Проблем с smartinf.ru

1 декември 201510 г.

Здравейте ,надявам се някой да ми помогне.Проблема е следния:При всяко включване на компютъра ми се стартира някаква руска търсачка smartinf.ru. Много е дразнеща.Благодаря предварително.

1 декември 201510 г.

преди 1 час, denkovi написа:

Здравейте ,надявам се някой да ми помогне.Проблема е следния:При всяко включване на компютъра ми се стартира някаква руска търсачка smartinf.ru. Много е дразнеща.Благодаря предварително.

Трудно ли беше, да прочетеш това? Следвай интрукциите и в тази тема която създаде, пусни необходимите логове.

https://www.kaldata.com/forums/topic/132819-%D1%81%D0%B8%D1%81%D1%82%D0%B5%D0%BC%D0%B0%D1%82%D0%B0-%D0%BC%D0%B8-%D0%B5-%D0%B8%D0%BD%D1%84%D0%B5%D0%BA%D1%82%D0%B8%D1%80%D0%B0%D0%BD%D0%B0-%D0%BA%D0%B0%D0%BA%D0%B2%D0%BE-%D0%B4%D0%B0-%D0%BF%D1%80%D0%B0%D0%B2%D1%8F-%D1%81%D0%B5%D0%B3%D0%B0/

Редактирано 1 декември 201510 г. от ghostBG86 (преглед на промените)

1 декември 201510 г.

Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:30-11-2015
Ran by Denkov (administrator) on DENKOV-PC (01-12-2015 13:25:57)
Running from C:\Users\Denkov\Desktop
Loaded Profiles: Denkov (Available Profiles: Denkov)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(www.BitComet.com) C:\Program Files\BitComet\BitComet.exe
(www.BitComet.com) C:\Program Files\BitComet\tools\BitCometService.exe
(Evgeny Lachinov) E:\New folder\Home Media Server\hms.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11680400 2012-10-26] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-06-04] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-29] (Microsoft Corporation)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\Run: [**><0H=89 <5480-A5@25@ (UPnP, DLNA, HTTP)<*>] => E:\New folder\Home Media Server\hms.exe /hide <===== ATTENTION (Value Name with invalid characters)
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [48145024 2015-10-14] (Skype Technologies S.A.)
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\MountPoints2: {c8590629-6bd8-11e3-afd8-94de80c0f0d3} - D:\setup.exe
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-12-23] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7BB90B8C-3BCB-4BFD-A839-174DB6646C5C}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSSE
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=130890304657892650&GUID=A259D736-6218-4491-9DA9-A3ABB266F54E
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll [2015-09-06] (Oracle Corporation)
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-09-06] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-11] ()
FF Plugin: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-09-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-09-06] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll [No File]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2946740568-875237454-2921467692-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Denkov\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-2946740568-875237454-2921467692-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Denkov\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-2946740568-875237454-2921467692-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Denkov\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-18] (Unity Technologies ApS)

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Презентации) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-01]
CHR Extension: (Google Документи) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-01]
CHR Extension: (Google Диск) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-17]
CHR Extension: (YouTube) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-18]
CHR Extension: (Google Търсене) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-17]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-03]
CHR Extension: (Gmail) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-10]
CHR HKLM\...\Chrome\Extension: [pgaidlfgjkmeendhknafahppllbniejm] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-06-04] (Advanced Micro Devices, Inc.) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2010-12-28] (www.BitComet.com)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284504 2015-04-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [46976 2009-07-14] (Microsoft Corporation)
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [19608 2012-10-25] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [239168 2013-12-23] (DT Soft Ltd)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
R1 MpKsl356320b4; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F5B7ED87-C94C-44E9-A178-09256863BC29}\MpKsl356320b4.sys [39168 2015-12-01] (Microsoft Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [428088 2013-12-27] () [File not signed]
U3 aycopqe7; C:\Windows\system32\Drivers\aycopqe7.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
S1 ArcCtrl; system32\drivers\ArcCtrl.sys [X]
S1 archlp; system32\drivers\archlp.sys [X]
S1 ArcSec; system32\drivers\ArcSec.sys [X]
S1 dcsjqwus; \??\C:\Windows\system32\drivers\dcsjqwus.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-01 13:25 - 2015-12-01 13:26 - 00012312 _____ C:\Users\Denkov\Desktop\FRST.txt
2015-12-01 13:25 - 2015-12-01 13:25 - 00000000 ____D C:\FRST
2015-12-01 13:23 - 2015-12-01 13:23 - 01721344 _____ (Farbar) C:\Users\Denkov\Desktop\FRST.exe
2015-11-28 19:47 - 2015-11-28 19:48 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-28 19:47 - 2015-11-28 19:47 - 00000000 ____D C:\Program Files\Adobe
2015-11-28 17:30 - 2015-11-28 17:30 - 00002130 _____ C:\Users\Denkov\Desktop\Minecraft.lnk
2015-11-28 17:30 - 2015-11-28 17:30 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft
2015-11-28 17:30 - 2015-11-28 17:30 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\.minecraft
2015-11-27 15:09 - 2015-11-27 15:09 - 00000000 ____D C:\Program Files\Guitar Hero - World Tour
2015-11-22 17:31 - 2015-11-22 17:32 - 00000000 ____D C:\Users\Denkov\Desktop\MC Worlds
2015-11-17 22:05 - 2015-11-17 22:05 - 00032387 _____ C:\Users\Denkov\Downloads\heist_2015.d.webdl.720p(subsunacs.net).rar
2015-11-15 10:58 - 2015-11-15 10:58 - 00000000 ____D C:\Users\Denkov\Desktop\Нова папка (7)
2015-11-13 09:19 - 2015-11-03 19:46 - 02386944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-11-11 18:43 - 2015-11-11 18:43 - 50433966 _____ C:\Users\Denkov\Downloads\Dev-Cpp 5.11 TDM-GCC 4.9.2 Setup.exe
2015-11-11 07:55 - 2015-10-29 19:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-11-11 07:55 - 2015-10-29 19:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-11-11 07:55 - 2015-10-29 19:49 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-11-11 07:55 - 2015-10-29 19:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-11-11 07:55 - 2015-10-13 18:31 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 07:55 - 2015-10-13 18:31 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 07:54 - 2015-11-03 23:51 - 00342728 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-11-11 07:54 - 2015-10-31 00:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-11-11 07:54 - 2015-10-31 00:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-11-11 07:54 - 2015-10-31 00:52 - 20331520 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-11-11 07:54 - 2015-10-31 00:47 - 00504832 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-11-11 07:54 - 2015-10-31 00:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-11-11 07:54 - 2015-10-31 00:45 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-11-11 07:54 - 2015-10-31 00:45 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-11-11 07:54 - 2015-10-31 00:44 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-11-11 07:54 - 2015-10-31 00:42 - 02279936 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-11-11 07:54 - 2015-10-31 00:39 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-11-11 07:54 - 2015-10-31 00:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-11-11 07:54 - 2015-10-31 00:37 - 00480256 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-11-11 07:54 - 2015-10-31 00:36 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-11-11 07:54 - 2015-10-31 00:36 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-11-11 07:54 - 2015-10-31 00:36 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-11-11 07:54 - 2015-10-31 00:36 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-11-11 07:54 - 2015-10-31 00:31 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-11 07:54 - 2015-10-31 00:28 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-11-11 07:54 - 2015-10-31 00:23 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-11 07:54 - 2015-10-31 00:21 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-11-11 07:54 - 2015-10-31 00:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-11-11 07:54 - 2015-10-31 00:18 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-11-11 07:54 - 2015-10-31 00:17 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-11-11 07:54 - 2015-10-31 00:16 - 04527616 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-11-11 07:54 - 2015-10-31 00:11 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-11-11 07:54 - 2015-10-31 00:10 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-11-11 07:54 - 2015-10-31 00:09 - 12854272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-11-11 07:54 - 2015-10-31 00:09 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-11-11 07:54 - 2015-10-31 00:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-11-11 07:54 - 2015-10-31 00:09 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-11-11 07:54 - 2015-10-30 23:51 - 02011136 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-11-11 07:54 - 2015-10-30 23:48 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-11-11 07:54 - 2015-10-30 23:46 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-11-11 07:54 - 2015-10-20 02:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-11-11 07:54 - 2015-10-20 02:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 07:54 - 2015-10-20 02:52 - 00138176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 07:54 - 2015-10-20 02:52 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 07:54 - 2015-10-20 02:48 - 01308160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 07:54 - 2015-10-20 02:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 07:54 - 2015-10-20 02:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 07:54 - 2015-10-20 02:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 07:54 - 2015-10-20 02:44 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 07:54 - 2015-10-20 02:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 07:54 - 2015-10-20 02:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 07:54 - 2015-10-20 02:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 07:54 - 2015-10-20 02:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 07:54 - 2015-10-20 01:29 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 07:54 - 2015-10-20 01:28 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 07:54 - 2015-10-20 01:28 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 07:54 - 2015-10-13 06:50 - 00712640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 07:54 - 2015-09-23 15:09 - 00371920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 07:54 - 2015-09-23 15:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 02955776 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 02061824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-11-11 07:53 - 2015-10-20 19:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-11-11 07:53 - 2015-10-20 19:45 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-11-11 07:53 - 2015-10-20 19:45 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-11-11 07:53 - 2015-10-20 19:45 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-11-11 07:53 - 2015-10-20 19:45 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-11-11 07:53 - 2015-10-01 19:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 07:53 - 2015-10-01 19:50 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-11-10 20:50 - 2015-11-10 20:50 - 00000000 ____D C:\Users\Denkov\Desktop\Нова папка (5)
2015-11-05 19:31 - 2015-11-05 19:31 - 00000000 ____D C:\Program Files\Adware Removal Tool by TSA

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-01 13:25 - 2013-12-28 12:34 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Skype
2015-12-01 13:25 - 2013-12-23 16:32 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\BitComet
2015-12-01 13:25 - 2009-07-14 04:37 - 00000000 ____D C:\Windows
2015-12-01 13:21 - 2014-05-01 19:48 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-01 13:16 - 2014-09-03 14:58 - 00001012 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2946740568-875237454-2921467692-1000UA.job
2015-12-01 13:15 - 2013-12-22 23:17 - 00000986 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-01 12:18 - 2009-07-14 06:34 - 00026432 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-01 12:18 - 2009-07-14 06:34 - 00026432 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-01 08:33 - 2013-12-29 20:24 - 00000000 ____D C:\Users\Denkov\AppData\Local\ElevatedDiagnostics
2015-12-01 08:05 - 2014-01-27 19:03 - 00000000 ____D C:\ProgramData\Home Media Server
2015-12-01 08:05 - 2013-12-22 23:17 - 00000982 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-01 08:05 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-30 20:16 - 2014-09-03 14:58 - 00000960 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2946740568-875237454-2921467692-1000Core.job
2015-11-30 13:57 - 2013-12-23 14:15 - 00000000 ____D C:\Users\Denkov\AppData\Local\CrashDumps
2015-11-30 13:42 - 2012-11-07 22:03 - 04358144 _____ (GSC Game World) C:\Windows\uncsetup.exe
2015-11-28 19:51 - 2013-12-24 13:16 - 00000000 ____D C:\Users\Denkov\AppData\Local\Adobe
2015-11-28 19:47 - 2014-02-11 22:41 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-11-28 19:47 - 2014-02-11 22:40 - 00000000 ____D C:\ProgramData\Adobe
2015-11-19 20:54 - 2013-12-22 05:02 - 00782470 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-19 20:54 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2015-11-16 20:27 - 2013-12-28 12:34 - 00000000 ____D C:\ProgramData\Skype
2015-11-14 09:30 - 2009-07-14 06:33 - 00362048 _____ C:\Windows\system32\FNTCACHE.DAT
2015-11-11 22:33 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2015-11-11 21:21 - 2013-12-24 13:17 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-11-11 21:21 - 2013-12-24 13:17 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-11-11 19:41 - 2009-07-14 09:50 - 00000000 ____D C:\Program Files\Windows Journal
2015-11-11 19:15 - 2013-12-23 20:21 - 00000000 ____D C:\Windows\system32\MRT
2015-11-11 19:08 - 2013-12-23 20:21 - 143250520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-11-10 08:41 - 2014-07-31 08:05 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-11-08 23:56 - 2015-09-06 18:51 - 00000000 ____D C:\Program Files\Common Files\Java
2015-11-08 23:56 - 2015-04-05 09:51 - 00000000 ___SD C:\Windows\system32\GWX
2015-11-08 23:56 - 2014-12-19 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-08 23:56 - 2014-12-19 20:49 - 00000000 ____D C:\Program Files\Java
2015-11-08 23:56 - 2014-08-19 12:20 - 00000000 ____D C:\ProgramData\Oracle
2015-11-08 23:56 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2015-11-08 19:34 - 2013-12-24 13:51 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Media Player Classic
2015-11-08 13:57 - 2013-12-22 23:10 - 00000000 ____D C:\Users\Denkov
2015-11-06 21:43 - 2014-03-06 22:10 - 00000000 ____D C:\Users\Denkov\Documents\ConvertXtoDVD
2015-11-05 19:01 - 2015-09-06 18:50 - 00000000 ____D C:\Users\Denkov\.oracle_jre_usage

==================== Files in the root of some directories =======

2014-03-06 21:42 - 2015-02-22 21:10 - 0087608 _____ () C:\Users\Denkov\AppData\Roaming\inst.exe
2014-03-06 21:42 - 2015-02-22 21:10 - 0007887 _____ () C:\Users\Denkov\AppData\Roaming\pcouffin.cat
2014-03-06 21:42 - 2015-02-22 21:10 - 0001144 _____ () C:\Users\Denkov\AppData\Roaming\pcouffin.inf
2014-03-06 21:43 - 2015-02-22 21:10 - 0000055 _____ () C:\Users\Denkov\AppData\Roaming\pcouffin.log
2014-03-06 21:42 - 2015-02-22 21:10 - 0047360 _____ (VSO Software) C:\Users\Denkov\AppData\Roaming\pcouffin.sys
2014-04-10 15:39 - 2014-11-11 11:29 - 0001189 _____ () C:\Users\Denkov\AppData\Roaming\vso_ts_preview.xml
2014-08-09 20:51 - 2015-06-10 20:51 - 0007601 _____ () C:\Users\Denkov\AppData\Local\Resmon.ResmonCfg
2014-12-23 14:29 - 2014-12-23 14:29 - 0000260 _____ () C:\Users\Denkov\AppData\Local\SocialModCfg.txt
2014-12-23 13:29 - 2014-12-23 13:42 - 0000676 _____ () C:\Users\Denkov\AppData\Local\TwitchModCfg.txt

Some files in TEMP:
====================
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe
C:\Users\Denkov\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe
C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe
C:\Users\Denkov\AppData\Local\Temp\Uninstall.exe
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-11-30 10:02

==================== End of FRST.txt ============================

Addition.txt

1 декември 201510 г.

Здравейте,

СТЪПКА 1

Ще се наложи да деинсталираме временно Google Chrome, защото адуера го е обновил до последната версия на разработчиците, където всички защитни механизми са свалени и дори да го почистим гадината пак ще го зарази в най-скоро време. Решението в този случай е само едно - преинсталоране на браузъра. Преди това обаче направете бекъп на паролите и любимите страници:

Експортиране на отметки от Chrome:

В горния десен ъгъл на прозореца на браузъра кликнете върху менюто на Chrome.
Изберете Отметки > Диспечер на отметките.
Кликнете върху менюто „Организиране“ в диспечера.
Сега изберете Export bookmarks to HTML file.

Тук са даден инструкции след това как да ги импортнете обратно след преинсталацията на браузъра:

https://support.google.com/chrome/answer/96816?hl=bg

http://www.wikihow.com/Export-Bookmarks-from-Chrome

За паролите вижте дали следния инструмент сработва:

http://www.intowindo...chrome-browser/

Засичането на инструмента от антивирусните програми е нормално, защото те не знаят дали вие или зловреден софтуер се опитва да достигне паролите в браузъра. Просто игнорирайте засичането.

След това задължително спрете синхронизацията на акаунта си, защото ако имате такава и тя е заразена, след новата преинсталация на браузъра, заразата отново ще се прехвърли на машината ви:

https://support.google.com/chrome/answer/2390059?hl=bg

Сега вече изтеглете програмата GeekUninstaller и я запазете на десктопа.

Разархивирайте я и стартирайте файла geek.exe
От списъка намерете Google Chrome (примера е за Mozilla Firefox, но това е просто за показно).

Кликнете с десен бутон върху програмата и изберете Uninstall

След края на инсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи):

Пример за Mozilla браузъра:

Натиснете бутона Finish за да изтриете останките от програмата.

СТЪПКА 2

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Сега вече можете да изтеглите и инсталирате последната СТАБИЛНА версия на Google Chrome оттук.

След това пишете дали има подобрение.

Поздрави!

10 декември 201510 г.

Автор

Здравейте.Съжалявам,че отговора ми се проточи във времето,но нямах време да пиша.Досадния браузер на smartinf.ru досега не се е появил.Надявам се така да си остане.Искрено благодаря за помощта ви.Бъдете здрави.

10 декември 201510 г.

преди 3 часа, denkovi написа:

Здравейте.Съжалявам,че отговора ми се проточи във времето,но нямах време да пиша.Досадния браузер на smartinf.ru досега не се е появил.Надявам се така да си остане.Искрено благодаря за помощта ви.Бъдете здрави.

Супер. Аз ще маркирам случая като решен, но все пак бихте ли публикували лог файла след изпълнението на скрипта от горния ми коментар?

Поздрави!

11 декември 201510 г.

Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-12-2015
Ran by Denkov (administrator) on DENKOV-PC (11-12-2015 10:43:40)
Running from C:\Users\Denkov\Desktop
Loaded Profiles: Denkov (Available Profiles: Denkov)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Program Files\iStarKaraoke\iStarKaraoke.exe
(Evgeny Lachinov) E:\New folder\Home Media Server\hms.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(www.BitComet.com) C:\Program Files\BitComet\BitComet.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(www.BitComet.com) C:\Program Files\BitComet\tools\BitCometService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.211.2215.0.exe
(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [676608 2013-06-04] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-29] (Microsoft Corporation)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
HKLM\...\Run: [NWEReboot] => [X]
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11680400 2012-10-26] (Realtek Semiconductor)
HKLM\...\Run: [iStarKaraoke] => C:\Program Files\iStarKaraoke\iStarKaraoke.exe [221184 2015-05-25] ()
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\Run: [**><0H=89 <5480-A5@25@ (UPnP, DLNA, HTTP)<*>] => "E:\New folder\Home Media Server\hms.exe" /hide <===== ATTENTION (Value Name with invalid characters)
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [48145024 2015-10-14] (Skype Technologies S.A.)
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\Run: [BitComet] => C:\Program Files\BitComet\BitComet.exe [12805888 2013-02-19] (www.BitComet.com)
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-06-04] (AMD)
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\...\MountPoints2: {c8590629-6bd8-11e3-afd8-94de80c0f0d3} - F:\Setup.exe
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-12-23] (Microsoft Corporation)
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
BootExecute: autocheck autochk * sdnclean.exeSsiEfr.exeSsiEfr.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{7BB90B8C-3BCB-4BFD-A839-174DB6646C5C}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSSE
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=COSP&ptag=D120415-A60FA26CFB78147A880F&form=CONMHP&conlogo=CT3332038
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D120415-A60FA26CFB78147A880F&form=CONBDF&conlogo=CT3332038&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://supertoolbar.ask.com/redirect?client=ie&tb=WBR&o=&src=crm&q={searchTerms}&locale={locale.underscore}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File
Toolbar: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466
FF NewTab: hxxp://www.bing.com/?pc=COSP&ptag=D120415-A60FA26CFB78147A880F&form=CONMHP&conlogo=CT3332038
FF SelectedSearchEngine: Bing®
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-09] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-06] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2946740568-875237454-2921467692-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Denkov\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-2946740568-875237454-2921467692-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Denkov\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-2946740568-875237454-2921467692-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Denkov\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-06-18] (Unity Technologies ApS)

Chrome:
=======
CHR Profile: C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-06]
CHR Extension: (Google Docs) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-06]
CHR Extension: (Google Drive) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-06]
CHR Extension: (YouTube) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-06]
CHR Extension: (Google Search) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-06]
CHR Extension: (Google Sheets) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-06]
CHR Extension: (Google Docs Offline) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-06]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-06]
CHR Extension: (Gmail) - C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-06]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-06-04] (Advanced Micro Devices, Inc.) [File not signed]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2010-12-28] (www.BitComet.com)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284504 2015-04-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [46976 2009-07-14] (Microsoft Corporation)
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [48256 2012-04-09] (Advanced Micro Devices)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [19608 2012-10-25] ()
S3 DCamUSBNovatek; C:\Windows\System32\Drivers\nvtcam.sys [79872 2005-11-01] (NTK) [File not signed]
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [239168 2013-12-23] (DT Soft Ltd)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-12-04] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [428088 2013-12-27] () [File not signed]
R3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
R1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [48128 2010-11-20] (Microsoft Corporation)
R3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
R1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [296064 2010-11-20] (Microsoft Corporation)
U3 ahvn6jm3; C:\Windows\system32\Drivers\ahvn6jm3.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
S1 ArcCtrl; system32\drivers\ArcCtrl.sys [X]
S1 archlp; system32\drivers\archlp.sys [X]
S1 ArcSec; system32\drivers\ArcSec.sys [X]
S1 dcsjqwus; \??\C:\Windows\system32\drivers\dcsjqwus.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
U5 Tosrfcom; C:\Windows\System32\Drivers\Tosrfcom.sys [64896 2005-08-01] (TOSHIBA Corporation) [File not signed]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-11 10:43 - 2015-12-11 10:44 - 00013609 _____ C:\Users\Denkov\Desktop\FRST.txt
2015-12-11 10:43 - 2015-12-11 10:43 - 01720320 _____ (Farbar) C:\Users\Denkov\Desktop\FRST.exe
2015-12-09 10:03 - 2015-11-11 22:52 - 00341192 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-12-09 10:03 - 2015-11-11 20:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2015-12-09 10:03 - 2015-11-11 20:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2015-12-09 10:03 - 2015-11-11 18:00 - 12856832 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-12-09 10:03 - 2015-11-11 17:44 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-12-09 10:03 - 2015-11-11 17:44 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-12-09 10:03 - 2015-11-11 17:41 - 20366848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-12-09 10:03 - 2015-11-11 16:57 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-12-09 10:03 - 2015-11-10 20:39 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-12-09 10:03 - 2015-11-10 20:39 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-12-09 10:03 - 2015-11-10 20:39 - 00811520 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2015-12-09 10:03 - 2015-11-10 19:40 - 02386944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-12-09 10:03 - 2015-11-10 02:24 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-12-09 10:03 - 2015-11-10 02:24 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-12-09 10:03 - 2015-11-10 02:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-12-09 10:03 - 2015-11-10 02:12 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-12-09 10:03 - 2015-11-10 02:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-12-09 10:03 - 2015-11-10 02:11 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-12-09 10:03 - 2015-11-10 02:08 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-12-09 10:03 - 2015-11-10 02:06 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-12-09 10:03 - 2015-11-10 02:06 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-12-09 10:03 - 2015-11-10 02:04 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-12-09 10:03 - 2015-11-10 02:03 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-12-09 10:03 - 2015-11-10 02:03 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-12-09 10:03 - 2015-11-10 02:02 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-12-09 10:03 - 2015-11-10 01:57 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-12-09 10:03 - 2015-11-10 01:50 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-12-09 10:03 - 2015-11-10 01:47 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-12-09 10:03 - 2015-11-10 01:44 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-12-09 10:03 - 2015-11-10 01:37 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-12-09 10:03 - 2015-11-10 01:36 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-12-09 10:03 - 2015-11-10 01:36 - 00687104 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-12-09 10:03 - 2015-11-10 01:36 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-12-09 10:03 - 2015-11-10 01:35 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-12-09 10:03 - 2015-11-10 01:17 - 02011136 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-12-09 10:03 - 2015-11-10 01:14 - 01311744 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-12-09 10:03 - 2015-11-10 01:12 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-12-09 10:02 - 2015-11-10 02:13 - 00496640 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-12-09 10:02 - 2015-11-10 02:02 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-12-09 10:02 - 2015-11-10 01:46 - 04514816 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-12-09 10:02 - 2015-11-05 21:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2015-12-09 10:02 - 2015-11-05 21:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-12-09 10:02 - 2015-11-05 11:48 - 00117760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2015-12-09 10:02 - 2015-11-03 20:56 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2015-12-09 10:02 - 2015-11-03 20:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2015-12-08 18:50 - 2015-12-08 18:50 - 00864038 _____ C:\Users\Denkov\Downloads\4_8_reshenia (8).zip
2015-12-08 18:48 - 2015-12-08 18:48 - 01047290 _____ C:\Users\Denkov\Downloads\4_8_reshenia (7).zip
2015-12-08 18:46 - 2015-12-08 18:46 - 01047290 _____ C:\Users\Denkov\Downloads\4_8_reshenia (6).zip
2015-12-08 18:46 - 2015-12-08 18:46 - 00166185 _____ C:\Users\Denkov\Downloads\6 (8).zip
2015-12-08 18:46 - 2015-12-08 18:46 - 00115848 _____ C:\Users\Denkov\Downloads\6 (9).zip
2015-12-08 18:44 - 2015-12-08 18:44 - 00166185 _____ C:\Users\Denkov\Downloads\6 (7).zip
2015-12-08 18:36 - 2015-12-08 18:36 - 00880247 _____ C:\Users\Denkov\Downloads\4_8_reshenia (5).zip
2015-12-08 18:36 - 2015-12-08 18:36 - 00166185 _____ C:\Users\Denkov\Downloads\6 (4).zip
2015-12-08 18:36 - 2015-12-08 18:36 - 00118010 _____ C:\Users\Denkov\Downloads\6 (6).zip
2015-12-08 18:36 - 2015-12-08 18:36 - 00078057 _____ C:\Users\Denkov\Downloads\6 (5).zip
2015-12-08 18:35 - 2015-12-08 18:35 - 00078401 _____ C:\Users\Denkov\Downloads\6 (3).zip
2015-12-08 18:34 - 2015-12-08 18:34 - 00729455 _____ C:\Users\Denkov\Downloads\4_8_reshenia (4).zip
2015-12-08 18:34 - 2015-12-08 18:34 - 00078401 _____ C:\Users\Denkov\Downloads\6 (2).zip
2015-12-08 11:13 - 2015-12-08 11:15 - 00000000 ____D C:\Program Files\iStarKaraoke
2015-12-08 10:38 - 2015-12-08 10:40 - 00000000 ____D C:\ProgramData\Recisio
2015-12-07 20:29 - 2015-12-07 20:29 - 01239090 _____ C:\Users\Denkov\Downloads\4_8_reshenia.zip
2015-12-07 20:29 - 2015-12-07 20:29 - 01239090 _____ C:\Users\Denkov\Downloads\4_8_reshenia (2).zip
2015-12-07 20:29 - 2015-12-07 20:29 - 01239090 _____ C:\Users\Denkov\Downloads\4_8_reshenia (1).zip
2015-12-07 20:29 - 2015-12-07 20:29 - 00880247 _____ C:\Users\Denkov\Downloads\4_8_reshenia (3).zip
2015-12-07 20:26 - 2015-12-07 20:26 - 00166185 _____ C:\Users\Denkov\Downloads\6 (1).zip
2015-12-07 20:22 - 2015-12-07 20:22 - 00078057 _____ C:\Users\Denkov\Downloads\6.zip
2015-12-06 18:34 - 2015-12-06 18:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Psyonix
2015-12-06 18:31 - 2015-12-06 18:31 - 00000000 ____D C:\Program Files\Psyonix
2015-12-06 15:15 - 2015-12-06 18:14 - 00000000 ___RD C:\Users\Denkov\Virtual Machines
2015-12-06 15:09 - 2015-12-06 15:09 - 00000000 ____D C:\Program Files\Windows Virtual PC
2015-12-06 15:06 - 2010-11-20 14:30 - 00296064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcvmm.sys
2015-12-06 15:06 - 2010-11-20 14:30 - 00172416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpchbus.sys
2015-12-06 15:06 - 2010-11-20 14:21 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\vpchbuspipe.dll
2015-12-06 15:06 - 2010-11-20 14:17 - 02171392 _____ (Microsoft Corporation) C:\Windows\system32\VPCWizard.exe
2015-12-06 15:06 - 2010-11-20 12:50 - 00559616 _____ (Microsoft Corporation) C:\Windows\system32\VMCPropertyHandler.dll
2015-12-06 15:06 - 2010-11-20 12:50 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcusb.sys
2015-12-06 15:06 - 2010-11-20 12:50 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcnfltr.sys
2015-12-06 15:05 - 2010-11-20 14:17 - 03330560 _____ (Microsoft Corporation) C:\Windows\system32\vpc.exe
2015-12-06 15:05 - 2010-11-20 14:17 - 01260032 _____ (Microsoft Corporation) C:\Windows\system32\VPCSettings.exe
2015-12-06 15:05 - 2010-11-20 12:52 - 01003008 _____ (Microsoft Corporation) C:\Windows\system32\VMWindow.exe
2015-12-06 15:05 - 2010-11-20 12:52 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\vmsal.exe
2015-12-06 11:01 - 2015-12-10 14:33 - 00002129 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-06 11:01 - 2015-12-06 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-06 11:00 - 2015-12-11 10:32 - 00000982 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-06 11:00 - 2015-12-06 11:07 - 00000986 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-06 10:34 - 2015-12-06 10:46 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Geek Uninstaller
2015-12-06 10:29 - 2015-12-06 10:29 - 06340896 _____ (Geek Uninstaller) C:\Users\Denkov\Desktop\geek.exe
2015-12-05 23:45 - 2015-12-06 18:45 - 00000000 ____D C:\ProgramData\SkidRow
2015-12-05 23:45 - 2015-12-05 23:45 - 00000000 ____D C:\Users\Denkov\Documents\Paradox Interactive
2015-12-05 23:34 - 2015-12-06 14:31 - 00000000 ____D C:\Program Files\Paradox Interactive
2015-12-05 14:18 - 2015-12-05 14:18 - 00054156 ____H C:\Windows\QTFont.qfn
2015-12-05 14:18 - 2015-12-05 14:18 - 00000000 _____ C:\Users\Denkov\AppData\LocalLow\QuickTime.qtp
2015-12-04 13:42 - 2015-12-04 13:42 - 00345360 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService.dll
2015-12-04 13:42 - 2015-12-04 13:42 - 00002896 _____ C:\Windows\system32\LavasoftTcpServiceOff.ini
2015-12-04 13:42 - 2015-12-04 13:42 - 00000268 _____ C:\Prefs.js
2015-12-04 11:59 - 2009-02-09 15:05 - 00002236 _____ C:\Windows\system32\askcom.xml
2015-12-04 11:58 - 2015-12-04 11:58 - 00000000 ____D C:\Program Files\Webroot
2015-12-04 11:58 - 2015-12-04 11:58 - 00000000 ____D C:\Program Files\MSSOAP
2015-12-04 11:58 - 2015-12-04 11:58 - 00000000 ____D C:\Program Files\Common Files\MSSoap
2015-12-04 11:57 - 2015-12-04 11:58 - 00000170 _____ C:\Windows\install.dat
2015-12-04 11:41 - 2015-12-04 11:41 - 00019984 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2015-12-03 23:34 - 2015-10-09 01:17 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2015-12-03 23:34 - 2015-10-09 01:13 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\kbdgeoqw.dll
2015-12-03 23:34 - 2015-10-09 01:13 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZEL.DLL
2015-12-03 23:34 - 2015-10-09 01:13 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDAZE.DLL
2015-12-03 23:34 - 2015-10-08 21:13 - 00419928 _____ C:\Windows\system32\locale.nls
2015-12-03 23:34 - 2015-08-05 19:40 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2015-12-03 23:34 - 2015-08-05 18:58 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-12-03 23:33 - 2015-11-20 20:34 - 02956800 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-12-03 23:33 - 2015-11-20 20:34 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-12-03 23:33 - 2015-11-20 20:33 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-12-03 23:33 - 2015-11-20 20:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-12-03 23:33 - 2015-11-20 20:33 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-12-03 00:22 - 2015-12-03 00:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bluetooth
2015-12-03 00:22 - 2015-12-03 00:22 - 00000000 ____D C:\Program Files\Toshiba
2015-12-03 00:18 - 2005-11-01 15:18 - 00080512 _____ (Windows (R) 2000 DDK provider) C:\Windows\system32\Drivers\nvtcamd2.sys
2015-12-03 00:18 - 2005-11-01 15:18 - 00079872 _____ (NTK) C:\Windows\system32\Drivers\nvtcam.sys
2015-12-03 00:18 - 2004-08-03 23:08 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\~GLH0001.TMP
2015-12-02 15:14 - 2015-12-02 15:14 - 00000000 ____D C:\sony
2015-12-01 13:25 - 2015-12-11 10:43 - 00000000 ____D C:\FRST
2015-11-28 19:47 - 2015-12-01 22:18 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-28 19:47 - 2015-11-28 19:47 - 00000000 ____D C:\Program Files\Adobe
2015-11-22 17:31 - 2015-11-22 17:32 - 00000000 ____D C:\Users\Denkov\Desktop\MC Worlds
2015-11-11 07:55 - 2015-10-29 19:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-11-11 07:55 - 2015-10-29 19:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-11-11 07:55 - 2015-10-29 19:49 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-11-11 07:55 - 2015-10-29 19:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-11-11 07:55 - 2015-10-13 18:31 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 07:55 - 2015-10-13 18:31 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 07:54 - 2015-10-20 02:52 - 03991488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-11-11 07:54 - 2015-10-20 02:52 - 03935680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 07:54 - 2015-10-20 02:52 - 00138176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-11-11 07:54 - 2015-10-20 02:52 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-11-11 07:54 - 2015-10-20 02:48 - 01308160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-11-11 07:54 - 2015-10-20 02:45 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00251392 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-11-11 07:54 - 2015-10-20 02:45 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-11-11 07:54 - 2015-10-20 02:45 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-11-11 07:54 - 2015-10-20 02:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-11-11 07:54 - 2015-10-20 02:44 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-11-11 07:54 - 2015-10-20 02:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-11-11 07:54 - 2015-10-20 02:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-11-11 07:54 - 2015-10-20 02:35 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-11-11 07:54 - 2015-10-20 02:35 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-11-11 07:54 - 2015-10-20 01:29 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-11-11 07:54 - 2015-10-20 01:28 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-11-11 07:54 - 2015-10-20 01:28 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-11-11 07:54 - 2015-10-13 06:50 - 00712640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 07:54 - 2015-09-23 15:09 - 00371920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-11-11 07:54 - 2015-09-23 15:09 - 00251000 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2015-11-11 07:53 - 2015-10-01 19:50 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-11-11 07:53 - 2015-10-01 19:50 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-11 10:42 - 2013-12-23 16:32 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\BitComet
2015-12-11 10:40 - 2009-07-14 06:34 - 00026432 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-11 10:40 - 2009-07-14 06:34 - 00026432 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-11 10:34 - 2013-12-28 12:34 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Skype
2015-12-11 10:32 - 2014-09-03 14:58 - 00000960 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2946740568-875237454-2921467692-1000Core.job
2015-12-11 10:32 - 2014-01-27 19:03 - 00000000 ____D C:\ProgramData\Home Media Server
2015-12-11 10:32 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-11 00:21 - 2014-05-01 19:48 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-11 00:16 - 2014-09-03 14:58 - 00001012 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2946740568-875237454-2921467692-1000UA.job
2015-12-09 22:35 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2015-12-09 19:28 - 2009-07-14 06:33 - 00362048 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-09 19:26 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2015-12-09 19:07 - 2013-12-23 20:21 - 00000000 ____D C:\Windows\system32\MRT
2015-12-09 19:01 - 2013-12-23 20:21 - 137798368 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-12-09 15:21 - 2013-12-24 13:17 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-12-09 15:21 - 2013-12-24 13:17 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-12-09 05:39 - 2013-12-22 23:57 - 00247976 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-12-08 11:15 - 2013-12-23 00:07 - 00000000 ____D C:\ProgramData\Package Cache
2015-12-08 10:50 - 2013-12-23 14:15 - 00000000 ____D C:\Users\Denkov\AppData\Local\CrashDumps
2015-12-08 09:05 - 2014-05-04 16:45 - 00000000 ___RD C:\Users\Denkov\Desktop\сйфкасйг
2015-12-07 20:50 - 2013-12-22 05:02 - 00782470 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-07 17:01 - 2013-12-23 21:13 - 00000022 _____ C:\Windows\GPU-Z.INI
2015-12-07 12:07 - 2014-11-29 17:17 - 00000000 ____D C:\Program Files\Sony
2015-12-07 12:06 - 2014-12-03 14:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2015-12-07 12:04 - 2014-12-03 14:43 - 00001400 _____ C:\Users\Denkov\Documents\Default.sfvidcap
2015-12-07 12:03 - 2014-11-29 17:25 - 00000000 ____D C:\Users\Denkov\Documents\Movie Studio Platinum 12.0 Projects
2015-12-07 11:38 - 2013-12-22 23:22 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2015-12-07 11:38 - 2009-07-14 06:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-12-07 11:34 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Public\Libraries
2015-12-07 11:29 - 2014-01-18 17:39 - 00004608 ___SH C:\Users\Denkov\Thumbs.db
2015-12-07 11:07 - 2013-12-28 20:39 - 00000000 ____D C:\MediaServer
2015-12-07 11:05 - 2015-01-04 14:05 - 00000000 ____D C:\AdwCleaner
2015-12-06 15:15 - 2013-12-22 23:10 - 00000000 ____D C:\Users\Denkov
2015-12-06 15:08 - 2009-07-14 04:37 - 00000000 ____D C:\Windows
2015-12-06 11:01 - 2013-12-22 23:17 - 00000000 ____D C:\Users\Denkov\AppData\Local\Google
2015-12-06 11:00 - 2013-12-22 23:17 - 00000000 ____D C:\Program Files\Google
2015-12-05 23:32 - 2013-12-23 16:37 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\DAEMON Tools Lite
2015-12-05 14:14 - 2013-12-22 23:23 - 00000000 ____D C:\Windows\system32\RTCOM
2015-12-05 13:23 - 2015-09-06 18:51 - 00000000 ____D C:\Program Files\Common Files\Java
2015-12-05 13:23 - 2015-09-06 18:49 - 00000000 ____D C:\Users\Denkov\AppData\LocalLow\Oracle
2015-12-05 13:23 - 2015-08-17 19:31 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo 2 &Diablo 2 Lord Of Destruction
2015-12-05 13:23 - 2015-07-21 10:11 - 00000000 ____D C:\Users\Denkov\Desktop\Нова папка (2)
2015-12-05 13:23 - 2015-06-01 08:31 - 00000000 ____D C:\Users\Denkov\AppData\Local\Вoйти в Интeрнет
2015-12-05 13:23 - 2015-06-01 08:25 - 00000000 ____D C:\Users\Denkov\AppData\Local\Кризис
2015-12-05 13:23 - 2015-06-01 08:23 - 00000000 ____D C:\Users\Denkov\AppData\Local\Поиcк в Интeрнете
2015-12-05 13:23 - 2014-12-19 20:49 - 00000000 ____D C:\Program Files\Java
2015-12-05 13:23 - 2014-08-30 15:39 - 00000000 ____D C:\Users\Denkov\Desktop\New folder
2015-12-05 13:23 - 2014-06-26 18:42 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Battle.net
2015-12-05 13:23 - 2014-06-20 08:35 - 00000000 ___RD C:\Users\Denkov\Desktop\Математика
2015-12-05 13:23 - 2014-05-03 14:40 - 00000000 ____D C:\Users\Denkov\AppData\Local\Nero_AG
2015-12-05 13:23 - 2014-05-03 14:40 - 00000000 ____D C:\Users\Denkov\AppData\Local\Nero
2015-12-05 13:23 - 2014-05-02 19:00 - 00000000 ____D C:\Users\Denkov\AppData\Local\Game Updater
2015-12-05 13:23 - 2014-04-19 20:31 - 00000000 ____D C:\Users\Denkov\AppData\Local\SimSync.de
2015-12-05 13:23 - 2014-04-06 18:01 - 00000000 ____D C:\Users\Denkov\AppData\Local\Unity
2015-12-05 13:23 - 2014-02-09 17:42 - 00000000 ____D C:\Users\Denkov\AppData\Local\HMSMPEG
2015-12-05 13:23 - 2013-12-30 11:23 - 00000000 ____D C:\Users\Denkov\AppData\Local\ArcSoft
2015-12-05 13:23 - 2013-12-24 15:10 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-12-05 13:23 - 2013-12-23 19:33 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\ArcSoft
2015-12-05 13:23 - 2013-12-23 16:50 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-12-05 13:23 - 2013-12-22 17:29 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
2015-12-05 13:23 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2015-12-05 13:22 - 2015-10-03 15:58 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Brackets
2015-12-05 13:22 - 2015-03-02 21:30 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Sierra
2015-12-05 13:22 - 2014-11-29 17:17 - 00000000 ____D C:\Users\Denkov\AppData\Local\Sony
2015-12-05 13:22 - 2014-11-13 20:12 - 00000000 ____D C:\Users\Denkov\Desktop\New folder (2)
2015-12-05 13:22 - 2014-08-19 09:36 - 00000000 ____D C:\Users\Denkov\AppData\LocalLow\Sun
2015-12-05 13:22 - 2014-04-06 18:01 - 00000000 ____D C:\Users\Denkov\AppData\LocalLow\Unity
2015-12-05 13:22 - 2014-04-01 19:00 - 00000000 ____D C:\Users\Denkov\AppData\Local\Skype
2015-12-05 13:22 - 2014-03-05 19:14 - 00000000 ____D C:\Program Files\Microsoft Office
2015-12-05 13:22 - 2014-02-19 14:27 - 00000000 ____D C:\Users\Denkov\AppData\Local\Microsoft Games
2015-12-05 13:22 - 2014-01-27 19:03 - 00000000 ____D C:\Users\Denkov\AppData\Local\Home Media Server
2015-12-05 13:22 - 2013-12-29 20:27 - 00000000 ____D C:\Users\Denkov\AppData\Local\Downloaded Installations
2015-12-05 13:22 - 2013-12-23 20:05 - 00000000 ____D C:\Users\Denkov\AppData\Local\CyberLink
2015-12-05 13:22 - 2013-12-23 16:40 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Mozilla
2015-12-05 13:22 - 2013-12-23 16:40 - 00000000 ____D C:\Users\Denkov\AppData\Local\Mozilla
2015-12-05 13:22 - 2013-12-22 23:27 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Adobe
2015-12-05 13:22 - 2013-12-22 23:22 - 00000000 ____D C:\Program Files\Realtek
2015-12-05 13:22 - 2013-12-22 23:10 - 00000000 ____D C:\Users\Denkov\AppData\Local\VirtualStore
2015-12-05 13:22 - 2013-12-22 18:44 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Wargaming.net
2015-12-05 13:21 - 2013-12-23 16:32 - 00000000 ____D C:\Program Files\BitComet
2015-12-05 13:14 - 2013-12-29 20:24 - 00000000 ____D C:\Users\Denkov\AppData\Local\ElevatedDiagnostics
2015-12-05 13:08 - 2013-12-22 23:22 - 00000000 ___HD C:\Program Files\Temp
2015-12-04 22:54 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2015-12-04 16:12 - 2015-06-01 08:21 - 00000000 ____D C:\Users\Denkov\AppData\Local\SystemDir
2015-12-04 11:59 - 2009-07-14 04:04 - 00000611 _____ C:\Windows\win.ini
2015-12-03 08:36 - 2014-11-29 17:16 - 00000000 ____D C:\Users\Denkov\AppData\Roaming\Sony
2015-11-30 13:42 - 2012-11-07 22:03 - 04358144 _____ (GSC Game World) C:\Windows\uncsetup.exe
2015-11-28 19:51 - 2013-12-24 13:16 - 00000000 ____D C:\Users\Denkov\AppData\Local\Adobe
2015-11-28 19:47 - 2014-02-11 22:41 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-11-28 19:47 - 2014-02-11 22:40 - 00000000 ____D C:\ProgramData\Adobe
2015-11-16 20:27 - 2013-12-28 12:34 - 00000000 ____D C:\ProgramData\Skype
2015-11-11 19:41 - 2009-07-14 09:50 - 00000000 ____D C:\Program Files\Windows Journal

==================== Files in the root of some directories =======

2014-03-06 21:42 - 2015-02-22 21:10 - 0087608 _____ () C:\Users\Denkov\AppData\Roaming\inst.exe
2014-03-06 21:42 - 2015-02-22 21:10 - 0007887 _____ () C:\Users\Denkov\AppData\Roaming\pcouffin.cat
2014-03-06 21:42 - 2015-02-22 21:10 - 0001144 _____ () C:\Users\Denkov\AppData\Roaming\pcouffin.inf
2014-03-06 21:43 - 2015-02-22 21:10 - 0000055 _____ () C:\Users\Denkov\AppData\Roaming\pcouffin.log
2014-03-06 21:42 - 2015-02-22 21:10 - 0047360 _____ (VSO Software) C:\Users\Denkov\AppData\Roaming\pcouffin.sys
2014-04-10 15:39 - 2014-11-11 11:29 - 0001189 _____ () C:\Users\Denkov\AppData\Roaming\vso_ts_preview.xml
2014-08-09 20:51 - 2015-06-10 20:51 - 0007601 _____ () C:\Users\Denkov\AppData\Local\Resmon.ResmonCfg
2014-12-23 14:29 - 2014-12-23 14:29 - 0000260 _____ () C:\Users\Denkov\AppData\Local\SocialModCfg.txt
2014-12-23 13:29 - 2014-12-23 13:42 - 0000676 _____ () C:\Users\Denkov\AppData\Local\TwitchModCfg.txt

Some files in TEMP:
====================
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe
C:\Users\Denkov\AppData\Local\Temp\9ea509a6-d73c-4178-b234-612fe4d30c53.exe
C:\Users\Denkov\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe
C:\Users\Denkov\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Denkov\AppData\Local\Temp\jre-8u66-windows-au.exe
C:\Users\Denkov\AppData\Local\Temp\mpam-fcd372fc.exe
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe
C:\Users\Denkov\AppData\Local\Temp\Uninstall.exe
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe
C:\Users\Denkov\AppData\Local\Temp\_is9B98.exe
C:\Users\Denkov\AppData\Local\Temp\_isBDA7.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-12-10 00:13

==================== End of FRST.txt ============================

Addition.txt

11 декември 201510 г.

Това не е желания от мен лог файл...публикували сте нови логове от FRST, а аз исках Fixlog.txt да публикувате след изпълнението на fixlist.txt скрипта от този коментар:

https://www.kaldata.com/forums/topic/248161-проблем-с-smartinfru/?do=findComment&comment=3250294

Поздрави!

11 декември 201510 г.

Автор

Fix result of Farbar Recovery Scan Tool (x86) Version:09-12-2015
Ran by Denkov (2015-12-11 11:52:47) Run:1
Running from C:\Users\Denkov\Desktop
Loaded Profiles: Denkov (Available Profiles: Denkov)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
Toolbar: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
S1 dcsjqwus; \??\C:\Windows\system32\drivers\dcsjqwus.sys [X]
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe
C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe
Task: {04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB} - System32\Tasks\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => pcalua.exe -a F:\setup.exe -d F:\
Task: {09D58292-1FAC-4147-8C5D-ACE658F57625} - System32\Tasks\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => pcalua.exe -a "C:\Program Files\European wars\RegSetup.exe" -d "C:\Program Files\European wars"
Task: {160DE17E-B431-4CFB-B4DA-700022CEC561} - System32\Tasks\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\Football Generation\Autorun.exe"
Task: {28190010-FF01-4BAD-9F6F-1D42743B7606} - System32\Tasks\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => pcalua.exe -a "C:\Program Files\Football Generation\setup.exe" -d "C:\Program Files\Football Generation\"
Task: {34BDACA9-17D0-4B7E-8CE5-14C09A655A94} - System32\Tasks\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => pcalua.exe -a "C:\Users\Denkov\AppData\Local\Temp\Temp3_Partition Magic 8.05 (kaldata.com).zip\RESCUEME\setup.exe"
Task: {3E115C30-9405-4069-82C3-C16C3E6B22B0} - System32\Tasks\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => pcalua.exe -a "C:\Program Files\THQ\Disney-Pixar\WALL-E\WALL-E\GameSetup.exe" -d "C:\Program Files\THQ\Disney-Pixar\WALL-E\WALL-E"
Task: {3ED37075-7235-48BC-87CB-CB792AC11265} - System32\Tasks\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => pcalua.exe -a "D:\nero 6\Nero 7\setup.exe" -d "D:\nero 6\Nero 7"
Task: {5CFBAD90-129E-4C24-B5D2-88D9084E3123} - System32\Tasks\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => pcalua.exe -a "E:\Биткомет\EuropeanWars\European wars.exe" -d E:\Биткомет\EuropeanWars
Task: {9EE089FC-4E87-45E1-A2A7-759045EC6453} - System32\Tasks\{A1C3ED44-A75C-4840-B56D-8750226416A1} => pcalua.exe -a "E:\Биткомет\Cossacks - The Art of War.exe" -d E:\Биткомет
Task: {AE6AC00C-80B3-402D-88BF-530A0B3AF998} - System32\Tasks\{523DE4AD-97A6-4159-8B44-537459343B41} => pcalua.exe -a "E:\Биткомет\Empire Earth Collection\Empire.Earth\Patches\ee_1000-1040_en.exe" -d "E:\Биткомет\Empire Earth Collection\Empire.Earth\Patches"
Task: {B411DC87-AC3E-4BA0-A302-F1D9FABB3C15} - System32\Tasks\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => pcalua.exe -a F:\autorun.exe -d F:\
Task: {C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7} - System32\Tasks\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => pcalua.exe -a "C:\Program Files\Black Sea Studios\Knights Of Honor\KoH.exe" -d "C:\Program Files\Black Sea Studios\Knights Of Honor\"
ShortcutWithArgument: C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk -> C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe () -> hxxp://gipide.ru/?utm_source=startlink03 <==== ATTENTION
ShortcutWithArgument: C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вoйти в Интeрнeт.lnk -> C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe () -> hxxp://gipide.ru/?utm_source=startlink03 <==== ATTENTION
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Denkov:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Temp:436DEE1E
AlternateDataStreams: C:\Users\Denkov\Application Data:gs5sys
AlternateDataStreams: C:\Users\Denkov\Cookies:gs5sys
AlternateDataStreams: C:\Users\Denkov\Local Settings:gs5sys
AlternateDataStreams: C:\Users\Denkov\Templates:gs5sys
AlternateDataStreams: C:\Users\Denkov\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local\Application Data:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local\History:gs5sys
AlternateDataStreams: C:\Users\Denkov\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
Hosts:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully.
"HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A06ED961-D98F-4CF9-A89B-80AB11DB149C}" => key removed successfully.
HKCR\CLSID\{A06ED961-D98F-4CF9-A89B-80AB11DB149C} => key not found.
"HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}" => key removed successfully.
HKCR\CLSID\{FFEBBF0A-C22C-4172-89FF-45215A135AC7} => key not found.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
dcsjqwus => service removed successfully.
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe => moved successfully
"C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe" => not found.
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB}" => key removed successfully.
C:\Windows\System32\Tasks\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{09D58292-1FAC-4147-8C5D-ACE658F57625}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{09D58292-1FAC-4147-8C5D-ACE658F57625}" => key removed successfully.
C:\Windows\System32\Tasks\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{160DE17E-B431-4CFB-B4DA-700022CEC561}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{160DE17E-B431-4CFB-B4DA-700022CEC561}" => key removed successfully.
C:\Windows\System32\Tasks\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{28190010-FF01-4BAD-9F6F-1D42743B7606}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28190010-FF01-4BAD-9F6F-1D42743B7606}" => key removed successfully.
C:\Windows\System32\Tasks\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{34BDACA9-17D0-4B7E-8CE5-14C09A655A94}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{34BDACA9-17D0-4B7E-8CE5-14C09A655A94}" => key removed successfully.
C:\Windows\System32\Tasks\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E115C30-9405-4069-82C3-C16C3E6B22B0}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E115C30-9405-4069-82C3-C16C3E6B22B0}" => key removed successfully.
C:\Windows\System32\Tasks\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{DBA82D88-1E74-4DB2-949B-1A214D094E45}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3ED37075-7235-48BC-87CB-CB792AC11265}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3ED37075-7235-48BC-87CB-CB792AC11265}" => key removed successfully.
C:\Windows\System32\Tasks\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5CFBAD90-129E-4C24-B5D2-88D9084E3123}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5CFBAD90-129E-4C24-B5D2-88D9084E3123}" => key removed successfully.
C:\Windows\System32\Tasks\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{308D2B9E-FD56-4145-A286-2774FCFA4D8D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9EE089FC-4E87-45E1-A2A7-759045EC6453}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9EE089FC-4E87-45E1-A2A7-759045EC6453}" => key removed successfully.
C:\Windows\System32\Tasks\{A1C3ED44-A75C-4840-B56D-8750226416A1} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A1C3ED44-A75C-4840-B56D-8750226416A1}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AE6AC00C-80B3-402D-88BF-530A0B3AF998}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE6AC00C-80B3-402D-88BF-530A0B3AF998}" => key removed successfully.
C:\Windows\System32\Tasks\{523DE4AD-97A6-4159-8B44-537459343B41} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{523DE4AD-97A6-4159-8B44-537459343B41}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B411DC87-AC3E-4BA0-A302-F1D9FABB3C15}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B411DC87-AC3E-4BA0-A302-F1D9FABB3C15}" => key removed successfully.
C:\Windows\System32\Tasks\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7}" => key removed successfully.
C:\Windows\System32\Tasks\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{855C4352-70CB-459B-B0B1-25B4338C0FE1}" => key removed successfully.
C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk => Shortcut argument removed successfully..
C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вoйти в Интeрнeт.lnk => not found.
C:\ProgramData => ":gs5sys" ADS removed successfully..
"C:\Users\All Users" => ":gs5sys" ADS not found.
C:\Users\Denkov => ":gs5sys" ADS removed successfully..
"C:\ProgramData\Application Data" => ":gs5sys" ADS not found.
C:\ProgramData\Temp => ":436DEE1E" ADS removed successfully..
"C:\Users\Denkov\Application Data" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Cookies" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Local Settings" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Templates" => ":gs5sys" ADS not found.
C:\Users\Denkov\Desktop\desktop.ini => ":gs5sys" ADS removed successfully..
C:\Users\Denkov\AppData\Local => ":gs5sys" ADS removed successfully..
C:\Users\Denkov\AppData\Roaming => ":gs5sys" ADS removed successfully..
"C:\Users\Denkov\AppData\Local\Application Data" => ":gs5sys" ADS not found.
"C:\Users\Denkov\AppData\Local\History" => ":gs5sys" ADS not found.
C:\Users\Denkov\Documents\desktop.ini => ":gs5sys" ADS removed successfully..
C:\Users\Public\Documents\desktop.ini => ":gs5sys" ADS removed successfully..

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.

========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 1.3 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 11:55:51 ====

11 декември 201510 г.

Благодаря.

Бихте ли могли да архивирате папката C:\FRST\Quarantine => и да качите архива на адрес => http://dox.abv.bg/files/share

След това ми пратете линк за изтегляне по лично съобщение и след това изтрийте архива. Папката да си стои, нея ще я изтрием по друг начин.

Да направим финални проверки:

СТЪПКА 1

Изтеглете и стартирайтe AdwCleaner.exe.
Натиснете бутона Scan.
AdwCleaner ще започне да проверява компютъра.
След като проверката приключи натиснете бутона Clean.
Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
Ще се появи автоматично лог файл с името (AdwCleaner[C0].txt) в C:\Adwcleaner
Публикувайте съдържанието му в следващия си коментар.

СТЪПКА 2

Моля изтеглете Junkware Removal Tool на вашия десктоп.

Спрете временно работата на защитните програми.
Стартирайте инструмента JRT.exe
Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 3

Моля изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи се уверете че сте сложили отметка пред:
Launch Malwarebytes Anti-Malware
Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

Натиснете бутона Finish.
Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
Ще започне проверка за зловреден софтуер.
При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи натиснете бутона Apply Actions.
Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
Отидете то табът History > Application Logs.

Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

СТЪПКА 4

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

СТЪПКА 5

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
Натиснете Next за да започне проверката.
Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

След това ако всичко е наред приключваме. Проверките са нужни, защото в новите логове от FRST видях нещо, което не ми харесва. Та дори да сме почистили системата нека да проверим и за остатъци.

Поздрави!

11 декември 201510 г.

Автор

# AdwCleaner v5.024 - Logfile created 11/12/2015 at 14:55:26
# Updated 07/12/2015 by Xplode
# Database : 2015-12-07.3 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x86)
# Username : Denkov - DENKOV-PC
# Running from : C:\Users\Denkov\Desktop\adwcleaner_5.024.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Users\Denkov\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\alkmmdfckfjdajamefgcfpckbjmfmooi
[-] Folder Deleted : C:\Users\Denkov\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\embjnckjmnhokebgblbeneepniamlkph
[-] Folder Deleted : C:\Users\Denkov\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\ipcgdihgpboihlafglciahchhjpflald
[-] Folder Deleted : C:\Users\Denkov\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\plbhdjfpjhdjgnbmikekbifmjoenklhj

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\TornTvDownloader.File
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D95A89C-A2F2-4E3C-9458-64ACA196C980}
[!] Key Not Deleted : HKLM\SOFTWARE\Classes\Interface\{8D95A89C-A2F2-4E3C-9458-64ACA196C980}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E54ED555-AD7A-4A1C-89E9-6EBC2C03433A}
[!] Key Not Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E54ED555-AD7A-4A1C-89E9-6EBC2C03433A}
[-] Key Deleted : HKCU\Software\WEBAPP
[-] Key Deleted : HKCU\Software\AppDataLow\Software\adawarebp
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\AskToolbar
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\TheTorntv V10
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\_CrossriderRegNamePlaceHolder_
[-] Key Deleted : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\TheTorntv V10
[-] Key Deleted : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\_CrossriderRegNamePlaceHolder_
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}

***** [ Web browsers ] *****

[-] [C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.bing.com/?pc=COSP&ptag=D120415-A60FA26CFB78147A880F&form=CONMHP&conlogo=CT3332038");
[-] [C:\Users\Denkov\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [3097 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 7 Ultimate x86
Ran by Denkov (Administrator) on ЇҐв 11.12.2015 Ј. at 15:10:30,12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 3

Successfully deleted: C:\Users\Denkov\AppData\Local\systemdir (Folder)
Successfully deleted: C:\Users\Denkov\AppData\Roaming\nico mak computing (Folder)
Successfully deleted: C:\Windows\wininit.ini (File)

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ЇҐв 11.12.2015 Ј. at 15:12:59,14
End of JRT log

11 декември 201510 г.

Автор



	HitmanPro 3.7.10.251

	www.hitmanpro.com

   Computer name . . . . : DENKOV-PC
   Windows . . . . . . . : 6.1.1.7601.X86/4
   User name . . . . . . : Denkov-PC\Denkov
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2015-12-11 16:06:25
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 36s
   Disk access mode . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot . . . . . . . : No

Threats . . . . . . . : 0
Traces . . . . . . . : 46

   Objects scanned . . . : 1 537 338
   Files scanned . . . . : 28 830
   Remnants scanned . . : 230 623 files / 1 277 885 keys

Miniport ____________________________________________________________________

   Primary
      DriverObject . . . : 86726640
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo . . . . . : 00000000 +0
      IRP_MJ_SCSI . . . : 866AF1E8 +0
   Solution
      DriverObject . . . : 86726640
      DriverName . . . . : \Driver\atapi
      DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
      StartIo . . . . . : 00000000 +0
      IRP_MJ_SCSI . . . : 8B6E844E \SystemRoot\system32\drivers\ataport.SYS+25678

Suspicious files ____________________________________________________________

   C:\Users\Denkov\Desktop\FRST.exe
      Size . . . . . . . : 1 720 320 bytes
      Age . . . . . . . : 0.2 days (2015-12-11 10:43:30)
      Entropy . . . . . : 7.5
      SHA-256 . . . . . : B1E92BC3FC04C3D5009C2C38F5997872096364F07E74ACA9323E5115744C155F
      Needs elevation . : Yes
      Fuzzy . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
         -11.0s C:\Windows\Prefetch\FRST.EXE-2E426072.pf
         -10.1s C:\Windows\Prefetch\MPSIGSTUB.EXE-5E95E876.pf
         -10.0s C:\Windows\Prefetch\NIS_DELTA_PATCH.EXE-8D924A02.pf
         -8.5s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA69A1E3-FE21-45F0-9D9E-BA656CC5C0E3}\mpasdlta.vdm
         -6.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA69A1E3-FE21-45F0-9D9E-BA656CC5C0E3}\mpavdlta.vdm
         -6.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{50DC73F9-C315-45A9-87FE-696CAD13E3AC}\nisfull.vdm
         -5.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA69A1E3-FE21-45F0-9D9E-BA656CC5C0E3}\
         -5.9s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA69A1E3-FE21-45F0-9D9E-BA656CC5C0E3}\mpengine.dll
         -5.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin
          0.0s C:\Users\Denkov\Desktop\FRST.exe
          0.1s C:\Windows\Prefetch\AM_DELTA_PATCH_1.211.2215.0.E-60084486.pf
          9.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.67
         15.9s C:\Windows\Prefetch\FRST.EXE-787BDA6D.pf
         39.7s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.79
         60.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.7C
         63.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.7E
         63.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.80
         64.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.87
         65.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.A0
         65.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.83
         66.0s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.CB
         66.3s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.CC
         66.4s C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-AEA4E6D7005B17A8F50A66647E0663CBE4C70D01.bin.5B
         70.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{50DC73F9-C315-45A9-87FE-696CAD13E3AC}\
         70.6s C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{50DC73F9-C315-45A9-87FE-696CAD13E3AC}\gapaengine.dll
         79.4s C:\Windows\Prefetch\BCDEDIT.EXE-10FC5AAB.pf
         87.4s C:\Windows\Prefetch\DLLHOST.EXE-B2EB1806.pf

   E:\New folder\Home Media Server\hms.exe
      Size . . . . . . . : 14 772 224 bytes
      Age . . . . . . . : 682.9 days (2014-01-27 19:02:57)
      Entropy . . . . . : 6.7
      SHA-256 . . . . . : 5C0BEA6752896F77309CFBB891F6710E7BF0B6ECC6C27BA10B965A0E7F36856B
      Product . . . . . : Домашний медиа сервер (UPnP, DLNA, HTTP)
      Publisher . . . . : Evgeny Lachinov
      Description . . . : Домашний медиа сервер (UPnP, DLNA, HTTP)
      Version . . . . . : 1.47.0.0
      Parent Name . . . : C:\Windows\Explorer.EXE
      LanguageID . . . . : 1049
      Running processes : 3684
      Fuzzy . . . . . . : 23.0
         The file is completely hidden from view and most antivirus products. It may belong to a rootkit.
         This program is actively listening for inbound network connections.
         Program is running but currently exposes no human-computer interface (GUI).
         Uses the Windows Registry to run each time the user logs on.
         Program starts automatically without user intervention.
         The file is in use by one or more active processes.
         The file appears to be part of an installation package or setup program. This is typical for most programs.
      Startup
         HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Software\Microsoft\Windows\CurrentVersion\Run\><0H=89
         HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Домашний медиа-сервер (UPnP, DLNA, HTTP)
      References
         C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Home Media Server\Домашний медиа-сервер (UPnP, DLNA, HTTP).lnk
         C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\hms - Shortcut.lnk
      Network Ports
         192.168.0.100:45397

Potential Unwanted Programs _________________________________________________

   HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)
   HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622\ (Linkey)
   HKLM\SYSTEM\ControlSet001\services\eventlog\Application\Torntv\ (TornPlusTV)
   HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622\ (Linkey)
   HKLM\SYSTEM\ControlSet002\services\eventlog\Application\Torntv\ (TornPlusTV)
   HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622\ (Linkey)
   HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\Torntv\ (TornPlusTV)
   HKU\S-1-5-21-2946740568-875237454-2921467692-1000_Classes\TornTvDownloader.File\ (TornPlusTV)

Cookies _____________________________________________________________________

   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:ad.360yield.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:adaptv.advertising.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:adfarm1.adition.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:adnxs.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:ads.kaldata.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:ads.stickyadstv.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:adscale.de
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:adsrvr.org
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:adtech.de
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:advertising.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:bidswitch.net
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:casalemedia.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:contextweb.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:doubleclick.net
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:eyeviewads.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:gwallet.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:ih.adscale.de
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:lijit.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:liverail.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:mathtag.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:nexac.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:openx.net
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:pixel.rubiconproject.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:pubmatic.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:rfihub.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:rubiconproject.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:sitescout.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:smartadserver.com
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:sxp.smartclip.net
   C:\Users\Denkov\AppData\Roaming\Mozilla\Firefox\Profiles\ucitgfld.default-1444552654466\cookies.sqlite:turn.com

11 декември 201510 г.

Автор

Emsisoft Emergency Kit - Version 10.0
Last update: 11.12.2015 г. 16:25:05
User account: Denkov-PC\Denkov

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:   11.12.2015 г. 16:35:19
C:\Program Files\LucasArts\LEGO Star Wars III The Clone Wars\paul.dll    detected: Packed.Win32.VMProtect (A)
C:\Program Files\Psyonix\Rocket League Chaos Run\Binaries\Win32\steam_api.dll    detected: Gen:Variant.Symmi.57528 (B)

Scanned 206974
Found 2

Scan end: 11.12.2015 г. 17:15:03
Scan time: 0:39:44

C:\Program Files\Psyonix\Rocket League Chaos Run\Binaries\Win32\steam_api.dll Quarantined Gen:Variant.Symmi.57528 (B)
C:\Program Files\LucasArts\LEGO Star Wars III The Clone Wars\paul.dll Quarantined Packed.Win32.VMProtect (A)

Quarantined 2

11 декември 201510 г.

Автор

с.txt

11 декември 201510 г.

Намерените неща от Emsisoft са краковете ви за игри. Можете да ги възстановите от карантината:

Отворете програмата, отидете до табът Quarantine => посочете файловете един по един и натиснете бутона Restore:

За да почистим финалните боклуци намерени от HitmanPro направете следното и приключваме.

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Поздрави!

11 декември 201510 г.

Автор

Здравей,мисля че обърках нещо . На десктопа виждам само fixlog.txt файла от одеве -създаден 11:55ч. не от сега 20:30ч. /приблизително/.Това е той:

Fix result of Farbar Recovery Scan Tool (x86) Version:09-12-2015
Ran by Denkov (2015-12-11 11:52:47) Run:1
Running from C:\Users\Denkov\Desktop
Loaded Profiles: Denkov (Available Profiles: Denkov)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
Toolbar: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
S1 dcsjqwus; \??\C:\Windows\system32\drivers\dcsjqwus.sys [X]
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe
C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe
Task: {04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB} - System32\Tasks\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => pcalua.exe -a F:\setup.exe -d F:\
Task: {09D58292-1FAC-4147-8C5D-ACE658F57625} - System32\Tasks\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => pcalua.exe -a "C:\Program Files\European wars\RegSetup.exe" -d "C:\Program Files\European wars"
Task: {160DE17E-B431-4CFB-B4DA-700022CEC561} - System32\Tasks\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\Football Generation\Autorun.exe"
Task: {28190010-FF01-4BAD-9F6F-1D42743B7606} - System32\Tasks\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => pcalua.exe -a "C:\Program Files\Football Generation\setup.exe" -d "C:\Program Files\Football Generation\"
Task: {34BDACA9-17D0-4B7E-8CE5-14C09A655A94} - System32\Tasks\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => pcalua.exe -a "C:\Users\Denkov\AppData\Local\Temp\Temp3_Partition Magic 8.05 (kaldata.com).zip\RESCUEME\setup.exe"
Task: {3E115C30-9405-4069-82C3-C16C3E6B22B0} - System32\Tasks\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => pcalua.exe -a "C:\Program Files\THQ\Disney-Pixar\WALL-E\WALL-E\GameSetup.exe" -d "C:\Program Files\THQ\Disney-Pixar\WALL-E\WALL-E"
Task: {3ED37075-7235-48BC-87CB-CB792AC11265} - System32\Tasks\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => pcalua.exe -a "D:\nero 6\Nero 7\setup.exe" -d "D:\nero 6\Nero 7"
Task: {5CFBAD90-129E-4C24-B5D2-88D9084E3123} - System32\Tasks\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => pcalua.exe -a "E:\Биткомет\EuropeanWars\European wars.exe" -d E:\Биткомет\EuropeanWars
Task: {9EE089FC-4E87-45E1-A2A7-759045EC6453} - System32\Tasks\{A1C3ED44-A75C-4840-B56D-8750226416A1} => pcalua.exe -a "E:\Биткомет\Cossacks - The Art of War.exe" -d E:\Биткомет
Task: {AE6AC00C-80B3-402D-88BF-530A0B3AF998} - System32\Tasks\{523DE4AD-97A6-4159-8B44-537459343B41} => pcalua.exe -a "E:\Биткомет\Empire Earth Collection\Empire.Earth\Patches\ee_1000-1040_en.exe" -d "E:\Биткомет\Empire Earth Collection\Empire.Earth\Patches"
Task: {B411DC87-AC3E-4BA0-A302-F1D9FABB3C15} - System32\Tasks\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => pcalua.exe -a F:\autorun.exe -d F:\
Task: {C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7} - System32\Tasks\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => pcalua.exe -a "C:\Program Files\Black Sea Studios\Knights Of Honor\KoH.exe" -d "C:\Program Files\Black Sea Studios\Knights Of Honor\"
ShortcutWithArgument: C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk -> C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe () -> hxxp://gipide.ru/?utm_source=startlink03 <==== ATTENTION
ShortcutWithArgument: C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вoйти в Интeрнeт.lnk -> C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe () -> hxxp://gipide.ru/?utm_source=startlink03 <==== ATTENTION
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Denkov:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Temp:436DEE1E
AlternateDataStreams: C:\Users\Denkov\Application Data:gs5sys
AlternateDataStreams: C:\Users\Denkov\Cookies:gs5sys
AlternateDataStreams: C:\Users\Denkov\Local Settings:gs5sys
AlternateDataStreams: C:\Users\Denkov\Templates:gs5sys
AlternateDataStreams: C:\Users\Denkov\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local\Application Data:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local\History:gs5sys
AlternateDataStreams: C:\Users\Denkov\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
Hosts:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully.
"HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A06ED961-D98F-4CF9-A89B-80AB11DB149C}" => key removed successfully.
HKCR\CLSID\{A06ED961-D98F-4CF9-A89B-80AB11DB149C} => key not found.
"HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}" => key removed successfully.
HKCR\CLSID\{FFEBBF0A-C22C-4172-89FF-45215A135AC7} => key not found.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value removed successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
dcsjqwus => service removed successfully.
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe => moved successfully
"C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe" => not found.
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe => moved successfully
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB}" => key removed successfully.
C:\Windows\System32\Tasks\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{09D58292-1FAC-4147-8C5D-ACE658F57625}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{09D58292-1FAC-4147-8C5D-ACE658F57625}" => key removed successfully.
C:\Windows\System32\Tasks\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{160DE17E-B431-4CFB-B4DA-700022CEC561}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{160DE17E-B431-4CFB-B4DA-700022CEC561}" => key removed successfully.
C:\Windows\System32\Tasks\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{28190010-FF01-4BAD-9F6F-1D42743B7606}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28190010-FF01-4BAD-9F6F-1D42743B7606}" => key removed successfully.
C:\Windows\System32\Tasks\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{34BDACA9-17D0-4B7E-8CE5-14C09A655A94}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{34BDACA9-17D0-4B7E-8CE5-14C09A655A94}" => key removed successfully.
C:\Windows\System32\Tasks\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3E115C30-9405-4069-82C3-C16C3E6B22B0}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E115C30-9405-4069-82C3-C16C3E6B22B0}" => key removed successfully.
C:\Windows\System32\Tasks\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{DBA82D88-1E74-4DB2-949B-1A214D094E45}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3ED37075-7235-48BC-87CB-CB792AC11265}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3ED37075-7235-48BC-87CB-CB792AC11265}" => key removed successfully.
C:\Windows\System32\Tasks\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5CFBAD90-129E-4C24-B5D2-88D9084E3123}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5CFBAD90-129E-4C24-B5D2-88D9084E3123}" => key removed successfully.
C:\Windows\System32\Tasks\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{308D2B9E-FD56-4145-A286-2774FCFA4D8D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9EE089FC-4E87-45E1-A2A7-759045EC6453}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9EE089FC-4E87-45E1-A2A7-759045EC6453}" => key removed successfully.
C:\Windows\System32\Tasks\{A1C3ED44-A75C-4840-B56D-8750226416A1} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A1C3ED44-A75C-4840-B56D-8750226416A1}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AE6AC00C-80B3-402D-88BF-530A0B3AF998}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE6AC00C-80B3-402D-88BF-530A0B3AF998}" => key removed successfully.
C:\Windows\System32\Tasks\{523DE4AD-97A6-4159-8B44-537459343B41} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{523DE4AD-97A6-4159-8B44-537459343B41}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B411DC87-AC3E-4BA0-A302-F1D9FABB3C15}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B411DC87-AC3E-4BA0-A302-F1D9FABB3C15}" => key removed successfully.
C:\Windows\System32\Tasks\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7}" => key removed successfully.
C:\Windows\System32\Tasks\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{855C4352-70CB-459B-B0B1-25B4338C0FE1}" => key removed successfully.
C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk => Shortcut argument removed successfully..
C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вoйти в Интeрнeт.lnk => not found.
C:\ProgramData => ":gs5sys" ADS removed successfully..
"C:\Users\All Users" => ":gs5sys" ADS not found.
C:\Users\Denkov => ":gs5sys" ADS removed successfully..
"C:\ProgramData\Application Data" => ":gs5sys" ADS not found.
C:\ProgramData\Temp => ":436DEE1E" ADS removed successfully..
"C:\Users\Denkov\Application Data" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Cookies" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Local Settings" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Templates" => ":gs5sys" ADS not found.
C:\Users\Denkov\Desktop\desktop.ini => ":gs5sys" ADS removed successfully..
C:\Users\Denkov\AppData\Local => ":gs5sys" ADS removed successfully..
C:\Users\Denkov\AppData\Roaming => ":gs5sys" ADS removed successfully..
"C:\Users\Denkov\AppData\Local\Application Data" => ":gs5sys" ADS not found.
"C:\Users\Denkov\AppData\Local\History" => ":gs5sys" ADS not found.
C:\Users\Denkov\Documents\desktop.ini => ":gs5sys" ADS removed successfully..
C:\Users\Public\Documents\desktop.ini => ":gs5sys" ADS removed successfully..

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.

========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 1.3 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 11:55:51 ====

не знам какво сбърах.

11 декември 201510 г.

Автор

Съжалявам, намерих го.Не беше на десктопа.

Fix result of Farbar Recovery Scan Tool (x86) Version:09-12-2015
Ran by Denkov (2015-12-11 20:18:26) Run:2
Running from E:\Mozilla Downloads
Loaded Profiles: Denkov (Available Profiles: Denkov)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
Toolbar: HKU\S-1-5-21-2946740568-875237454-2921467692-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
S1 dcsjqwus; \??\C:\Windows\system32\drivers\dcsjqwus.sys [X]
C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe
C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe
C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe
C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe
C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe
C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe
C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe
C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe
C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe
Task: {04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB} - System32\Tasks\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => pcalua.exe -a F:\setup.exe -d F:\
Task: {09D58292-1FAC-4147-8C5D-ACE658F57625} - System32\Tasks\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => pcalua.exe -a "C:\Program Files\European wars\RegSetup.exe" -d "C:\Program Files\European wars"
Task: {160DE17E-B431-4CFB-B4DA-700022CEC561} - System32\Tasks\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\Football Generation\Autorun.exe"
Task: {28190010-FF01-4BAD-9F6F-1D42743B7606} - System32\Tasks\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => pcalua.exe -a "C:\Program Files\Football Generation\setup.exe" -d "C:\Program Files\Football Generation\"
Task: {34BDACA9-17D0-4B7E-8CE5-14C09A655A94} - System32\Tasks\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => pcalua.exe -a "C:\Users\Denkov\AppData\Local\Temp\Temp3_Partition Magic 8.05 (kaldata.com).zip\RESCUEME\setup.exe"
Task: {3E115C30-9405-4069-82C3-C16C3E6B22B0} - System32\Tasks\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => pcalua.exe -a "C:\Program Files\THQ\Disney-Pixar\WALL-E\WALL-E\GameSetup.exe" -d "C:\Program Files\THQ\Disney-Pixar\WALL-E\WALL-E"
Task: {3ED37075-7235-48BC-87CB-CB792AC11265} - System32\Tasks\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => pcalua.exe -a "D:\nero 6\Nero 7\setup.exe" -d "D:\nero 6\Nero 7"
Task: {5CFBAD90-129E-4C24-B5D2-88D9084E3123} - System32\Tasks\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => pcalua.exe -a "E:\Биткомет\EuropeanWars\European wars.exe" -d E:\Биткомет\EuropeanWars
Task: {9EE089FC-4E87-45E1-A2A7-759045EC6453} - System32\Tasks\{A1C3ED44-A75C-4840-B56D-8750226416A1} => pcalua.exe -a "E:\Биткомет\Cossacks - The Art of War.exe" -d E:\Биткомет
Task: {AE6AC00C-80B3-402D-88BF-530A0B3AF998} - System32\Tasks\{523DE4AD-97A6-4159-8B44-537459343B41} => pcalua.exe -a "E:\Биткомет\Empire Earth Collection\Empire.Earth\Patches\ee_1000-1040_en.exe" -d "E:\Биткомет\Empire Earth Collection\Empire.Earth\Patches"
Task: {B411DC87-AC3E-4BA0-A302-F1D9FABB3C15} - System32\Tasks\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => pcalua.exe -a F:\autorun.exe -d F:\
Task: {C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7} - System32\Tasks\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => pcalua.exe -a "C:\Program Files\Black Sea Studios\Knights Of Honor\KoH.exe" -d "C:\Program Files\Black Sea Studios\Knights Of Honor\"
ShortcutWithArgument: C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk -> C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe () -> hxxp://gipide.ru/?utm_source=startlink03 <==== ATTENTION
ShortcutWithArgument: C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вoйти в Интeрнeт.lnk -> C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.exe () -> hxxp://gipide.ru/?utm_source=startlink03 <==== ATTENTION
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Denkov:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Temp:436DEE1E
AlternateDataStreams: C:\Users\Denkov\Application Data:gs5sys
AlternateDataStreams: C:\Users\Denkov\Cookies:gs5sys
AlternateDataStreams: C:\Users\Denkov\Local Settings:gs5sys
AlternateDataStreams: C:\Users\Denkov\Templates:gs5sys
AlternateDataStreams: C:\Users\Denkov\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local\Application Data:gs5sys
AlternateDataStreams: C:\Users\Denkov\AppData\Local\History:gs5sys
AlternateDataStreams: C:\Users\Denkov\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
Hosts:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
"C:\Windows\system32\GroupPolicy\Machine" => not found.
HKLM\SOFTWARE\Policies\Google => key not found.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A06ED961-D98F-4CF9-A89B-80AB11DB149C} => key not found.
HKCR\CLSID\{A06ED961-D98F-4CF9-A89B-80AB11DB149C} => key not found.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7} => key not found.
HKCR\CLSID\{FFEBBF0A-C22C-4172-89FF-45215A135AC7} => key not found.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value not found.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => key not found.
dcsjqwus => service not found.
"C:\Users\Denkov\AppData\Local\Temp\2mtIympSjcZE.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\3lHvNJdlxhWr.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\93hxUD0R69TU.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\EtDFEVNTo1ZF.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\jEZ6CEma4RYX.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\PQrJdvXPiCRC.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\tFH5kBTvs7yT.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\tYClcUVNazLu.exe" => not found.
"C:\Users\Denkov\AppData\Local\Temp\xxNXAB9oNRy7.exe" => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04AE7B8C-DC77-46C6-AD7C-ECD74F6516EB} => key not found.
C:\Windows\System32\Tasks\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C56B848E-7CC6-4A01-B124-CF436E1A6CEC} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{09D58292-1FAC-4147-8C5D-ACE658F57625} => key not found.
C:\Windows\System32\Tasks\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B4656E81-B7E0-41A9-AFB6-F1260AC2F020} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{160DE17E-B431-4CFB-B4DA-700022CEC561} => key not found.
C:\Windows\System32\Tasks\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5DF0AD89-D18B-40ED-8DB1-23BA8BD5B3D3} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28190010-FF01-4BAD-9F6F-1D42743B7606} => key not found.
C:\Windows\System32\Tasks\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{875AFA3F-0D7C-4D37-BC2D-8FCF1AB919B0} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{34BDACA9-17D0-4B7E-8CE5-14C09A655A94} => key not found.
C:\Windows\System32\Tasks\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6B2905D8-D033-41B6-96C5-2B9CF9431F3B} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E115C30-9405-4069-82C3-C16C3E6B22B0} => key not found.
C:\Windows\System32\Tasks\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{DBA82D88-1E74-4DB2-949B-1A214D094E45} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3ED37075-7235-48BC-87CB-CB792AC11265} => key not found.
C:\Windows\System32\Tasks\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B32B5DCB-B9AB-47D7-BBEF-1BB04C265D73} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5CFBAD90-129E-4C24-B5D2-88D9084E3123} => key not found.
C:\Windows\System32\Tasks\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{308D2B9E-FD56-4145-A286-2774FCFA4D8D} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9EE089FC-4E87-45E1-A2A7-759045EC6453} => key not found.
C:\Windows\System32\Tasks\{A1C3ED44-A75C-4840-B56D-8750226416A1} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A1C3ED44-A75C-4840-B56D-8750226416A1} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE6AC00C-80B3-402D-88BF-530A0B3AF998} => key not found.
C:\Windows\System32\Tasks\{523DE4AD-97A6-4159-8B44-537459343B41} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{523DE4AD-97A6-4159-8B44-537459343B41} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B411DC87-AC3E-4BA0-A302-F1D9FABB3C15} => key not found.
C:\Windows\System32\Tasks\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8EE7ADC8-12A6-44F2-88AC-C6F8CEACF036} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2F15CC9-4C00-43D3-B493-5DAE62CD2CD7} => key not found.
C:\Windows\System32\Tasks\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{855C4352-70CB-459B-B0B1-25B4338C0FE1} => key not found.
C:\Users\Denkov\AppData\Local\Microsoft\Start Menu\Вoйти в Интeрнeт.lnk => Shortcut argument removed successfully..
C:\Users\Denkov\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вoйти в Интeрнeт.lnk => not found.
"C:\ProgramData" => ":gs5sys" ADS not found.
"C:\Users\All Users" => ":gs5sys" ADS not found.
"C:\Users\Denkov" => ":gs5sys" ADS not found.
"C:\ProgramData\Application Data" => ":gs5sys" ADS not found.
"C:\ProgramData\Temp" => ":436DEE1E" ADS not found.
"C:\Users\Denkov\Application Data" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Cookies" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Local Settings" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Templates" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Desktop\desktop.ini" => ":gs5sys" ADS not found.
"C:\Users\Denkov\AppData\Local" => ":gs5sys" ADS not found.
"C:\Users\Denkov\AppData\Roaming" => ":gs5sys" ADS not found.
"C:\Users\Denkov\AppData\Local\Application Data" => ":gs5sys" ADS not found.
"C:\Users\Denkov\AppData\Local\History" => ":gs5sys" ADS not found.
"C:\Users\Denkov\Documents\desktop.ini" => ":gs5sys" ADS not found.
"C:\Users\Public\Documents\desktop.ini" => ":gs5sys" ADS not found.

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.

========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 765.2 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 20:19:23 ====

11 декември 201510 г.

Не са тези...трябва да има нов след изпълнението на скрипта от предишния ми коментар...изтеглете новия fixlist.txt и действайте и ще се създаде нов fixlog.txt.

Поздрави!

12 декември 201510 г.

Автор

Здравейте.Ако не е това не знам вече.

Fix result of Farbar Recovery Scan Tool (x86) Version:09-12-2015
Ran by Denkov (2015-12-12 09:56:45) Run:3
Running from C:\Users\Denkov\Desktop
Loaded Profiles: Denkov (Available Profiles: Denkov)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622
DeleteKey: HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\Torntv
DeleteKey: HKU\S-1-5-21-2946740568-875237454-2921467692-1000_Classes\TornTvDownloader.File
end
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} => key removed successfully.
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622 => could not remove at first attempt (ErrorCode: C0000121), see next line.
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_F06DEFF2-5B9C-490D-910F-35D3A9119622 => key removed successfully.
HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\Torntv => key removed successfully.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000_Classes\TornTvDownloader.File => could not remove at first attempt (ErrorCode: C0000121), see next line.
HKU\S-1-5-21-2946740568-875237454-2921467692-1000_Classes\TornTvDownloader.File => key removed successfully.

==== End of Fixlog 09:56:46 ====

12 декември 201510 г.

Това е.

Готови сме. Вижте финалните ми инструкции тук.

Поздрави и приятни почивни дни!

12 декември 201510 г.

Автор

Големи благодарности.Приятни почивни дни и на теб!

P.S.сега ще си имам работа за цяла вечер.

12 декември 201510 г.

Автор

Между другото Start Emsisoft Emergency Kit не се изтри

12 декември 201510 г.

То се изтрива самата папка C:\EEK, другото е само препратка към инструмента. Може в момента процесите му да са били отворени и затова. Рестартирайте и трябва да се изтрие, ако ли не влезте в Safe Mode и го изтрийте оттам.

Добре дошли!

Проблем с smartinf.ru

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)