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-10-12 13:16 - 2014-01-29 17:29 - 00003270 _____ C:\Windows\System32\Tasks\update-S-1-5-21-2187845750-4061225191-2299496136-1000
2015-10-12 13:16 - 2014-01-29 17:29 - 00000424 _____ C:\Users\Данелия\AppData\Local\UserProducts.xml

==================== Files in the root of some directories =======

2012-12-24 17:39 - 2015-11-11 10:00 - 0000387 _____ () C:\Users\Данелия\AppData\Roaming\sp_data.sys
2014-11-13 20:34 - 2014-11-13 20:34 - 0008704 ___SH () C:\Users\Данелия\AppData\Roaming\Thumbs.db
2012-12-29 21:24 - 2015-11-05 14:51 - 2044963 _____ () C:\Users\Данелия\AppData\Roaming\UserTile.png
2013-01-01 01:46 - 2013-12-07 21:06 - 0005632 _____ () C:\Users\Данелия\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-01-29 17:29 - 2014-01-29 17:29 - 0000003 _____ () C:\Users\Данелия\AppData\Local\updater.log
2014-01-29 17:29 - 2015-10-12 13:16 - 0000424 _____ () C:\Users\Данелия\AppData\Local\UserProducts.xml

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2013-01-05 23:10

==================== End of FRST.txt ============================

Addition.txt

12 ноември 201510 г.

Привет,

Лично аз не виждам проблеми свързани с активни зарази освен използването на кофти активатор в лицето на hale.exe, потенциално нежелана програма в лицето на Greenshot (може да замени програмата с алтернатива като например с PicPick, Screenpresso и т.н.).

Добре е да се деинсталира от Control Panel-a и следната програма => Pandora Service

Има някои остатъци, които могат да се премахнат от логовете + да се направи проверка дали няма най-новия адуер в Google Chrome + да се оправят някои грешки от Event Viewer лог файла и затова изпълнете следните инструкции:

За да премахнем нежеланите добавки изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST64.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете дали има подобрение.

Поздрави!

12 ноември 201510 г.

Автор

Здравейте отново.Прикачил съм фикс-лога.

Интересното е,че вчера забелязах едно натоварване на процесора,стигащо до загряването му до 65 градуса.След като пуснах Фарбар, плюс някои оптимизации на системата,температурата вече достига 47-48 градуса.Забелязах,че вече има сложена добавката АдБлок,което е чудесно.Странно е,че и преди нея не забелязах някакви изскачащи реклами или допълнителни прозорци.А сега съвсем.Общо взето машинката си работи задоволително,отчитайки че процесора е Пентиум B980, и допълнителна видеокарта ГеФорс 610М.Предстои да отворя машината за едно почистване и смяна на термопастата.

Деинсталирах ръчно Пандора Сервис.

Живо-здраво.

Fixlog.txt

12 ноември 201510 г.

Пускането на FRST едва ли е помогнало, защото без скрипт инструмента само сканира... А лично аз не видях да има bitcoin miner, който да товари процесора. Кой процес товареше?

Коя добавка по-точно - Adblock или Adblock Plus...защото втората е за предпочитане. Само се уверете, че сте махнали отметката тук:

Архивирайте следните файлове и ги качете на dox.bg

c:\Program Files (x86)\Google\Chrome\Application\45.0.2454.101\resources.pak
c:\Program Files (x86)\Google\Chrome\Application\46.0.2490.80\resources.pak

Пратете ми линка за изтегляне в следващия си коментар за да видя има ли компрометиране на Google Chrome.

13 ноември 201510 г.

Автор

Здравейте.

За съжаление не запазих снимка на положението с процесите,за да се види какво е товарило.

Добавката е AdBlock.Но вече я махнах и сложих AdBlockPlus, както посъветвахте.

Линк

14 ноември 201510 г.

Не виждам проблеми с файловете на Google Chrome.

Да направим и последните проверки. Ще дам стъпките на един път, защото не знам кога трябва да го връщате (за да стане по-бързо).

СТЪПКА 1

Изтеглете и стартирайтe AdwCleaner.exe.
От Options => сложете всички отметки (без последната).
Натиснете бутона Scan.
AdwCleaner ще започне да проверява компютъра.
След като проверката приключи натиснете бутона Clean.
Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
Ще се появи автоматично лог файл с името (AdwCleaner[C0].txt) в C:\Adwcleaner
Публикувайте съдържанието му в следващия си коментар.

СТЪПКА 2

Моля изтеглете Junkware Removal Tool на вашия десктоп.

Спрете временно работата на защитните програми.
Стартирайте инструмента JRT.exe
Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 3

Моля изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи се уверете че сте сложили отметка пред:
Launch Malwarebytes Anti-Malware
Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

Натиснете бутона Finish.
Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
Ще започне проверка за зловреден софтуер.
При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи натиснете бутона Apply Actions.
Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
Отидете то табът History > Application Logs.

Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

СТЪПКА 4

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

СТЪПКА 5

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
Натиснете Next за да започне проверката.
Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

Поздрави!

14 ноември 201510 г.

Автор

AdwCleaner

# AdwCleaner v5.020 - Лог файлът е създаден 14/11/2015 при 20:57:04
# Обновен 13/11/2015 от Xplode
# База данни : 2015-11-13.3 [Сървър]
# Операционна система : Windows 7 Ultimate Service Pack 1 (x64)
# Потребителско име : Данелия - DANI-PC
# Изпълнява се от : C:\Users\Данелия\Desktop\adwcleaner_5.020.exe
# Опция : Изчистване
# Поддръжка : http://toolslib.net/forum

***** [ Сервизи ] *****

***** [ Папки ] *****

[-] Папка Изтрито : C:\ProgramData\Ask
[-] Папка Изтрито : C:\Users\Данелия\AppData\Local\apn

***** [ Файлове ] *****

***** [ DLLs ] *****

***** [ Преки пътища ] *****

***** [ Планирани задачи ] *****

[-] Задача Изтрито : update-sys
[-] Задача Изтрито : update-S-1-5-21-2187845750-4061225191-2299496136-1000
[-] Задача Изтрито : update-sys
[-] Задача Изтрито : update-S-1-5-21-2187845750-4061225191-2299496136-1000
[-] Задача Изтрито : update-sys

***** [ Регистър ] *****

[-] Ключ Изтрито : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}
[-] Ключ Изтрито : HKCU\Software\APN PIP
[-] Ключ Изтрито : HKCU\Software\Conduit
[-] Ключ Изтрито : HKCU\Software\Softonic
[-] Ключ Изтрито : HKLM\SOFTWARE\Conduit
[-] Ключ Изтрито : HKLM\SOFTWARE\Driver-Soft
[-] Ключ Изтрито : HKLM\SOFTWARE\dt soft\daemon tools toolbar
[-] Ключ Изтрито : HKLM\SOFTWARE\PIP
[-] Ключ Изтрито : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Genius_is1

***** [ Уеб браузъри ] *****

*************************

:: "Tracing" ключове отстраняват
:: Настройките за Proxy са премахнати
:: Настройките на Winsock са нулирани
:: Настройките за TCP/IP са нулирани
:: Настройките на защитната стена са нулирани
:: Настройките на IPSec са нулирани
:: BITS опашката е изчистена
:: Chrome политиките са нулирани

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2372 байта] ##########

Junkware

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.4 (09.28.2015:1)
OS: Windows 7 Ultimate x64
Ran by „ Ґ«Ёп on бкЎ 14.11.2015 Ј. at 21:16:03,52
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{7AC63A3E-6F04-4710-B7B6-39BB32C625D8}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AC63A3E-6F04-4710-B7B6-39BB32C625D8}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7AC63A3E-6F04-4710-B7B6-39BB32C625D8}

~~~ Files

Successfully deleted: [File] C:\Users\„ Ґ«Ёп\AppData\Roaming\sp_data.sys

~~~ Folders

Successfully deleted: [Folder] C:\Program Files (x86)\driver-soft
Successfully deleted: [Folder] C:\ProgramData\drivergenius
Successfully deleted: [Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\driver genius

~~~ FireFox

Emptied folder: C:\Users\„ Ґ«Ёп\AppData\Roaming\mozilla\firefox\profiles\q9uan22f.default\minidumps [13 files]

~~~ Chrome

[C:\Users\„ Ґ«Ёп\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\„ Ґ«Ёп\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\„ Ґ«Ёп\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\„ Ґ«Ёп\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on бкЎ 14.11.2015 Ј. at 21:20:04,94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 14.11.2015 г.
Scan Time: 21:29 ч.
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.11.14.05
Rootkit Database: v2015.11.13.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Данелия

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 359563
Time Elapsed: 30 min, 53 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 44
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\images, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\lib, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ar, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\bg, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ca, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\cs, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\da, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\de, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\el, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\en, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\es, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\fi, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\fil, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\fr, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\hi, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\hr, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\hu, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\id, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\it, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ja, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ko, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\lt, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\lv, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\nl, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\no, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\pl, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\pt_BR, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\pt_PT, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ro, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ru, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\se, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\sk, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\sl, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\sr, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\th, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\tr, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\uk, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\vi, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\zh_CN, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\zh_TW, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_metadata, Quarantined, [b6378eef1d6ea294f057540662a0d42c],

Files: 60
PUP.Optional.APNToolBar, C:\Users\Данелия\Downloads\KMPlayer_3-5-0-77_00_20130123015648[1].exe, Quarantined, [fcf1dda0ccbf74c24f72978d0cf57c84],
PUP.Optional.SafeInstall, C:\Users\Данелия\Downloads\vioplayerv.exe, Quarantined, [d518e29b95f6261045d50426cf3240c0],
HackTool.WpaKill, C:\Users\Данелия\Downloads\RemoveWAT v2.2.6.0.rar, Quarantined, [2cc16419e2a91e18166f2100f60b54ac],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\background.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\config.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\fb_visit.css, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\gui.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\gui1.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\i.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\icon128.png, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\icon16.png, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\icon48.png, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\jquery.cookies.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\jquery.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\languages.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\lib.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\manifest.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\stasi.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\xmldoc.js, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\images\na.png, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ar\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\bg\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ca\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\cs\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\da\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\de\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\el\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\en\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\es\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\fi\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\fil\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\fr\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\hi\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\hr\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\hu\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\id\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\it\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ja\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ko\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\lt\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\lv\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\nl\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\no\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\pl\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\pt_BR\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\pt_PT\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ro\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\ru\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\se\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\sk\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\sl\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\sr\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\th\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\tr\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\uk\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\vi\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\zh_CN\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_locales\zh_TW\messages.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_metadata\computed_hashes.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],
PUP.Optional.BrowseCoupon, C:\Users\Данелия\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.4_0\_metadata\verified_contents.json, Quarantined, [b6378eef1d6ea294f057540662a0d42c],

Physical Sectors: 0
(No malicious items detected)

(end)

Hitman



	HitmanPro 3.7.10.251

	www.hitmanpro.com

Computer name . . . . : DANI-PC
Windows . . . . . . . : 6.1.1.7601.X64/2
User name . . . . . . : Dani-PC\Данелия
UAC . . . . . . . . . : Disabled
License . . . . . . . : Free

Scan date . . . . . . : 2015-11-14 22:12:40
Scan mode . . . . . . : Normal
Scan duration . . . . : 7m 22s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No

Threats . . . . . . . : 1
Traces . . . . . . . : 2

Objects scanned . . . : 1 159 369
Files scanned . . . . : 34 237
Remnants scanned . . : 178 936 files / 946 196 keys

Miniport ____________________________________________________________________

Primary
DriverObject . . . : FFFFFA800331EE70
DriverName . . . . : \Driver\atapi
DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
StartIo . . . . . : 0000000000000000 +0
IRP_MJ_SCSI . . . : FFFFFA80031BF2C0 +0
Solution
DriverObject . . . : FFFFFA800331EE70
DriverName . . . . : \Driver\atapi
DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
StartIo . . . . . : 0000000000000000 +0
IRP_MJ_SCSI . . . : FFFFF88000FB14D8 \SystemRoot\system32\drivers\ataport.SYS+29912

Malware _____________________________________________________________________

C:\Users\Данелия\Downloads\PCPerformer-BitTorrent-c\PCPerformerSetup.exe
Size . . . . . . . : 797 472 bytes
Age . . . . . . . : 619.2 days (2014-03-05 17:43:46)
Entropy . . . . . : 7.7
SHA-256 . . . . . : 299D91DAAB1F10B1A391D7B9BD88882DF47BD3C13E78695F66F47CF4D941E7FC
Product . . . . . : Installer
Publisher
Description . . . : Installer
Version . . . . . : 15.9.28.27
Copyright . . . . : Copyright 2012
RSA Key Size . . . : 2048
LanguageID . . . . : 1033
Authenticode . . . : Valid
> Kaspersky . . . . : Trojan-Downloader.Win32.BrainInst.aj
Fuzzy . . . . . . : 102.0

Suspicious files ____________________________________________________________

C:\Users\Данелия\Desktop\FRST64.exe
Size . . . . . . . : 2 198 528 bytes
Age . . . . . . . : 3.5 days (2015-11-11 10:26:30)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 6E8BF313C850728328088C2DC10FB5369B9C938F71F58EC7EB8D51374EB1CA51
Needs elevation . : Yes
Fuzzy . . . . . . : 24.0
Program has no publisher information but prompts the user for permission elevation.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Time indicates that the file appeared recently on this computer.
Forensic Cluster
-8.5s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
-8.5s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6
-3.7s C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\edf6e0153a9ed41d4b5b4019efc8c0db_162cfd1f-088a-4ce3-977c-0ec6b2aab1d5
-1.0s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DB145CFEEC544B1582FED1ADA3370DD
-1.0s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DB145CFEEC544B1582FED1ADA3370DD
0.0s C:\Users\Данелия\Desktop\FRST64.exe
0.3s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E3B4D810CDA56990F6FC5106B77DA149_91D7B4B31E7581603335CF4FBCD8556C
0.3s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E3B4D810CDA56990F6FC5106B77DA149_91D7B4B31E7581603335CF4FBCD8556C
2.7s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2A3B02B6CC59692AE1FA060B11AAC36
2.7s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7F029ACF6CC9569F2CACD23115D634A9
2.7s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2A3B02B6CC59692AE1FA060B11AAC36
2.7s C:\Users\Данелия\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7F029ACF6CC9569F2CACD23115D634A9

Emisoft

Emsisoft Emergency Kit - Version 10.0
Last update: 14.11.2015 г. 22:27:32
User account: Dani-PC\Данелия

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:   14.11.2015 г. 22:28:31
Value: HKEY_USERS\S-1-5-21-2187845750-4061225191-2299496136-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR    detected: Setting.DisableTaskMgr (A)
Value: HKEY_USERS\S-1-5-21-2187845750-4061225191-2299496136-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS    detected: Setting.DisableRegistryTools (A)
C:\Users\Данелия\Downloads\PCPerformer-BitTorrent-c\PCPerformerSetup.exe    detected: Application.Bundler.InstallBrain.A (B)

Scanned 186723
Found 3

Scan end: 14.11.2015 г. 22:56:03
Scan time: 0:27:32

За съжаление утре хората ще си вземат лаптопа.Ще инсталирам програма за дистанционен контрол,и се надявам да успеем да приключим всичко както си му е редът.

Поздрави.

14 ноември 201510 г.

Лог файла от HitmanPro изглежда непълен.
Моля публикувайте целия лог файл. :)

14 ноември 201510 г.

Автор

HitmanPro_20151114_2221.log

Редактирано 14 ноември 201510 г. от onogondur (преглед на промените)

14 ноември 201510 г.

Нещата изглеждат наред и мисля да не ви прекарвам през последните стъпки на zoek, zhpcleaner, eset online scanner и securitycheck.

Изтрийте ръчно следния файл => C:\Users\Данелия\Downloads\PCPerformer-BitTorrent-c\PCPerformerSetup.exe

Финалните инструкции можете да видите тук => https://www.kaldata.com/forums/topic/247339-след-старт-hdd-работи-на-100/?do=findComment&comment=3236795

Ще маркирам случая като решен. Поздрави и приятен неделен ден!

14 ноември 201510 г.

Автор

Благодаря.

Бъдете здрави.

п.п.Ако някога минавате покрай Варна града голяма,отбийте се за по бира.

Редактирано 14 ноември 201510 г. от onogondur (преглед на промените)

Добре дошли!

Профилактична проверка на лаптоп

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)