Как да премахна рекламен зловреден софтуер?

25 декември 201510 г.

Как да премахна зловреден софтуер

25 декември 201510 г.

Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:25-12-2015
Ran by Toni (administrator) on TONI-PC (25-12-2015 14:43:06)
Running from D:\dowloads
Loaded Profiles: Toni (Available Profiles: Toni)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(BitTorrent Inc.) C:\Users\Toni\AppData\Roaming\uTorrent\uTorrent.exe
(Spotify Ltd) C:\Users\Toni\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(BitTorrent Inc.) C:\Users\Toni\AppData\Roaming\uTorrent\updates\3.4.5_41372\utorrentie.exe
(BitTorrent Inc.) C:\Users\Toni\AppData\Roaming\uTorrent\updates\3.4.5_41372\utorrentie.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\setup\instup.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7004376 2015-11-28] (AVAST Software)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKU\S-1-5-21-1245008870-2349687684-1380508342-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1245008870-2349687684-1380508342-1000\...\Run: [uTorrent] => C:\Users\Toni\AppData\Roaming\uTorrent\uTorrent.exe [2026520 2015-12-05] (BitTorrent Inc.)
HKU\S-1-5-21-1245008870-2349687684-1380508342-1000\...\Run: [Spotify Web Helper] => C:\Users\Toni\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2346096 2015-12-21] (Spotify Ltd)
HKU\S-1-5-21-1245008870-2349687684-1380508342-1000\...\Run: [Spotify] => C:\Users\Toni\AppData\Roaming\Spotify\Spotify.exe [8387696 2015-12-21] (Spotify Ltd)
HKU\S-1-5-21-1245008870-2349687684-1380508342-1000\...\MountPoints2: {70e0be1a-e692-11e4-87ce-bc5ff4850c03} - F:\setup.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-11-28] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 185.82.216.244 8.8.8.8
Tcpip\..\Interfaces\{1300AF3A-A141-409B-B572-FD2A99CD5D65}: [DhcpNameServer] 185.82.216.244 8.8.8.8

Internet Explorer:
==================
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-11-28] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-28] (AVAST Software)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\7d29xaqh.default
FF Homepage: hxxp://google.bg/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-08] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-08] ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-05-20] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-05-20] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Extension: Bronze Aid - C:\Users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\7d29xaqh.default\Extensions\{a5adbf96-6c85-4c15-8d79-21aa419d172c}.xpi [2015-12-24] [not signed]
FF Extension: Adblock Plus - C:\Users\Toni\AppData\Roaming\Mozilla\Firefox\Profiles\7d29xaqh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-15]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-11-28]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2015-11-28]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR Profile: C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-07]
CHR Extension: (Avast Online Security) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-07]
CHR Extension: (Google Wallet) - C:\Users\Toni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-07]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-11-28]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-11-28]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [174416 2015-11-28] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [5554152 2015-11-28] (Avast Software)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 61883; C:\Windows\System32\DRIVERS\61883.sys [60288 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-11-28] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-11-28] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-11-28] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-11-28] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1059656 2015-11-28] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449992 2015-11-28] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [154256 2015-11-28] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-11-28] (AVAST Software)
S3 BazisPortableCDBus; C:\Windows\System32\drivers\BazisPortableCDBus.sys [268896 2015-04-19] (SysProgs.org)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 ngvss; C:\Windows\System32\Drivers\ngvss.sys [147088 2015-11-28] (AVAST Software)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [310904 2015-11-28] (Avast Software)
R3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-25 14:42 - 2015-12-25 14:43 - 00000000 ____D C:\FRST
2015-12-25 14:24 - 2015-12-25 14:24 - 00000563 _____ C:\Users\Toni\Desktop\JRT.txt
2015-12-25 14:13 - 2015-12-25 14:13 - 00004548 _____ C:\Windows\system32\.crusader
2015-12-25 13:36 - 2015-12-25 13:52 - 00000080 _____ C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\чTorrent.lnk
2015-12-25 13:07 - 2015-12-25 13:07 - 00000000 ____D C:\Users\Toni\AppData\Local\Flvto
2015-12-23 13:33 - 2015-12-25 12:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-22 14:57 - 2015-12-22 14:57 - 00000000 ____D C:\Users\Toni\AppData\Roaming\dvdcss
2015-12-21 17:51 - 2015-12-25 14:26 - 00000000 ____D C:\Users\Toni\AppData\Roaming\Spotify
2015-12-21 17:51 - 2015-12-25 14:26 - 00000000 ____D C:\Users\Toni\AppData\Local\Spotify
2015-12-21 17:51 - 2015-12-25 13:53 - 00001768 _____ C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2015-12-21 17:51 - 2015-12-25 13:52 - 00001762 _____ C:\Users\Toni\Desktop\Spotify.lnk
2015-12-21 17:51 - 2015-12-21 17:51 - 00000000 ____D C:\Users\Toni\AppData\Local\CEF
2015-12-18 15:52 - 2015-12-18 16:23 - 00000000 ____D C:\Users\Toni\Desktop\New folder
2015-12-18 11:52 - 2015-12-25 14:26 - 00000000 ____D C:\Users\Toni\AppData\LocalLow\uTorrent
2015-12-14 01:44 - 2015-12-14 01:44 - 00000000 ___RD C:\Users\Toni\Documents\Scanned Documents
2015-12-14 01:44 - 2015-12-14 01:44 - 00000000 ____D C:\Users\Toni\Documents\Fax
2015-12-05 12:24 - 2015-12-05 12:24 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2015-12-05 12:24 - 2015-12-05 12:24 - 00000000 ____D C:\Program Files\Common Files\AV
2015-11-28 16:22 - 2015-11-28 16:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-11-28 16:22 - 2015-11-28 16:22 - 00000000 ____D C:\ProgramData\Apple Computer
2015-11-28 16:22 - 2015-11-28 16:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2015-11-28 16:02 - 2015-11-28 16:02 - 00386096 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-11-28 16:02 - 2015-11-28 16:02 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-25 14:43 - 2014-10-22 21:21 - 00000000 ____D C:\Users\Toni\AppData\Roaming\uTorrent
2015-12-25 14:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows
2015-12-25 14:34 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-25 14:34 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-25 14:31 - 2009-07-14 07:13 - 00778150 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-25 14:31 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2015-12-25 14:25 - 2014-11-03 21:15 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-25 14:25 - 2014-10-22 17:33 - 00000000 ____D C:\ProgramData\NVIDIA
2015-12-25 14:25 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-25 14:23 - 2014-10-22 19:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-25 14:22 - 2014-11-03 21:15 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-25 14:15 - 2014-11-03 21:15 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-12-25 14:13 - 2014-11-02 18:41 - 00000000 ____D C:\ProgramData\HitmanPro
2015-12-25 13:53 - 2014-10-23 03:01 - 00001423 _____ C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-12-25 13:53 - 2014-10-23 03:01 - 00001389 _____ C:\Users\Toni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-12-25 13:52 - 2015-04-19 15:35 - 00000813 _____ C:\Users\Toni\Desktop\DiRT 3 Complete Edition.lnk
2015-12-25 13:52 - 2015-02-02 19:38 - 00001239 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2015-12-25 13:52 - 2014-12-17 22:12 - 00002002 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-12-25 13:52 - 2014-10-30 16:15 - 00001221 _____ C:\Users\Public\Desktop\MPEG Video Wizard DVD 5.0.lnk
2015-12-25 13:52 - 2014-10-23 18:47 - 00000733 _____ C:\Users\Public\Desktop\GRID Autosport.lnk
2015-12-25 13:52 - 2014-10-23 02:59 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2015-12-25 13:52 - 2014-10-22 21:50 - 00002837 _____ C:\Users\Public\Desktop\Nero Burning ROM 11.lnk
2015-12-25 13:52 - 2014-10-22 19:13 - 00001110 _____ C:\Users\Toni\Desktop\Adobe Premiere Pro CS6.lnk
2015-12-25 13:52 - 2014-10-22 18:34 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-12-25 13:52 - 2014-10-22 18:34 - 00001145 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-12-25 13:52 - 2014-10-22 18:27 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-12-25 13:52 - 2014-10-22 18:06 - 00000985 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2015-12-25 13:52 - 2009-07-14 07:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2015-12-25 13:52 - 2009-07-14 06:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-12-25 13:52 - 2009-07-14 06:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2015-12-25 13:52 - 2009-07-14 06:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2015-12-25 13:52 - 2009-07-14 06:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2015-12-25 13:52 - 2009-07-14 06:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2015-12-25 13:45 - 2014-10-22 21:24 - 00000000 ____D C:\KMPlayer
2015-12-25 13:36 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Resources
2015-12-25 13:10 - 2014-12-29 21:27 - 00000000 ____D C:\Users\Toni\AppData\Local\Hotger
2015-12-25 13:06 - 2014-12-29 21:27 - 00000000 ____D C:\Users\Toni\Documents\YouTubeDownloads
2015-12-25 12:28 - 2014-10-22 18:02 - 00000000 ____D C:\Users\Toni\AppData\Local\Adobe
2015-12-25 12:17 - 2014-10-22 18:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-22 14:57 - 2014-11-16 16:53 - 00000000 ____D C:\Users\Toni\AppData\Roaming\vlc
2015-12-14 10:56 - 2014-10-23 03:01 - 00000000 ____D C:\Users\Toni\AppData\Local\VirtualStore
2015-12-09 11:06 - 2014-10-22 17:27 - 00000000 ____D C:\Windows\SysWOW64\vbox
2015-12-09 11:06 - 2014-10-22 17:27 - 00000000 ____D C:\Windows\system32\vbox
2015-12-08 23:23 - 2014-10-22 19:28 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-12-08 23:23 - 2014-10-22 19:28 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-08 23:23 - 2014-10-22 19:28 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-07 13:13 - 2014-04-29 22:26 - 00000000 ___HD C:\Users\Toni\AppData\Local\Eg8lnRYWqJllIqj
2015-12-05 13:17 - 2014-11-03 21:15 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-05 13:17 - 2014-11-03 21:15 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-11-28 16:02 - 2014-11-03 21:15 - 00449992 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-11-28 16:02 - 2014-11-03 21:15 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-11-28 16:02 - 2014-11-03 21:15 - 00154256 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-11-28 16:02 - 2014-11-03 21:15 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-11-28 16:02 - 2014-11-03 21:15 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-11-28 16:02 - 2014-11-03 21:15 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-11-28 16:02 - 2014-11-03 21:15 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-11-28 16:01 - 2015-09-15 09:24 - 00147088 _____ (AVAST Software) C:\Windows\system32\Drivers\ngvss.sys
2015-11-28 16:01 - 2014-11-03 21:15 - 01059656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-12-21 18:44

==================== End of FRST.txt ============================

Addition.txt

26 декември 201510 г.

Здравейте и Весела Коледа!

Какъв е проблема за да знам къде да търся? В логовете на бърз преглед няма нищо зловредно...

26 декември 201510 г.

Автор

Изкачат ми реклами почити на целия екрани като се опитам да ги премахна и ми отваря сайтове с още реклами.

26 декември 201510 г.

Само във Firefox ли е проблема?

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това задайте ръчно DNS-ите на Google: (както са на снимката):

8.8.8.8

8.8.4.4

При вас в момента само единия адрес е на Google - втория 8.8.8.8, но първия е на прокси и е добре да се премахне и да се замени с 8.8.8.8, а втория да стане 8.8.4.4

Кликнете с десен бутон върху иконата на мрежовия адаптер в системния трей => Open network and sharing center => change adapter settings (линка вляво) => десен бутон върху мрежовия адаптер => properties => плъзнете плъзгача до Internet protocol version 4 (TCP/IPv4) => Properties и ще ги видите.

След това рестартирайте системата и пишете дали има подобрение.

26 декември 201510 г.

Автор

Направих всичко както ми описахте и мисля че проблемът се решен. Не ми излизат вече реклами.

Трябва ли сега да правя още някаква проверка или вече системата ми е чиста?

26 декември 201510 г.

Може ли все пак да видя лог файла от FRST - fixlog.txt? Изобщо преминахте ли през тази стъпка преди да смените DNS адреса?

26 декември 201510 г.

Автор

Да направих всичко което бяхте написали обаче такъв файл fixlog.txt не ми излезе никъде.

26 декември 201510 г.

Проверете в папката от която сте стартирали инструмента D:\dowloads или в C:\FRST\Logs

26 декември 201510 г.

Автор

Това ли трябва да е?

Fixlog_26-12-2015_18-24-40.txt

26 декември 201510 г.

Не, този от първото стартиране. Това е лог файла от 2-второто такова:

Цитат

Run:2

Други логове име ли в споменатите от мен папки?

26 декември 201510 г.

Автор

Това е всичко в папката

Fixlog_26-12-2015_17-55-16.txt

Addition_25-12-2015_14-43-56.txt

FRST_25-12-2015_14-43-56.txt

ct

26 декември 201510 г.

Това е друго нещо.

Що се отнася дали да правим още проверки...видях, че вие вече сте проверили с Junkware Removal Tool, HitmanPro и Malwarebytes Anti-Malware...можем да направим 3 последни проверки, но не вярвам да открием нещо съществено...но за ваше успокоение ще ги направим.

СТЪПКА 1

Моля изтеглете ZHPcleaner и я запазете на вашия десктоп.

Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
Кликнете върху за да се съгласите с лицензионното споразумение.
Изберете бутона .
Браузърите ще бъдат затворени автоматично.
Ще се отвори лог файл след прикючването на проверката.
Публикувайте лог файла в следващия си коментар.

СТЪПКА 2

Изтеглете и стартирайтe AdwCleaner.exe.
От Options => сложете всички отметки (без последната).
Натиснете бутона Scan.
AdwCleaner ще започне да проверява компютъра.
След като проверката приключи натиснете бутона Clean.
Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
Ще се появи автоматично лог файл с името (AdwCleaner[C0].txt) в C:\Adwcleaner
Публикувайте съдържанието му в следващия си коментар.

СТЪПКА 3

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
Натиснете Next за да започне проверката.
Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

Поздрави!

26 декември 201510 г.

Автор

Emsisoft Emergency Kit - Version 10.0
Last update: 26.12.2015 г. 21:45:39
User account: Toni-PC\Toni

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: Off
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:   26.12.2015 г. 21:48:10
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASAPI32    detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASMANCS    detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\BINGBAR_RASMANCS    detected: Application.Win32.InstallExt (A)

Scanned 177799
Found 3

Scan end: 26.12.2015 г. 22:09:35
Scan time: 0:21:25

AdwCleaner[S1].txt

ZHPCleaner-[S]-26122015-21_20_55.txt

26 декември 201510 г.

Повторете проверката със ZHPCleaner, но този път натиснете бутона Repair. Като се отвори списъка с намерените неща за почистване натиснете отново бутона Repair. Като приключи натиснете бутпна Report и запазете файла на десктопа и го публикувайте в следващия си коментар.

За да изтрием намерените неща от Emsisoft направете следното:

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!