Здравейте,

Антивирусната Avast не отчита, че има вируси, Trojan Remover също, както и Microsoft Sckan.

Първоначално премахнаха заразени файлове, не успях да видя какви са точно, но сканирах няколко пъти, вече не отчитат заразени файлове, вируси, но проблема си остава.

Когато търся каквото и да е в google, като резултат ми излизат няколко поредни еднакви резултата и чак след тях реалните. Като влизам в повечето страници отстрани и отдолу ми излизат огромни реклами, като кликна да си въведа парола някъде ме пренасочва в други сайтове и рекламни страници...  Tърсих да изтегля една програма, теглих от съмнителни сайтове и от 3 дни имам този проблем.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-01-2016
Ran by ilhan (administrator) on ILHAN-PC (19-01-2016 18:46:19)
Running from C:\Users\ilhan\Downloads
Loaded Profiles: ilhan (Available Profiles: ilhan)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Mail.Ru) C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe
() C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
(TU-Funs LIMITED) C:\ProgramData\lWdMl\WdMan.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Mail.Ru) C:\Users\ilhan\AppData\Local\Mail.Ru\MailRuUpdater.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\VIVACOM 3G USB Modem\VIVACOM 3G USB Modem.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\Common Files\4f596ec3-77fb-4fc3-82cb-691c42c71d77\updater.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\PluginContainer.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\2\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\3\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\5\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\8\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\7\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\10\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\12\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\7\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\3\Plugin.exe
() C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\plugins\12\Plugin.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-13] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-08-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe [87336 2010-09-20] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-18] (Avast Software s.r.o.)
HKLM-x32\...\Run: [TrojanScanner] => C:\Program Files (x86)\Trojan Remover\Trjscan.exe [3725328 2015-10-15] (Simply Super Software)
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\Run: [Facebook Update] => C:\Users\ilhan\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-02-09] (Facebook Inc.)
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\Run: [Viber] => "C:\Users\ilhan\AppData\Local\Viber\Viber.exe"
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\Run: [MailRuUpdater] => C:\Users\ilhan\AppData\Local\Mail.Ru\MailRuUpdater.exe [6058712 2016-01-15] (Mail.Ru)
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {57f98f46-cd94-11e4-8916-90a4de9e3b20} - F:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {57f98f55-cd94-11e4-8916-90a4de9e3b20} - F:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {57f98f6d-cd94-11e4-8916-90a4de9e3b20} - G:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {d07e898f-ce73-11e4-b15c-90a4de9e3b20} - F:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {d0ac827f-91b5-11e4-88db-90a4de9e3b20} - F:\AutoRun.exe
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Settings Manager\smdmf\sysapcrt.dll
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Settings Manager\smdmf\x64\sysapcrt.dll
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-09] (Avast Software s.r.o.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2012-02-01]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{1A378D02-8840-42B0-BF84-AE7637996445}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{47854D17-0241-4A53-8F23-73CC0B1B7ABC}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4D5CBD5A-6FB9-46D8-8A1A-DBA8CC443081}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{B7459CC9-C956-4F39-8D89-37248D7E033E}: [NameServer] 212.39.90.42 212.39.90.43

Internet Explorer:
==================
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.mail.ru/?ieverfix=1&fr=ieverfix_sg
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?utm_source=b&utm_medium=ss&from=ss&uid=SAMSUNG_HN-M500MBB_S2RSJ9FBA11158&ts=1354068028
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&ieverfix=1&fr=ieverfix_dse
SearchScopes: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&ieverfix=1&fr=ieverfix_dse
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-09] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-01-14] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-05-09] (Avast Software s.r.o.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-01-14] (Google Inc.)
BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll [2010-10-25] ()
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-01-14] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-01-14] (Google Inc.)
Toolbar: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> avast! EasyPass Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default
FF NewTab: hxxp://www.yoursearching.com/newtab/?type=nt&ts=1449395713&z=5e7c20d41738a6add892395g7zbzat6c7taw2mbe8q&from=cor&uid=SAMSUNGXHN-M500MBB_S2RSJ9FBA11158
FF DefaultSearchEngine: @Mail.Ru
FF SearchEngineOrder.1: default-search.net
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Поиск@Mail.Ru
FF Homepage: www.google.bg
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-09] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3501037737-4075381568-431326788-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\ilhan\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-3501037737-4075381568-431326788-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\ilhan\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-07] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\user.js [2016-01-14]
FF Extension: Домашняя страница Mail.Ru - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\[email protected] [2015-12-26]
FF Extension: Поиск@Mail.Ru - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\[email protected] [2015-12-26] [not signed]
FF Extension: Discover Treasure - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\{8c45f3f9-c0ef-4add-9d3b-9333bf7271cf}.xpi [2016-01-14] [not signed]
FF Extension: Визуальные закладки @Mail.Ru - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} [2015-12-26]
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-05-18] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\extensions\[email protected] => not found

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.yoursearching.com/?type=hp&ts=1449395713&z=5e7c20d41738a6add892395g7zbzat6c7taw2mbe8q&from=cor&uid=SAMSUNGXHN-M500MBB_S2RSJ9FBA11158
CHR StartupUrls: Default -> "hxxp://go.mail.ru/?chverfix=1&fr=chverfix_sg"
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.111\gcswf32.dll => No File
CHR Plugin: (Skype Toolbars) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (WordCaptureX) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf\1.1_0\npWCX.dll (Deskperience)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll => No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Profile: C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (AutoPCBackup) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gajcommimlhdkdihfjakhdcbnklbnlia [2015-11-08]
CHR Extension: (MyPlayCity) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjmohbdbnfkkjolmdfbhhdfjgjclomkd [2014-12-07]
CHR Extension: (Avast Online Security) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-08]
CHR Extension: (Discover Treasure) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai [2016-01-19] [UpdateUrl: hxxp://cdn.discovertreasurenow.com/update] <==== ATTENTION
CHR Extension: (Word CaptureX Extension) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf [2014-09-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR Extension: (Allin1Convert) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\odhkadhmcmknhbdekepokcbnipebjdei [2015-10-10]
CHR HKLM-x32\...\Chrome\Extension: [bpeeepmahhfjiediknjejcmcfmjcjdck] - C:\Program Files (x86)\Google\Chrome\User Data\Default\Extensions\serach.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [dkdkpmmkgdbglmfmmmmehbkmnkopingb] - C:\Program Files (x86)\Google\Chrome\User Data\Default\Extensions\v9-toolbar.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-05-09]
CHR HKLM-x32\...\Chrome\Extension: [ijblflkdjdopkpdgllkmlbgcffjbnfda] - C:\Program Files (x86)\Google\Chrome\User Data\Default\Extensions\newtab.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx [2010-07-23]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-09] (Avast Software s.r.o.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-10-28] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]
R2 Service Mgr DiscoverTreasure; C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77\PluginContainer.exe [782048 2016-01-19] () <==== ATTENTION
R2 Update Mgr DiscoverTreasure; C:\Program Files (x86)\Common Files\4f596ec3-77fb-4fc3-82cb-691c42c71d77\updater.exe [647392 2016-01-19] () <==== ATTENTION
R2 Updater.Mail.Ru; C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe [6058712 2016-01-15] (Mail.Ru)
S2 VIVACOM 3G USB Modem. RunOuc; C:\Program Files (x86)\VIVACOM 3G USB Modem\UpdateDog\ouc.exe [651856 2013-10-26] ()
R2 WdMan; C:\ProgramData\lWdMl\WdMan.exe [326656 2016-01-07] (TU-Funs LIMITED) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 SmdmFService; C:\Program Files (x86)\Settings Manager\smdmf\SmdmFService.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-09] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [21136 2012-10-31] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-09] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-09] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-09] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-27] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-09] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-09] ()
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\ew_cdcacm.sys [121728 2013-10-23] (Huawei Technologies Co., Ltd.)
R3 hwusb_wwanecm; C:\Windows\System32\DRIVERS\ew_wwanecm.sys [376448 2013-11-01] (Huawei Technologies Co., Ltd.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-10-14] (Windows (R) 2003 DDK 3790 provider)
S1 wfdrvr_vt_1_10_0_28; no ImagePath
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]
S1 F06DEFF2-5B9C-490D-910F-35D3A91196222; \??\C:\Program Files (x86)\Settings Manager\smdmf\x64\smdmfmgrc3.cfg [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-19 18:46 - 2016-01-19 18:46 - 00023964 _____ C:\Users\ilhan\Downloads\FRST.txt
2016-01-19 18:46 - 2016-01-19 18:46 - 00000000 ____D C:\FRST
2016-01-19 18:44 - 2016-01-19 18:44 - 02370560 _____ (Farbar) C:\Users\ilhan\Downloads\FRST64.exe
2016-01-19 11:51 - 2016-01-19 11:51 - 00000000 ____D C:\Users\ilhan\Documents\Simply Super Software
2016-01-19 11:49 - 2016-01-19 11:49 - 00001069 _____ C:\Users\Public\Desktop\Trojan Remover.lnk
2016-01-19 11:49 - 2016-01-19 11:49 - 00000000 ____D C:\ProgramData\Simply Super Software
2016-01-19 11:49 - 2016-01-19 11:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2016-01-19 11:49 - 2016-01-19 11:49 - 00000000 ____D C:\Program Files (x86)\Trojan Remover
2016-01-19 11:46 - 2016-01-19 11:48 - 28167528 _____ (Simply Super Software ) C:\Users\ilhan\Downloads\trjsetup693.exe
2016-01-19 11:40 - 2016-01-19 11:45 - 146360592 _____ (Microsoft Corporation) C:\Users\ilhan\Downloads\msert (1).exe
2016-01-18 20:50 - 2016-01-18 20:54 - 143940368 _____ (Microsoft Corporation) C:\Users\ilhan\Downloads\msert.exe
2016-01-18 18:57 - 2016-01-19 18:41 - 00000000 ____D C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77
2016-01-18 16:06 - 2016-01-18 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-01-18 16:03 - 2016-01-18 16:03 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-01-18 16:03 - 2016-01-18 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2016-01-18 14:56 - 2016-01-18 15:15 - 00000000 ____D C:\Users\ilhan\Desktop\63_PAGE
2016-01-18 14:08 - 2016-01-18 14:39 - 00000000 ____D C:\Users\ilhan\Desktop\13_PAGE
2016-01-18 13:25 - 2016-01-18 15:25 - 00000001 _____ C:\windows\SysWOW64\en.html
2016-01-18 11:07 - 2016-01-18 18:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-01-17 22:44 - 2016-01-17 22:55 - 00000000 ____D C:\Users\ilhan\Desktop\foto
2016-01-17 00:02 - 2016-01-17 00:02 - 04220044 _____ C:\Users\ilhan\Desktop\vremeto 1-2.eps
2016-01-15 06:42 - 2016-01-15 06:43 - 00000000 ____D C:\Users\ilhan\AppData\LocalLow\uTorrent
2016-01-15 06:41 - 2016-01-15 06:41 - 00026004 _____ C:\Users\ilhan\Downloads\Lynda.com - InDesign CS6 Essential Training.torrent
2016-01-14 13:45 - 2016-01-16 09:47 - 00000000 ____D C:\Program Files (x86)\SFK
2016-01-14 13:44 - 2016-01-14 13:45 - 00000000 ____D C:\windows\system32upd
2016-01-14 13:44 - 2016-01-14 13:45 - 00000000 ____D C:\ProgramData\lWdMl
2016-01-14 13:44 - 2016-01-14 13:44 - 00000636 _____ C:\yoursites123.xml
2016-01-14 13:44 - 2016-01-14 13:44 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2016-01-14 07:36 - 2016-01-19 18:37 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-01-14 06:59 - 2016-01-14 06:59 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\SimpleFiles
2016-01-14 06:58 - 2016-01-14 06:59 - 00000000 ____D C:\Program Files (x86)\Discover Treasure
2016-01-08 19:33 - 2016-01-08 19:42 - 00000000 ____D C:\Users\ilhan\Desktop\zaqvlenie
2015-12-31 00:14 - 2015-12-31 00:14 - 00181368 _____ C:\Users\ilhan\Downloads\Untitled Gradients.grd
2015-12-31 00:05 - 2010-10-24 14:52 - 00163356 _____ C:\Users\ilhan\Downloads\the-ultimate-gradient-pack-1-grey.grd

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-19 18:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows
2016-01-19 18:27 - 2012-02-06 01:57 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-19 18:17 - 2012-11-19 01:35 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-01-19 17:52 - 2011-08-31 13:20 - 00000000 ____D C:\ProgramData\Temp
2016-01-19 17:49 - 2012-02-07 02:34 - 00003926 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{CB936C3D-2F4B-46D9-8795-549AF1EC7AE1}
2016-01-19 17:43 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-19 17:43 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-19 17:37 - 2015-10-31 14:26 - 00000410 _____ C:\windows\Tasks\Final Media Player Update Checker.job
2016-01-19 17:37 - 2012-02-06 01:57 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-19 17:35 - 2012-02-01 14:17 - 00065536 _____ C:\windows\system32\Ikeext.etl
2016-01-19 17:35 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-01-19 17:33 - 2012-02-27 15:50 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\SoftGrid Client
2016-01-19 17:21 - 2012-09-22 01:29 - 00000928 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3501037737-4075381568-431326788-1000UA.job
2016-01-19 12:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2016-01-19 11:37 - 2012-07-10 00:39 - 00004182 _____ C:\windows\System32\Tasks\avast! Emergency Update
2016-01-18 23:21 - 2012-09-22 01:29 - 00000906 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3501037737-4075381568-431326788-1000Core.job
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\lv-LV
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\lt-LT
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\et-EE
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\Help
2016-01-18 18:57 - 2013-06-26 15:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-18 17:06 - 2012-02-01 03:24 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\Skype
2016-01-18 16:06 - 2014-12-09 11:59 - 00002697 _____ C:\Users\Public\Desktop\Skype.lnk
2016-01-18 16:06 - 2014-12-08 15:47 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-01-18 16:06 - 2014-12-08 12:13 - 00000000 ____D C:\Users\ilhan\AppData\Local\Skype
2016-01-18 16:06 - 2012-02-01 03:13 - 00000000 ____D C:\ProgramData\Skype
2016-01-18 10:46 - 2013-06-26 15:09 - 00000000 ____D C:\Users\ilhan\AppData\Local\Mozilla
2016-01-18 09:23 - 2012-02-01 03:20 - 00648152 _____ C:\Users\ilhan\AppData\Local\GDIPFONTCACHEV1.DAT
2016-01-17 17:10 - 2015-10-31 14:19 - 00000000 ____D C:\Users\ilhan\AppData\Local\Amigo
2016-01-17 00:01 - 2015-11-25 20:32 - 00000000 ____D C:\Users\ilhan\Desktop\ID
2016-01-16 23:47 - 2012-08-20 00:06 - 02608128 ___SH C:\Users\ilhan\Desktop\Thumbs.db
2016-01-16 15:50 - 2012-02-10 00:28 - 00000000 ____D C:\Users\ilhan\AppData\Local\CrashDumps
2016-01-16 07:44 - 2015-10-31 14:20 - 00000000 ____D C:\Users\ilhan\AppData\Local\Mail.Ru
2016-01-15 06:47 - 2014-11-08 18:04 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\uTorrent
2016-01-14 22:19 - 2015-06-02 18:57 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2016-01-14 22:18 - 2015-06-02 18:56 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-01-14 20:53 - 2013-06-26 15:09 - 00001119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-01-14 20:53 - 2013-03-24 01:51 - 00001413 _____ C:\Users\ilhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-01-14 13:44 - 2015-12-06 11:56 - 00000000 ____D C:\ProgramData\Tmp0x0x
2016-01-14 06:59 - 2015-12-06 11:54 - 00002558 _____ C:\Users\ilhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk
2016-01-08 19:23 - 2009-07-14 07:13 - 00783400 _____ C:\windows\system32\PerfStringBackup.INI
2016-01-02 21:21 - 2012-11-19 01:35 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-01-02 21:21 - 2012-11-19 01:35 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-01-02 21:21 - 2012-02-01 03:31 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-01 12:40 - 2015-12-06 12:59 - 00000000 ____D C:\Users\ilhan\Desktop\zvezdi
2015-12-21 16:44 - 2015-10-31 14:20 - 00000000 ____D C:\Users\ilhan\AppData\LocalLow\Unity

==================== Files in the root of some directories =======

2014-12-07 19:12 - 2014-12-07 19:12 - 6000640 _____ () C:\Program Files (x86)\GUTA489.tmp
2015-03-20 22:29 - 2015-03-20 22:29 - 1388167 _____ () C:\Users\ilhan\AppData\Roaming\UserTile.png
2012-02-01 08:03 - 2012-02-01 08:03 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-08-31 13:35 - 2011-08-31 13:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2016-01-14 13:44 - 2016-01-14 13:44 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2011-08-31 13:20 - 2011-08-31 13:22 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log
2011-08-31 13:30 - 2011-08-31 13:31 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-08-31 13:22 - 2011-08-31 13:30 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log
2011-08-31 13:31 - 2011-08-31 13:35 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log

Files to move or delete:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Some files in TEMP:
====================
C:\Users\ilhan\AppData\Local\Temp\6rprgdvm.dll
C:\Users\ilhan\AppData\Local\Temp\8duqQGCCPZ.exe
C:\Users\ilhan\AppData\Local\Temp\amigo_setup.exe
C:\Users\ilhan\AppData\Local\Temp\cdo1083144565.dll
C:\Users\ilhan\AppData\Local\Temp\cdo582240585.dll
C:\Users\ilhan\AppData\Local\Temp\mrutmp.exe
C:\Users\ilhan\AppData\Local\Temp\qbtr0jxy.dll
C:\Users\ilhan\AppData\Local\Temp\SkypeSetup.exe
C:\Users\ilhan\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe
C:\Users\ilhan\AppData\Local\Temp\Softonic_EN_1-5-11_EN-Production_10_CleanRelease.exe
C:\Users\ilhan\AppData\Local\Temp\Uninstall.exe
C:\Users\ilhan\AppData\Local\Temp\uttCA57.tmp.exe
C:\Users\ilhan\AppData\Local\Temp\{024A726A-429E-404F-BC4C-F96C8B6AABF0}.dll
C:\Users\ilhan\AppData\Local\Temp\{04E59D8B-ABDD-4ADE-A03F-41AE317793AC}-37.0.2062.120_37.0.2062.103_chrome_updater.exe
C:\Users\ilhan\AppData\Local\Temp\{090EA871-1DC1-44B0-ABD7-1BC514B7215A}.dll
C:\Users\ilhan\AppData\Local\Temp\{0E5093C6-A8CC-4935-AEE7-4FC1F3783FCF}.dll
C:\Users\ilhan\AppData\Local\Temp\{1838D411-684F-423C-B552-E14700E3FA34}-GoogleToolbarInstaller_updater_signed.exe
C:\Users\ilhan\AppData\Local\Temp\{1987CB53-0156-48F8-8049-349CD4760AF6}.dll
C:\Users\ilhan\AppData\Local\Temp\{235A7A07-2D2F-48C5-A260-D67246F99291}.dll
C:\Users\ilhan\AppData\Local\Temp\{3270C9AB-B74E-4F57-B863-E3A8FEC9B45E}.dll
C:\Users\ilhan\AppData\Local\Temp\{48E7FCE9-11CD-4B24-BA15-F1883B7012F5}.dll
C:\Users\ilhan\AppData\Local\Temp\{4AE31F9C-9E9F-4A73-B973-CB0F130ED4B6}.dll
C:\Users\ilhan\AppData\Local\Temp\{52D04781-4934-4F75-96D2-9338AB1FDC08}-37.0.2062.120_37.0.2062.103_chrome_updater.exe
C:\Users\ilhan\AppData\Local\Temp\{56E70DAA-C2F8-4930-9402-5360190AA6C2}.dll
C:\Users\ilhan\AppData\Local\Temp\{597A09D2-B184-4716-88B8-B9E04D685E75}.dll
C:\Users\ilhan\AppData\Local\Temp\{5C5A47BC-0DCE-4FA1-ADA2-629FE0A66BEC}.dll
C:\Users\ilhan\AppData\Local\Temp\{5D390E3B-5ED2-4216-9F26-CDCF0591D5A7}.dll
C:\Users\ilhan\AppData\Local\Temp\{605022D6-BD9F-4358-80E7-288FF3A88DD4}.dll
C:\Users\ilhan\AppData\Local\Temp\{67BD2D78-31B1-42C9-B1F6-205E4F92B140}.dll
C:\Users\ilhan\AppData\Local\Temp\{68F778D8-D61D-44B9-B21F-77747CE2FF44}.dll
C:\Users\ilhan\AppData\Local\Temp\{6EE3D255-8E1B-4B1D-ADFD-9D745FC7CD51}.dll
C:\Users\ilhan\AppData\Local\Temp\{7FD25C3F-E342-4F66-B5BF-BE151F0FDF14}.dll
C:\Users\ilhan\AppData\Local\Temp\{8304AF1F-3F9E-46CA-95A4-8C2CBADCE41F}.dll
C:\Users\ilhan\AppData\Local\Temp\{8450AAFE-72A7-407D-91CA-D90EFEE95158}.dll
C:\Users\ilhan\AppData\Local\Temp\{87DE1F8C-A978-4B22-9E24-A29A5D3CD9F7}.dll
C:\Users\ilhan\AppData\Local\Temp\{8FF581AF-3655-4A82-B40B-F96BA513A50B}.dll
C:\Users\ilhan\AppData\Local\Temp\{9226D738-AFFF-4248-8BD8-D2EB584684F6}.dll
C:\Users\ilhan\AppData\Local\Temp\{A37FAB92-E177-4F75-A434-53F42C4CC5C8}.dll
C:\Users\ilhan\AppData\Local\Temp\{A5E81602-9FDE-4B71-A111-37C61D0B19BA}.dll
C:\Users\ilhan\AppData\Local\Temp\{B338D7A9-8B98-4DE4-92A9-04EE412B479B}.dll
C:\Users\ilhan\AppData\Local\Temp\{B6F370C3-68D0-4838-89E7-7ED219897AC3}.dll
C:\Users\ilhan\AppData\Local\Temp\{BB9A5C67-3B28-4033-BE0B-FB28D4172806}.dll
C:\Users\ilhan\AppData\Local\Temp\{C27C60A9-35C4-4D04-AF9D-4860E0A7C13C}.dll
C:\Users\ilhan\AppData\Local\Temp\{C36A5BF0-F39E-4D14-A168-7F23C781EBC5}.dll
C:\Users\ilhan\AppData\Local\Temp\{C55DB4C2-B05F-4967-9010-932BD80CCC3B}.dll
C:\Users\ilhan\AppData\Local\Temp\{CE938DC9-DBA7-446F-AC84-A80DDC46D485}.dll
C:\Users\ilhan\AppData\Local\Temp\{D0ED433F-1A10-4387-ABA8-5073A8269E0C}.dll
C:\Users\ilhan\AppData\Local\Temp\{D1D79CE8-FBE3-4401-850C-61D1C42F2668}.dll
C:\Users\ilhan\AppData\Local\Temp\{D853FD69-A659-4EFD-9CF1-811D6CE655E9}.dll
C:\Users\ilhan\AppData\Local\Temp\{D8964245-B05F-405D-919D-B21BCFFE8103}.dll
C:\Users\ilhan\AppData\Local\Temp\{DCCD87A9-2800-492C-AB5E-6CB281B5CE58}.dll
C:\Users\ilhan\AppData\Local\Temp\{E6C0C464-2A4B-4E55-BD7E-6A5AF640E332}.dll
C:\Users\ilhan\AppData\Local\Temp\{E98445C2-260D-455B-A1A2-312A7747CE1B}.dll
C:\Users\ilhan\AppData\Local\Temp\{EB49C330-03EF-4FC4-A40C-AF473BCA9295}.dll
C:\Users\ilhan\AppData\Local\Temp\{F8B6CDFD-B9D0-40DF-97D6-667F43B26DEE}.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-01-19 17:23

==================== End of FRST.txt ============================

Addition.txt

Добър вечер..!

Изтеглете програмата GeekUninstaller и я запазете на десктопа.
Разархивирайте я и стартирайте файла geek.exe   От списъка намерете и деинсталирайте всички програми които съм ви написал в карето:

Цитат

WordFly
yoursearching uninstall

WarThunder

Settings Manager

Final Media Player 2014

Discover Treasure

 

Кликнете с десен бутон върху програмата и изберете Uninstall
 

 
 
След края на всяка деинсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи).Натиснете бутона Finish за да изтриете останките от програмата.

 

Сканиране с AdwCleaner

 
Моля, изтеглете и стартирайте програмата AdwCleaner (by Xplode):

• Затворете всички стартирани програми и браузъри
• Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
• Натиснете OK, за да потвърдите, че всички стартирани програми ще бъдат затворени.
• Маркирайте Clean
• Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
• Моля, да публикувате съдържанието на този лог в отговора си
• Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[s0].txt

 

Сканиране с Junkware Removal Tool
 
Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

• Спрете временно работата на защитните програми.
• Стартирайте инструмента JRT.exe
• Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
• Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
• Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
• Моля копирайте съдържанието на лог файла в следващия си пост.

 

Изтрийте FRST.exe и логовете към нея. След това изтеглете отново свежа версия и повторете сканирането по тази инструкция:

 

Сканиране с Farbar Recovery Scan Tool

 

• Моля изтеглете Farbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете на десктопа.
• Стартирайте файла FRST.exe (или FRST64.exe)
• Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
• Натиснете бутона .
• Изчакайте търпеливо проверката да приключи.
• Ще се създадат два лог файла с името - FRST.txt и Addition.txt на десктопа.
• Копирайте съдържанието на файла FRST.txt в следващия си пост. Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение).

 

  Дневници
 
В следващия си отговор, моля да включите следните дневници:

 

• FRST.txt (копирате цялото съдържание)
• Addition.txt (прикачате..)
• AdwCleaner[s0].txt
• JRT.txt

 

 

Благодаря!!!

За сега не ми се появяват реклами и пренасочване в други страници при кликване в страници.

Флашката ми може ли да е заразена, с коя програма да я проверя за да не стане пак зараза...

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-01-2016
Ran by ilhan (administrator) on ILHAN-PC (20-01-2016 02:28:53)
Running from C:\Users\ilhan\Desktop
Loaded Profiles: ilhan (Available Profiles: ilhan)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 10 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-13] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-08-10] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe [87336 2010-09-20] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-18] (Avast Software s.r.o.)
HKLM-x32\...\Run: [TrojanScanner] => C:\Program Files (x86)\Trojan Remover\Trjscan.exe [3725328 2015-10-15] (Simply Super Software)
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\Run: [Facebook Update] => C:\Users\ilhan\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-02-09] (Facebook Inc.)
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\Run: [Viber] => "C:\Users\ilhan\AppData\Local\Viber\Viber.exe"
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {57f98f46-cd94-11e4-8916-90a4de9e3b20} - F:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {57f98f55-cd94-11e4-8916-90a4de9e3b20} - F:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {57f98f6d-cd94-11e4-8916-90a4de9e3b20} - G:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {d07e898f-ce73-11e4-b15c-90a4de9e3b20} - F:\AutoRun.exe
HKU\S-1-5-21-3501037737-4075381568-431326788-1000\...\MountPoints2: {d0ac827f-91b5-11e4-88db-90a4de9e3b20} - F:\AutoRun.exe
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-09] (Avast Software s.r.o.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2012-02-01]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{1A378D02-8840-42B0-BF84-AE7637996445}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{47854D17-0241-4A53-8F23-73CC0B1B7ABC}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4D5CBD5A-6FB9-46D8-8A1A-DBA8CC443081}: [NameServer] 212.39.90.42 212.39.90.43
Tcpip\..\Interfaces\{B7459CC9-C956-4F39-8D89-37248D7E033E}: [NameServer] 212.39.90.42 212.39.90.43

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-09] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-01-14] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-05-09] (Avast Software s.r.o.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-01-14] (Google Inc.)
BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll [2010-10-25] ()
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-01-14] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-01-14] (Google Inc.)
Toolbar: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-3501037737-4075381568-431326788-1000 -> avast! EasyPass Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-09] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3501037737-4075381568-431326788-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\ilhan\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-3501037737-4075381568-431326788-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\ilhan\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-07] (Unity Technologies ApS)
FF Extension: Домашняя страница Mail.Ru - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\[email protected] [2015-12-26]
FF Extension: Поиск@Mail.Ru - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\[email protected] [2015-12-26] [not signed]
FF Extension: Discover Treasure - C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\{8c45f3f9-c0ef-4add-9d3b-9333bf7271cf}.xpi [2016-01-14] [not signed]
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-05-18] [not signed]

Chrome:
=======
CHR Profile: C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (MyPlayCity) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjmohbdbnfkkjolmdfbhhdfjgjclomkd [2014-12-07]
CHR Extension: (Avast Online Security) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-08]
CHR Extension: (Discover Treasure) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai [2016-01-20] [UpdateUrl: hxxp://cdn.discovertreasurenow.com/update] <==== ATTENTION
CHR Extension: (Chrome Web Store Payments) - C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR HKLM-x32\...\Chrome\Extension: [bpeeepmahhfjiediknjejcmcfmjcjdck] - C:\Program Files (x86)\Google\Chrome\User Data\Default\Extensions\serach.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [dkdkpmmkgdbglmfmmmmehbkmnkopingb] - C:\Program Files (x86)\Google\Chrome\User Data\Default\Extensions\v9-toolbar.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-05-09]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-09] (Avast Software s.r.o.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-10-28] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]
S2 VIVACOM 3G USB Modem. RunOuc; C:\Program Files (x86)\VIVACOM 3G USB Modem\UpdateDog\ouc.exe [651856 2013-10-26] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Updater.Mail.Ru; C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe --s [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-09] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [21136 2012-10-31] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-09] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-09] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-09] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-27] (Avast Software s.r.o.)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-09] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-09] ()
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 hwusb_cdcacm; C:\Windows\System32\DRIVERS\ew_cdcacm.sys [121728 2013-10-23] (Huawei Technologies Co., Ltd.)
R3 hwusb_wwanecm; C:\Windows\System32\DRIVERS\ew_wwanecm.sys [376448 2013-11-01] (Huawei Technologies Co., Ltd.)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-10-14] (Windows (R) 2003 DDK 3790 provider)
S3 BCM42RLY; system32\drivers\BCM42RLY.sys [X]
S3 BCM43XX; system32\DRIVERS\bcmwl664.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-20 02:28 - 2016-01-20 02:29 - 00016469 _____ C:\Users\ilhan\Desktop\FRST.txt
2016-01-20 02:25 - 2016-01-20 02:25 - 00005731 _____ C:\Users\ilhan\Desktop\JRT.txt
2016-01-20 02:11 - 2016-01-20 02:12 - 00010555 _____ C:\Users\ilhan\Desktop\AdwCleaner[C1].txt
2016-01-20 02:08 - 2016-01-20 02:16 - 00000000 ____D C:\AdwCleaner
2016-01-20 01:44 - 2016-01-20 01:45 - 02370560 _____ (Farbar) C:\Users\ilhan\Desktop\FRST64.exe
2016-01-20 01:39 - 2016-01-20 01:39 - 01600184 _____ (Malwarebytes) C:\Users\ilhan\Desktop\JRT.exe
2016-01-20 01:37 - 2016-01-20 01:37 - 01505280 _____ C:\Users\ilhan\Desktop\adwcleaner_5.030.exe
2016-01-20 01:28 - 2016-01-20 02:05 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\Geek Uninstaller
2016-01-20 01:27 - 2016-01-20 01:27 - 02581418 _____ C:\Users\ilhan\Desktop\geek.zip
2016-01-20 01:27 - 2015-12-06 14:53 - 06340384 _____ (Geek Uninstaller) C:\Users\ilhan\Desktop\geek.exe
2016-01-20 01:26 - 2016-01-20 01:27 - 02581418 _____ C:\Users\ilhan\Downloads\geek.zip
2016-01-19 18:46 - 2016-01-20 02:28 - 00000000 ____D C:\FRST
2016-01-19 11:51 - 2016-01-19 11:51 - 00000000 ____D C:\Users\ilhan\Documents\Simply Super Software
2016-01-19 11:49 - 2016-01-19 11:49 - 00001069 _____ C:\Users\Public\Desktop\Trojan Remover.lnk
2016-01-19 11:49 - 2016-01-19 11:49 - 00000000 ____D C:\ProgramData\Simply Super Software
2016-01-19 11:49 - 2016-01-19 11:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
2016-01-19 11:49 - 2016-01-19 11:49 - 00000000 ____D C:\Program Files (x86)\Trojan Remover
2016-01-19 11:46 - 2016-01-19 11:48 - 28167528 _____ (Simply Super Software ) C:\Users\ilhan\Downloads\trjsetup693.exe
2016-01-19 11:40 - 2016-01-19 11:45 - 146360592 _____ (Microsoft Corporation) C:\Users\ilhan\Downloads\msert (1).exe
2016-01-18 20:50 - 2016-01-18 20:54 - 143940368 _____ (Microsoft Corporation) C:\Users\ilhan\Downloads\msert.exe
2016-01-18 16:06 - 2016-01-18 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-01-18 16:03 - 2016-01-20 01:47 - 00002215 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-01-18 16:03 - 2016-01-18 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2016-01-18 14:56 - 2016-01-18 15:15 - 00000000 ____D C:\Users\ilhan\Desktop\63_PAGE
2016-01-18 14:08 - 2016-01-18 14:39 - 00000000 ____D C:\Users\ilhan\Desktop\13_PAGE
2016-01-18 13:25 - 2016-01-18 15:25 - 00000001 _____ C:\windows\SysWOW64\en.html
2016-01-18 11:07 - 2016-01-18 18:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-01-17 22:44 - 2016-01-17 22:55 - 00000000 ____D C:\Users\ilhan\Desktop\foto
2016-01-17 00:02 - 2016-01-17 00:02 - 04220044 _____ C:\Users\ilhan\Desktop\vremeto 1-2.eps
2016-01-15 06:42 - 2016-01-15 06:43 - 00000000 ____D C:\Users\ilhan\AppData\LocalLow\uTorrent
2016-01-15 06:41 - 2016-01-15 06:41 - 00026004 _____ C:\Users\ilhan\Downloads\Lynda.com - InDesign CS6 Essential Training.torrent
2016-01-14 13:44 - 2016-01-14 13:45 - 00000000 ____D C:\windows\system32upd
2016-01-14 13:44 - 2016-01-14 13:45 - 00000000 ____D C:\ProgramData\lWdMl
2016-01-14 13:44 - 2016-01-14 13:44 - 00000636 _____ C:\yoursites123.xml
2016-01-14 07:36 - 2016-01-20 01:47 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-01-08 19:33 - 2016-01-08 19:42 - 00000000 ____D C:\Users\ilhan\Desktop\zaqvlenie
2015-12-31 00:14 - 2015-12-31 00:14 - 00181368 _____ C:\Users\ilhan\Downloads\Untitled Gradients.grd
2015-12-31 00:05 - 2010-10-24 14:52 - 00163356 _____ C:\Users\ilhan\Downloads\the-ultimate-gradient-pack-1-grey.grd

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-20 02:27 - 2012-02-06 01:57 - 00000898 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-20 02:21 - 2012-09-22 01:29 - 00000928 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3501037737-4075381568-431326788-1000UA.job
2016-01-20 02:21 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-20 02:21 - 2009-07-14 06:45 - 00028848 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-20 02:17 - 2012-11-19 01:35 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-01-20 02:14 - 2012-02-06 01:57 - 00000894 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-20 02:13 - 2012-02-01 14:17 - 00065536 _____ C:\windows\system32\Ikeext.etl
2016-01-20 02:13 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-01-20 02:11 - 2012-02-01 03:31 - 00000000 ____D C:\Users\ilhan\AppData\LocalLow\Yahoo!
2016-01-20 01:47 - 2013-06-26 15:09 - 00001119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-01-20 01:47 - 2013-03-24 01:51 - 00001413 _____ C:\Users\ilhan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-01-19 23:21 - 2012-09-22 01:29 - 00000906 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3501037737-4075381568-431326788-1000Core.job
2016-01-19 23:17 - 2012-11-19 01:35 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-01-19 23:17 - 2012-11-19 01:35 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-01-19 23:17 - 2012-02-01 03:31 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-19 18:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows
2016-01-19 17:52 - 2011-08-31 13:20 - 00000000 ____D C:\ProgramData\Temp
2016-01-19 17:49 - 2012-02-07 02:34 - 00003926 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{CB936C3D-2F4B-46D9-8795-549AF1EC7AE1}
2016-01-19 17:33 - 2012-02-27 15:50 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\SoftGrid Client
2016-01-19 12:29 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing
2016-01-19 11:37 - 2012-07-10 00:39 - 00004182 _____ C:\windows\System32\Tasks\avast! Emergency Update
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\lv-LV
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\lt-LT
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\et-EE
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2016-01-18 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\windows\Help
2016-01-18 18:57 - 2013-06-26 15:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-18 17:06 - 2012-02-01 03:24 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\Skype
2016-01-18 16:06 - 2014-12-09 11:59 - 00002697 _____ C:\Users\Public\Desktop\Skype.lnk
2016-01-18 16:06 - 2014-12-08 15:47 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-01-18 16:06 - 2014-12-08 12:13 - 00000000 ____D C:\Users\ilhan\AppData\Local\Skype
2016-01-18 16:06 - 2012-02-01 03:13 - 00000000 ____D C:\ProgramData\Skype
2016-01-18 10:46 - 2013-06-26 15:09 - 00000000 ____D C:\Users\ilhan\AppData\Local\Mozilla
2016-01-18 09:23 - 2012-02-01 03:20 - 00648152 _____ C:\Users\ilhan\AppData\Local\GDIPFONTCACHEV1.DAT
2016-01-17 00:01 - 2015-11-25 20:32 - 00000000 ____D C:\Users\ilhan\Desktop\ID
2016-01-16 23:47 - 2012-08-20 00:06 - 02608128 ___SH C:\Users\ilhan\Desktop\Thumbs.db
2016-01-16 15:50 - 2012-02-10 00:28 - 00000000 ____D C:\Users\ilhan\AppData\Local\CrashDumps
2016-01-15 06:47 - 2014-11-08 18:04 - 00000000 ____D C:\Users\ilhan\AppData\Roaming\uTorrent
2016-01-14 22:19 - 2015-06-02 18:57 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2016-01-14 22:18 - 2015-06-02 18:56 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-01-08 19:23 - 2009-07-14 07:13 - 00783400 _____ C:\windows\system32\PerfStringBackup.INI
2016-01-01 12:40 - 2015-12-06 12:59 - 00000000 ____D C:\Users\ilhan\Desktop\zvezdi
2015-12-21 16:44 - 2015-10-31 14:20 - 00000000 ____D C:\Users\ilhan\AppData\LocalLow\Unity

==================== Files in the root of some directories =======

2015-03-20 22:29 - 2015-03-20 22:29 - 1388167 _____ () C:\Users\ilhan\AppData\Roaming\UserTile.png
2012-02-01 08:03 - 2012-02-01 08:03 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-08-31 13:35 - 2011-08-31 13:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2011-08-31 13:20 - 2011-08-31 13:22 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log
2011-08-31 13:30 - 2011-08-31 13:31 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-08-31 13:22 - 2011-08-31 13:30 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log
2011-08-31 13:31 - 2011-08-31 13:35 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log

Some files in TEMP:
====================
C:\Users\ilhan\AppData\Local\Temp\6rprgdvm.dll
C:\Users\ilhan\AppData\Local\Temp\8duqQGCCPZ.exe
C:\Users\ilhan\AppData\Local\Temp\amigo_setup.exe
C:\Users\ilhan\AppData\Local\Temp\cdo1083144565.dll
C:\Users\ilhan\AppData\Local\Temp\cdo582240585.dll
C:\Users\ilhan\AppData\Local\Temp\mrutmp.exe
C:\Users\ilhan\AppData\Local\Temp\qbtr0jxy.dll
C:\Users\ilhan\AppData\Local\Temp\SkypeSetup.exe
C:\Users\ilhan\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe
C:\Users\ilhan\AppData\Local\Temp\Softonic_EN_1-5-11_EN-Production_10_CleanRelease.exe
C:\Users\ilhan\AppData\Local\Temp\sqlite3.dll
C:\Users\ilhan\AppData\Local\Temp\Uninstall.exe
C:\Users\ilhan\AppData\Local\Temp\uttCA57.tmp.exe
C:\Users\ilhan\AppData\Local\Temp\{024A726A-429E-404F-BC4C-F96C8B6AABF0}.dll
C:\Users\ilhan\AppData\Local\Temp\{04E59D8B-ABDD-4ADE-A03F-41AE317793AC}-37.0.2062.120_37.0.2062.103_chrome_updater.exe
C:\Users\ilhan\AppData\Local\Temp\{090EA871-1DC1-44B0-ABD7-1BC514B7215A}.dll
C:\Users\ilhan\AppData\Local\Temp\{0E5093C6-A8CC-4935-AEE7-4FC1F3783FCF}.dll
C:\Users\ilhan\AppData\Local\Temp\{1838D411-684F-423C-B552-E14700E3FA34}-GoogleToolbarInstaller_updater_signed.exe
C:\Users\ilhan\AppData\Local\Temp\{1987CB53-0156-48F8-8049-349CD4760AF6}.dll
C:\Users\ilhan\AppData\Local\Temp\{235A7A07-2D2F-48C5-A260-D67246F99291}.dll
C:\Users\ilhan\AppData\Local\Temp\{3270C9AB-B74E-4F57-B863-E3A8FEC9B45E}.dll
C:\Users\ilhan\AppData\Local\Temp\{48E7FCE9-11CD-4B24-BA15-F1883B7012F5}.dll
C:\Users\ilhan\AppData\Local\Temp\{4AE31F9C-9E9F-4A73-B973-CB0F130ED4B6}.dll
C:\Users\ilhan\AppData\Local\Temp\{52D04781-4934-4F75-96D2-9338AB1FDC08}-37.0.2062.120_37.0.2062.103_chrome_updater.exe
C:\Users\ilhan\AppData\Local\Temp\{56E70DAA-C2F8-4930-9402-5360190AA6C2}.dll
C:\Users\ilhan\AppData\Local\Temp\{597A09D2-B184-4716-88B8-B9E04D685E75}.dll
C:\Users\ilhan\AppData\Local\Temp\{5C5A47BC-0DCE-4FA1-ADA2-629FE0A66BEC}.dll
C:\Users\ilhan\AppData\Local\Temp\{5D390E3B-5ED2-4216-9F26-CDCF0591D5A7}.dll
C:\Users\ilhan\AppData\Local\Temp\{605022D6-BD9F-4358-80E7-288FF3A88DD4}.dll
C:\Users\ilhan\AppData\Local\Temp\{67BD2D78-31B1-42C9-B1F6-205E4F92B140}.dll
C:\Users\ilhan\AppData\Local\Temp\{68F778D8-D61D-44B9-B21F-77747CE2FF44}.dll
C:\Users\ilhan\AppData\Local\Temp\{6EE3D255-8E1B-4B1D-ADFD-9D745FC7CD51}.dll
C:\Users\ilhan\AppData\Local\Temp\{7FD25C3F-E342-4F66-B5BF-BE151F0FDF14}.dll
C:\Users\ilhan\AppData\Local\Temp\{8304AF1F-3F9E-46CA-95A4-8C2CBADCE41F}.dll
C:\Users\ilhan\AppData\Local\Temp\{8450AAFE-72A7-407D-91CA-D90EFEE95158}.dll
C:\Users\ilhan\AppData\Local\Temp\{87DE1F8C-A978-4B22-9E24-A29A5D3CD9F7}.dll
C:\Users\ilhan\AppData\Local\Temp\{88E708E6-4BE6-49F6-8537-6E08AE3E60C2}.dll
C:\Users\ilhan\AppData\Local\Temp\{8FF581AF-3655-4A82-B40B-F96BA513A50B}.dll
C:\Users\ilhan\AppData\Local\Temp\{9226D738-AFFF-4248-8BD8-D2EB584684F6}.dll
C:\Users\ilhan\AppData\Local\Temp\{A37FAB92-E177-4F75-A434-53F42C4CC5C8}.dll
C:\Users\ilhan\AppData\Local\Temp\{A5E81602-9FDE-4B71-A111-37C61D0B19BA}.dll
C:\Users\ilhan\AppData\Local\Temp\{B338D7A9-8B98-4DE4-92A9-04EE412B479B}.dll
C:\Users\ilhan\AppData\Local\Temp\{B6F370C3-68D0-4838-89E7-7ED219897AC3}.dll
C:\Users\ilhan\AppData\Local\Temp\{BB9A5C67-3B28-4033-BE0B-FB28D4172806}.dll
C:\Users\ilhan\AppData\Local\Temp\{C27C60A9-35C4-4D04-AF9D-4860E0A7C13C}.dll
C:\Users\ilhan\AppData\Local\Temp\{C36A5BF0-F39E-4D14-A168-7F23C781EBC5}.dll
C:\Users\ilhan\AppData\Local\Temp\{C55DB4C2-B05F-4967-9010-932BD80CCC3B}.dll
C:\Users\ilhan\AppData\Local\Temp\{CE938DC9-DBA7-446F-AC84-A80DDC46D485}.dll
C:\Users\ilhan\AppData\Local\Temp\{D0ED433F-1A10-4387-ABA8-5073A8269E0C}.dll
C:\Users\ilhan\AppData\Local\Temp\{D1D79CE8-FBE3-4401-850C-61D1C42F2668}.dll
C:\Users\ilhan\AppData\Local\Temp\{D853FD69-A659-4EFD-9CF1-811D6CE655E9}.dll
C:\Users\ilhan\AppData\Local\Temp\{D8964245-B05F-405D-919D-B21BCFFE8103}.dll
C:\Users\ilhan\AppData\Local\Temp\{DCCD87A9-2800-492C-AB5E-6CB281B5CE58}.dll
C:\Users\ilhan\AppData\Local\Temp\{E6C0C464-2A4B-4E55-BD7E-6A5AF640E332}.dll
C:\Users\ilhan\AppData\Local\Temp\{E98445C2-260D-455B-A1A2-312A7747CE1B}.dll
C:\Users\ilhan\AppData\Local\Temp\{EB49C330-03EF-4FC4-A40C-AF473BCA9295}.dll
C:\Users\ilhan\AppData\Local\Temp\{F8B6CDFD-B9D0-40DF-97D6-667F43B26DEE}.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-01-19 17:23

==================== End of FRST.txt ============================

 

# AdwCleaner v5.030 - Logfile created 20/01/2016 at 02:11:37
# Updated 17/01/2016 by Xplode
# Database : 2016-01-19.2 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : ilhan - ILHAN-PC
# Running from : C:\Users\ilhan\Desktop\adwcleaner_5.030.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : SmdmFService
[-] Service Deleted : WdMan
[-] Service Deleted : wfdrvr_vt_1_10_0_28
[-] Service Deleted : F06DEFF2-5B9C-490D-910F-35D3A91196222

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\Assets Manager
[-] Folder Deleted : C:\Program Files (x86)\Mail.Ru
[-] Folder Deleted : C:\Program Files (x86)\SFK
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\Mail.Ru
[-] Folder Deleted : C:\ProgramData\smdmf
[-] Folder Deleted : C:\ProgramData\Tmp0x0x
[-] Folder Deleted : C:\ProgramData\Uniblue
[-] Folder Deleted : C:\Users\ilhan\AppData\Local\Amigo
[-] Folder Deleted : C:\Users\ilhan\AppData\Local\Mail.Ru
[-] Folder Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf
[-] Folder Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gajcommimlhdkdihfjakhdcbnklbnlia
[-] Folder Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\odhkadhmcmknhbdekepokcbnipebjdei
[-] Folder Deleted : C:\Users\ilhan\AppData\LocalLow\Yahoo!\Companion
[-] Folder Deleted : C:\Users\ilhan\AppData\Roaming\FirefoxToolbar
[-] Folder Deleted : C:\Users\ilhan\AppData\Roaming\OpenCandy
[-] Folder Deleted : C:\Users\ilhan\AppData\Roaming\SimpleFiles
[-] Folder Deleted : C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}

***** [ Files ] *****

[-] File Deleted : C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gajcommimlhdkdihfjakhdcbnklbnlia_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gajcommimlhdkdihfjakhdcbnklbnlia_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_odhkadhmcmknhbdekepokcbnipebjdei_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_odhkadhmcmknhbdekepokcbnipebjdei_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.myway.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.myway.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.tb.ask.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.tb.ask.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_autopcbackup.dl.myway.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_autopcbackup.dl.myway.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_autopcbackup.dl.tb.ask.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_autopcbackup.dl.tb.ask.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_bsplayer.bg.softonic.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_bsplayer.bg.softonic.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_ccleaner.bg.softonic.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_ccleaner.bg.softonic.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_gametab.myplaycity.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_gametab.myplaycity.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_my.parallaxsearch.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_my.parallaxsearch.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_onlinemapfinder.dl.myway.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_onlinemapfinder.dl.myway.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_onlinemapfinder.dl.tb.ask.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_onlinemapfinder.dl.tb.ask.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_vlc-media-player.bg.softonic.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_vlc-media-player.bg.softonic.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.myplaycity.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.myplaycity.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.newpoptab.com_0.localstorage
[-] File Deleted : C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.newpoptab.com_0.localstorage-journal
[-] File Deleted : C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\invalidprefs.js
[-] File Deleted : C:\Users\ilhan\AppData\Roaming\Mozilla\Firefox\Profiles\a32w46yp.default\user.js
[-] File Deleted : C:\windows\SysNative\drivers\wfdrvr_vt_1_10_0_28.sys.vir

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Mozilla\Extends
[-] Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
[-] Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]
[-] Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
[-] Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]
[!] Value Not Deleted : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls [x64]
[!] Value Not Deleted : HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls [x86]
[-] Key Deleted : HKLM\SOFTWARE\Clients\StartMenuInternet\Amigo.7THAXGRHQKZ5UNMWC2BWQF6FCI
[-] Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ijblflkdjdopkpdgllkmlbgcffjbnfda
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA760BA8-5862-4BC5-9263-4452CBC0B264}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93D511B5-143B-4A99-ABFC-B5B78AD0AE1B}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E1842850-FB16-4471-B327-7343FBAED55C}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{AA760BA8-5862-4BC5-9263-4452CBC0B264}
[-] Key Deleted : HKCU\Software\Bitberry
[-] Key Deleted : HKCU\Software\Bitberry Software
[-] Key Deleted : HKCU\Software\Conduit
[-] Key Deleted : HKCU\Software\ICSW1.17
[-] Key Deleted : HKCU\Software\Linkey
[!] Key Not Deleted : HKCU\Software\Mozilla\Extends
[-] Key Deleted : HKCU\Software\PRODUCTSETUP
[-] Key Deleted : HKCU\Software\SimpleFiles
[-] Key Deleted : HKCU\Software\SmdmF
[-] Key Deleted : HKCU\Software\Softonic
[-] Key Deleted : HKCU\Software\undefined
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\Conduit
[-] Key Deleted : HKLM\SOFTWARE\SimpleFiles
[-] Key Deleted : HKLM\SOFTWARE\SiteSee
[-] Key Deleted : HKLM\SOFTWARE\SmdmF
[-] Key Deleted : HKLM\SOFTWARE\TSv
[-] Key Deleted : HKLM\SOFTWARE\Uniblue
[-] Key Deleted : HKLM\SOFTWARE\V9Software
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\yoursearchingSoftware
[-] Key Deleted : HKLM\SOFTWARE\yoursites123Software
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater
[-] Key Deleted : [x64] HKLM\SOFTWARE\V9Software
[-] Key Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall\MailRuUpdater
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [MailRuUpdater]
[-] Key Deleted : HKCU\Software\Classes\softonic

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [10463 bytes] ##########

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.2 (01.06.2016)
Operating System: Windows 7 Home Premium x64
Ran by ilhan (Administrator) on 20/01/2016 at  2:17:58.33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

File System: 46

Successfully deleted: C:\Users\ilhan\AppData\Local\{17F0CE1B-21DD-4387-B732-E3CE0C486825} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{1CBA161A-199C-4E54-85FB-D5748230D8F0} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{1F921443-9E6E-4B4A-9B63-AE7C513B41AE} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{1FB5CE03-49B4-4106-9FF8-7A68AB95A185} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{315229BD-0A2F-4AB3-B66A-A82823468705} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{5ED28C7F-48E0-424A-873A-51514AE79E3F} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{6CC97C66-255F-4404-852D-5B40856BDB46} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{6E7DB2B7-5975-40E5-A54D-437DD24CF01A} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{728B60BA-469A-45FA-AECC-D1874D3B1FF9} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{9A419DF3-F959-48AA-9285-1B0C8476CDB7} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{A05130CC-6DBC-4D87-A51A-B4CAB6F1F9FE} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{A74052F7-DD77-4584-878E-5AAC31FE8664} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{BBE5CB59-E39A-4E82-AF0C-424E334D26C8} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{C6E87C63-7875-417F-9E64-8C24CB3F30D7} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{CC48ED26-A5C4-4517-AC24-366BC25D6A3A} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{D55C91A2-195E-48CB-95CC-91E1171217DC} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{D63612A8-BAF4-48E6-939F-D0B8027AE0E0} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\{D9F0F531-D1EA-4286-93D7-6803D387B43F} (Empty Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\crashrpt (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage-journal (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage-journal (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage (File)
Successfully deleted: C:\Users\ilhan\Appdata\LocalLow\datamngr (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Roaming\mailproducts (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Roaming\software informer (Folder)
Successfully deleted: C:\windows\system32\Tasks\EasySpeedUpManager (Task)
Successfully deleted: C:\Program Files (x86)\GUTA489.tmp (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1UXYCFF9 (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XGNWWNI (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HH6OP5N (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A00II8LU (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q57X7DH2 (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UWTXE7J4 (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XKC60TGE (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZXI6WGMZ (Folder)
Successfully deleted: C:\Users\ilhan\AppData\Local\Temp\vitruvian-installer-hardwareprofile-v0001 (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Temp\vitruvian-installer-install-v0003 (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Temp\vitruvian-installer-processes-v0002 (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Temp\vitruvian-installer-scheduledtasks-v0001 (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Temp\vitruvian-installer-softwareregkeys-v0002 (File)
Successfully deleted: C:\Users\ilhan\AppData\Local\Temp\vitruvian-installer-uninstall-v0002 (File)
Successfully deleted: C:\windows\SysWOW64\sho1E1D.tmp (File)
Successfully deleted: C:\windows\SysWOW64\sho31D2.tmp (File)
Successfully deleted: C:\windows\SysWOW64\shoCC91.tmp (File)
Successfully deleted: C:\windows\SysWOW64\shoE470.tmp (File)

 

Registry: 3

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20/01/2016 at  2:25:25.77
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Addition.txt

Здравейте..! Не сме свършили още...имаме още работа..!

 

Фикс с Farbar Recovery Scan Tool

 
Изтеглете файла  fixlist.txt и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.
Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.
 
ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

 

Дневници
 
В следващия си отговор, моля да включите следните дневници:

• FixLog.txt

 

Предполагам, че замества изтегления по-рано FixLog.txt, и го прикрепих.

След като натиснах Fix  и сканира ми даде да рестартирам, рестартирах и прикрепих файла.

Fixlog.txt

А какво е сега моментното състояние на компютъра..? Как се държи..? Наблюдавате ли още първоначалните проблеми..?

 

СТЪПКА 1

Моля изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

• Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
• След като инсталацията приключи се уверете че сте сложили отметка пред:
• Launch Malwarebytes Anti-Malware
• Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

• Натиснете бутона Finish.
• Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
• Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
• Ще започне проверка за зловреден софтуер.
• При някои инфекции можете да видите съобщението:
• "Could not load DDA driver"
• Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
• Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
• След като проверката приключи натиснете бутона Apply Actions.
• Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
• След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
• Отидете то табът History > Application Logs.

• Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
• Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

СТЪПКА 2

 

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 

 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

 

СТЪПКА 3

 

• Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
• Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
• Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

• След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
• Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
• Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
• Натиснете Next за да започне проверката.
• Когато проверката приключи натиснете бутона View Report.
• Копирайте съдържанието на лог файла в следващия си коментар.

 

СТЪПКА 4

Сканиране с SecurityCheck by glax24

• Изтеглете SecurityCheck by glax24 от тук и запомнете инструмента на десктопа .
• Стартирате програмата (ако използвате Windows XP) или стартирате с десен бутон на мишката от името на администратор (ако използвате Windows Vista/7/8/10)
• Изчакайте да приключи сканирането.Ще се отвори в текстов файл с име SecurityCheck.txt. Копирайте съдържанието на  този файл  следващия си пост
• Можете да намерите този файл в основната директория на системния диск в папка с име SecurityCheck, напр. C:\SecurityCheck\SecurityCheck.txt

 

 

 

 

 

Работи супер, все още нямам тези реклами отдолу и отстрани на страниците, няма и пренасочване към някакви измислесни рекламни страници при всеки клик.

преди 6 минути, deska870 написа:

Работи супер, все още нямам тези реклами отдолу и отстрани на страниците, няма и пренасочване към някакви измислесни рекламни страници при всеки клик.

Прекрасно..! Очаквам и резултатите от последните сканирания...за да видим за остатъци..!След това ще ви пиша и какво да направим по въпроса за флашката ..ще ви дам и някои допълнителни препоръки и следва финал...

При стъпка едно, когато приключи сканирането ми даде да избера Remove now-избрах го, после ми показа да растартирам и рестартирах,

при зареждането ми даде черен екран и пак изключих и включих лаптопа. Не ми се зареди MBAM, но аз си я заредих, отидох на History>Application logs, отворих рапорта с и без отметка, но като дам Coppy to clipboard никаде не виждам да ми е експортнат този рапорт.

Да повторя ли отначало всичко с инсталирането, там не видях да има да дам 3 отметки някъде преди да натисна Finish. Да не би това да е проблема.

Редактирано 20 януари 201610 г. от deska870 (преглед на промените)

преди 3 минути, deska870 написа:

при зареждането ми даде черен екран и пак изключих и включих лаптопа. Не ми се зареди MBAM, но аз си я заредих, отидох на History>Application logs, отворих рапорта с и без отметка, но като дам Coppy to clipboard никаде не виждам да ми е експортнат този рапорт.

....поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

..или маркирайте Application logs - таб View  и вече копирайте целия дневник

Malwarebytes Anti-Malware
www.malwarebytes.org

Protection, 20/01/2016 10:25, SYSTEM, ILHAN-PC, Protection, Malware Protection, Starting,
Protection, 20/01/2016 10:25, SYSTEM, ILHAN-PC, Protection, Malware Protection, Started,
Protection, 20/01/2016 10:25, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Starting,
Protection, 20/01/2016 10:26, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Started,
Update, 20/01/2016 10:26, SYSTEM, ILHAN-PC, Manual, Remediation Database, 2015.9.16.1, 2016.1.18.1,
Update, 20/01/2016 10:26, SYSTEM, ILHAN-PC, Manual, Rootkit Database, 2015.9.18.1, 2016.1.9.1,
Update, 20/01/2016 10:27, SYSTEM, ILHAN-PC, Manual, IP Database, 2015.9.21.2, 2016.1.19.1,
Update, 20/01/2016 10:27, SYSTEM, ILHAN-PC, Manual, Domain Database, 2015.9.22.3, 2016.1.20.1,
Protection, 20/01/2016 10:27, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 20/01/2016 10:27, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 20/01/2016 10:27, SYSTEM, ILHAN-PC, Protection, Malware Protection, Stopping,
Protection, 20/01/2016 10:27, SYSTEM, ILHAN-PC, Protection, Malware Protection, Stopped,
Protection, 20/01/2016 10:29, SYSTEM, ILHAN-PC, Protection, Malware Protection, Starting,
Protection, 20/01/2016 10:29, SYSTEM, ILHAN-PC, Protection, Malware Protection, Started,
Protection, 20/01/2016 10:29, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Starting,
Protection, 20/01/2016 10:31, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Started,
Update, 20/01/2016 10:32, SYSTEM, ILHAN-PC, Manual, Remediation Database, 2015.9.16.1, 2016.1.18.1,
Update, 20/01/2016 10:32, SYSTEM, ILHAN-PC, Manual, Rootkit Database, 2015.9.18.1, 2016.1.9.1,
Update, 20/01/2016 10:32, SYSTEM, ILHAN-PC, Manual, IP Database, 2015.9.21.2, 2016.1.19.1,
Update, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Manual, Domain Database, 2015.9.22.3, 2016.1.20.1,
Update, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Manual, Malware Database, 2015.9.22.5, 2016.1.20.2,
Protection, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Protection, Refresh, Starting,
Protection, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Protection, Refresh, Success,
Protection, 20/01/2016 10:33, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Starting,
Protection, 20/01/2016 10:34, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Started,
Detection, 20/01/2016 10:37, SYSTEM, ILHAN-PC, Protection, Malware Protection, File, PUP.Optional.WindowsProtectManager, C:\ProgramData\lWdMl\WdMan.exe, Quarantine, [479b5dde91081b1bd05301d11ee350b0]
Detection, 20/01/2016 10:37, SYSTEM, ILHAN-PC, Protection, Malware Protection, File, PUP.Optional.WindowsProtectManager, c:\programdata\lwdml\wdman.exe, Quarantine Failed, 6, The handle is invalid.  , [479b5dde91081b1bd05301d11ee350b0]
Detection, 20/01/2016 10:37, SYSTEM, ILHAN-PC, Protection, Malware Protection, File, PUP.Optional.WindowsProtectManager, c:\programdata\lwdml\wdman.exe, Quarantine Failed, 6, The handle is invalid.  , [479b5dde91081b1bd05301d11ee350b0]
Scan, 20/01/2016 11:14, SYSTEM, ILHAN-PC, Manual, Start:20/01/2016 10:39, Duration:30 min 46 sec, Threat Scan, Completed, 0 Malware Detections, 12 Non-Malware Detections,
Protection, 20/01/2016 11:16, SYSTEM, ILHAN-PC, Protection, Malware Protection, Starting,
Protection, 20/01/2016 11:16, SYSTEM, ILHAN-PC, Protection, Malware Protection, Started,
Protection, 20/01/2016 11:16, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Starting,
Protection, 20/01/2016 11:17, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Started,
Protection, 20/01/2016 11:21, SYSTEM, ILHAN-PC, Protection, Malware Protection, Starting,
Protection, 20/01/2016 11:21, SYSTEM, ILHAN-PC, Protection, Malware Protection, Started,
Protection, 20/01/2016 11:21, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Starting,
Protection, 20/01/2016 11:22, SYSTEM, ILHAN-PC, Protection, Malicious Website Protection, Started,

(end)

Да, да ок, очаквах директно да се експортне нещо та да копирам и пейстна... Продължавам!

Не сте публикували и правилния лог от Malwarebytes. Аз искам SCAN лог файла, а вие сте публикували Protection лог файла.Спокойно си работете..не се притеснявайте...!

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 20/01/2016
Scan Time: 10:39
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.01.20.02
Rootkit Database: v2016.01.09.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: ilhan

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 348014
Time Elapsed: 30 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.WindowsMangerProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, Quarantined, [22c0d3683a5ffb3b5bdab23ab94a9b65],

Registry Values: 4
PUP.Optional.SimpleFiles, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{AF02262F-8E7C-4699-85DF-FB18EE9889BC}, v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\SimpleFiles\SimpleFiles.exe|Name=SimpleFiles|, Quarantined, [5a88e45710897eb804c238ed7f85ee12]
PUP.Optional.SimpleFiles, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{C21E00E2-BF59-4A47-B989-1DB6E80B9EA9}, v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\SimpleFiles\SimpleFiles.exe|Name=SimpleFiles|, Quarantined, [ac36a5965049eb4bc204869f18eccd33]
PUP.Optional.SimpleFiles, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{CBCD9ED3-49BB-4434-B482-88B1B625AE42}, v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\SimpleFiles\downloader.exe|Name=SimpleFiles|, Quarantined, [e7fbf645009987af1aac968f7292e31d]
PUP.Optional.SimpleFiles, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{F9680846-22BD-4AA2-ADF7-973861EADAEE}, v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\SimpleFiles\downloader.exe|Name=SimpleFiles|, Quarantined, [a73b6ad1e7b25adc13b3b96cdb29a55b]

Registry Data: 0
(No malicious items detected)

Folders: 2
PUP.Optional.Yontoo, C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai\1.0.5856.35722_0, Quarantined, [c220f546c2d7dd5990b8776edd27827e],
PUP.Optional.Yontoo, C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai, Quarantined, [c220f546c2d7dd5990b8776edd27827e],

Files: 5
PUP.Optional.YourSites123.ShrtCln, C:\yoursites123.xml, Quarantined, [32b075c65c3d58de9843a828956d23dd],
PUP.Optional.Yontoo, C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai\1.0.5856.35722_0\manifest.json, Quarantined, [c220f546c2d7dd5990b8776edd27827e],
PUP.Optional.Yontoo, C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai\1.0.5856.35722_0\background.js, Quarantined, [c220f546c2d7dd5990b8776edd27827e],
PUP.Optional.Yontoo, C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai\1.0.5856.35722_0\content.js, Quarantined, [c220f546c2d7dd5990b8776edd27827e],
PUP.Optional.Yontoo, C:\Users\ilhan\AppData\Local\Google\Chrome\User Data\Default\Extensions\inlklghmabnjlpneflfnjgaablohgdai\1.0.5856.35722_0\icon.png, Quarantined, [c220f546c2d7dd5990b8776edd27827e],

Physical Sectors: 0
(No malicious items detected)

(end)

Супер..да това е ! Всичко засечено  е в карантина..Моля продължете със следващите стъпки..!

При стъпка 2 късно видях от къде да дам ignorе и може да съм изтстрила много неща, които бяха на Delite.

HitmanPro_20160120_1254.log

Всичко е наред..продължете напред..!

При стъпка 3 пуснах да се сканира втори път и на 90% ми забива компютъра и рестартирам. Изчаквам час преди да изключа, но нищо не се случва. Най-отгоре изписва  5 от 5. Първия път като спрях програмата на 90% ми изписа View Report и  кликнах, но после заби компа и изключих и включих и не видях да има някъде репорт. Докато сканираше програмата, Avast блокира някакъв троянец. Пак ще пробвам.

Emsisoft Emergency Kit - Version 10.0
Last update: 21/01/2016 01:10:32
User account: ilhan-PC\ilhan

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:    21/01/2016 01:12:49
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\PROTECTOR_DLL.PROTECTORBHO     detected: Application.AdReg (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\PROTECTOR_DLL.PROTECTORBHO.1     detected: Application.AdReg (A)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF10.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF12.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF11.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF13.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF15.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF18.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF17.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF19.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF14.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF20.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF2.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF16.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF22.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF21.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF23.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF24.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF25.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF26.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF27.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF28.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF29.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF31.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF32.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF30.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF34.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF33.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF4.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF5.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF7.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF6.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF8.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\Users\ilhan\AppData\Roaming\FirefoxToolbar\Settings Manager\smdmf\components\SmdmFHlpFF9.dll.vir     detected: Adware.Linkey.B (B)
C:\AdwCleaner\Quarantine\C\windows\SysNative\drivers\wfdrvr_vt_1_10_0_28.sys.vir.vir     detected: Application.Generic.1523066 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{024A726A-429E-404F-BC4C-F96C8B6AABF0}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{0E5093C6-A8CC-4935-AEE7-4FC1F3783FCF}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{090EA871-1DC1-44B0-ABD7-1BC514B7215A}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{3270C9AB-B74E-4F57-B863-E3A8FEC9B45E}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{1987CB53-0156-48F8-8049-349CD4760AF6}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{235A7A07-2D2F-48C5-A260-D67246F99291}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{4AE31F9C-9E9F-4A73-B973-CB0F130ED4B6}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{48E7FCE9-11CD-4B24-BA15-F1883B7012F5}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{5C5A47BC-0DCE-4FA1-ADA2-629FE0A66BEC}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{597A09D2-B184-4716-88B8-B9E04D685E75}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{56E70DAA-C2F8-4930-9402-5360190AA6C2}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{5D390E3B-5ED2-4216-9F26-CDCF0591D5A7}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{605022D6-BD9F-4358-80E7-288FF3A88DD4}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{6EE3D255-8E1B-4B1D-ADFD-9D745FC7CD51}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{67BD2D78-31B1-42C9-B1F6-205E4F92B140}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{8304AF1F-3F9E-46CA-95A4-8C2CBADCE41F}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{7FD25C3F-E342-4F66-B5BF-BE151F0FDF14}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{68F778D8-D61D-44B9-B21F-77747CE2FF44}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{88E708E6-4BE6-49F6-8537-6E08AE3E60C2}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{87DE1F8C-A978-4B22-9E24-A29A5D3CD9F7}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{8450AAFE-72A7-407D-91CA-D90EFEE95158}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{9226D738-AFFF-4248-8BD8-D2EB584684F6}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{8FF581AF-3655-4A82-B40B-F96BA513A50B}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{A5E81602-9FDE-4B71-A111-37C61D0B19BA}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{B338D7A9-8B98-4DE4-92A9-04EE412B479B}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{B6F370C3-68D0-4838-89E7-7ED219897AC3}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{A37FAB92-E177-4F75-A434-53F42C4CC5C8}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{C27C60A9-35C4-4D04-AF9D-4860E0A7C13C}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{C36A5BF0-F39E-4D14-A168-7F23C781EBC5}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{C55DB4C2-B05F-4967-9010-932BD80CCC3B}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{CE938DC9-DBA7-446F-AC84-A80DDC46D485}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{D1D79CE8-FBE3-4401-850C-61D1C42F2668}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{BB9A5C67-3B28-4033-BE0B-FB28D4172806}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{D853FD69-A659-4EFD-9CF1-811D6CE655E9}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{D8964245-B05F-405D-919D-B21BCFFE8103}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{DCCD87A9-2800-492C-AB5E-6CB281B5CE58}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{E6C0C464-2A4B-4E55-BD7E-6A5AF640E332}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{D0ED433F-1A10-4387-ABA8-5073A8269E0C}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{EB49C330-03EF-4FC4-A40C-AF473BCA9295}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{F8B6CDFD-B9D0-40DF-97D6-667F43B26DEE}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)
C:\FRST\Quarantine\C\Users\ilhan\AppData\Local\Temp\{E98445C2-260D-455B-A1A2-312A7747CE1B}.dll.xBAD     detected: Gen:Adware.BrowseFox.1 (B)

Scanned    159271
Found    76

Scan end:    21/01/2016 06:24:14
Scan time:    5:11:25

*** Scan aborted by user ***

Натиснах Stop при 90%, понеже седеше в това положение часове, изчаках доста да видя дали ще излезе да дам View report и ми даде този по-горе.

Здравейте..! С трета стъпка приключваме...там всичко е наред..! Остана само четвърта последна стъпка..! Очаквам резултата..!

SecurityCheck by glax24 & Severnyj v.1.4.0.34 [18.01.16]
WebSite: www.safezone.cc
DateLog: 21.01.2016 12:05:13
Path starting: C:\Users\ilhan\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: ilhan
VersionXML: 2.33i-20.01.2016
___________________________________________________________________________

Windows 7(6.1.7601) Service Pack 1 (x64) HomePremium Lang: English(0409)
Installation date OS: 01.02.2012 01:04:03
LicenseStatus: Windows(R) 7, HomePremium edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
SystemDrive: C: FS: [NTFS] Capacity: [178 Gb] Used: [56.4 Gb] Free: [121.6 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 10.0.9200.17089 Warning! Download Update
Online installation. Last version available when Windows update is enabled throught the Internet.
User Account Control enabled
Automatic Updates disabled
Date install updates: 2014-11-08 12:53:23
Windows Update (wuauserv) - The service is running
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
---------------------------- [ Antivirus_WMI ] ----------------------------
avast! Antivirus (enabled and up to date)
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (enabled and up to date)
avast! Antivirus (enabled and up to date)
---------------------- [ AntiVirusFirewallInstall ] -----------------------
Avast Free Antivirus v.10.2.2218
-------------------------- [ SecurityUtilities ] --------------------------
Malwarebytes Anti-Malware version 2.2.0.1024 v.2.2.0.1024
Trojan Remover 6.9.3 v.6.9.3
--------------------------- [ OtherUtilities ] ----------------------------
Microsoft Silverlight v.5.1.30514.0 Warning! Download Update
WinRAR 5.21 (32-bit) v.5.21.0 Warning! Download Update
--------------------------------- [ IM ] ----------------------------------
Skype Launcher v.1.6.5 Warning! Download Update
^Optional update.^
Skype™ 7.18 v.7.18.103 Warning! Download Update
^Optional update.^
--------------------------------- [ P2P ] ---------------------------------
µTorrent v.3.4.5.41372 Warning! P2P-client.
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 20 ActiveX v.20.0.0.286
Adobe Acrobat Reader DC v.15.010.20056
------------------------------- [ Browser ] -------------------------------
Google Chrome v.47.0.2526.111
Mozilla Firefox 43.0.4 (x86 bg) v.43.0.4
----------------------------- [ EmailClient ] -----------------------------
Windows Live Mail v.15.4.3502.0922
„Windows Live Mail“ v.15.4.3502.0922
Почта Windows Live v.15.4.3502.0922
--------------------------- [ RunningProcess ] ----------------------------
C:\Program Files (x86)\Mozilla Firefox\firefox.exe v.43.0.4.5848
C:\Program Files\AVAST Software\Avast\AvastSvc.exe v.10.2.2218.942
C:\Program Files\AVAST Software\Avast\AvastUI.exe v.10.2.2218.944
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe v.2.3.125.0
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe v.3.1.6.0
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe v.3.2.19.0
---------------------------- [ UnwantedApps ] -----------------------------
Google Toolbar for Internet Explorer v.1.0.0 << Hidden Warning! Browser's toolbar. It can slow down the working of your browser and have violation privacy problems.
Skype Click to Call v.8.0.0.9103 Warning! Browser's toolbar. It can slow down the working of your browser and have violation privacy problems.
----------------------------- [ End of Log ] ------------------------------

Когато ми се появиха вирусите на този компютър, постоянно прехвърлях с флашката си информация от този на другия ми компютър.

Но само този копютър показваше проблеми, на другия не му излизат реклами и не прави пренасочвания към други страници.

Може ли да е от антивирусната и на двата компютъра е различна. Aко другата е по-сигурна...

Отново чрез  програмата GeekUninstaller от списъка намерете и деинсталирайте:

Цитат

Google Toolbar for Internet Explorer v.1.0.0

Skype Click to Call v.8.0.0.9103

(примера е за Mozilla Firefox, но това е просто за показно).

Кликнете с десен бутон върху всяка от програмите и изберете Uninstall
 

След края на инсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи):

Пример за Mozilla браузъра:

Натиснете бутона Finish за да изтриете останките от програмата.

 

Обновете следния софтуер:

Цитат

Internet Explorer 10.0.9200.17089 Warning! Download Update

Microsoft Silverlight v.5.1.30514.0 Warning! Download Update
WinRAR 5.21 (32-bit) v.5.21.0 Warning! Download Update

Skype Launcher v.1.6.5 Warning! Download Update
^Optional update.^
Skype™ 7.18 v.7.18.103 Warning! Download Update
^Optional update.^

 

В общи линии компютъра ви вече е чист и аз не виждам проблеми от зловреден характер..!

 

Изтеглете DelFix и го стартирайте. Сложете отметка пред:

• Remove disinfection tools
• Purge system restore

 
..и след това натиснете бутона Run

• След като операцията е завърши,ще се създаде дневник
• Копирате го и го поставите в следващия си отговор

Инструмента ще се самоизтрие след като приключи своята задача!

Ако има нещо което използвахме в лечението до тук и не се е премахнало след последните инструкции го премахнете ръчно ,по стандартните методи..!

 

Препоръчвам програмата Malwarebytes' Anti-Malware да остане на вашия компютър и периодично да сканирате системата си с нея (поне един -два пъти в седмицата),като не забравяйте да обновите дефинициите и преди всяко сканиране..!Напомням че това не е антивирусна програма а едно изключително добро допълнение към нея..!

 

Относно флашката..:

стъпка 1:

Спрете Autorun функцията.
Изтеглете и стартирайте следния файл
Стартирайте го и се съгласете с лицензионното споразумение.
Натиснете Next и изчакайте да си свърши работата. Ако се наложи рестартирайте.

 

стъпка 2:

Изтеглете UsbFix и я запазете на десктопа.

Сложете  флашката в USB-то.
Стартирайте инструмента и натиснете бутона Clean.

Публикувайте лог файла в следващия си коментар и споделете как е положението след стъпките към момента!

 

Май трябва първо да си изтегля друг браузър, ще остана без, като изтрия моите.

Чакай..къде съм казал да триете браузери..!Картинката е само за да покажа как става...Не трийте никакви браузери...Много ви моля внимавайте...!

Чрез програмата изтрийте само това в карето:

Google Toolbar for Internet Explorer v.1.0.0

Skype Click to Call v.8.0.0.9103

 

ок

Добро утро!

# DelFix v1.011 - Logfile created 22/01/2016 at 08:03:11
# Updated 18/08/2015 by Xplode
# Username : ilhan - ILHAN-PC
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\SecurityCheck
Deleted : C:\log.txt
Deleted : C:\Users\ilhan\Desktop\Addition.txt
Deleted : C:\Users\ilhan\Desktop\AdwCleaner[C1].txt
Deleted : C:\Users\ilhan\Desktop\adwcleaner_5.030.exe
Deleted : C:\Users\ilhan\Desktop\Fixlog.txt
Deleted : C:\Users\ilhan\Desktop\FRST.txt
Deleted : C:\Users\ilhan\Desktop\FRST64.exe
Deleted : C:\Users\ilhan\Desktop\JRT.exe
Deleted : C:\Users\ilhan\Desktop\JRT.txt
Deleted : C:\Users\ilhan\Desktop\SecurityCheck.exe
Deleted : HKLM\SOFTWARE\AdwCleaner

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #228 [JRT Pre-Junkware Removal | 01/20/2016 00:18:02]
Deleted : RP #229 [Windows Update | 01/20/2016 05:06:41]
Deleted : RP #231 [Restore Point Created by FRST | 01/20/2016 07:46:54]
Deleted : RP #232 [Checkpoint by HitmanPro | 01/20/2016 10:20:21]
Deleted : RP #233 [Checkpoint by HitmanPro | 01/20/2016 10:35:07]
Deleted : RP #234 [Removed Skype Click to Call | 01/21/2016 12:23:03]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########