Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Get search тази настройка е наложена от администратора.

kosama86
в Премахване на зловреден софтуер

Featured Replies

Проблема е в това, че когато използвам браузъра Google Chrome, често автоматично се зарежда руска търсачка като последователно прехвърля през тези три сайта:(cosmosearch.ru, searchtds.ru, http://go.mail.ru/). Когато вляза в настройките на Chrome и се опитам да променя търсещата машина само Get Search не мога да променя, което е зададено. Прилагам снимка. Също така имам проблем с един файл който не мога да деинсталирам, според мен е свързан с този проблем. Ще прикача още две снимки да се види какво се показва когато се опитам да го деинсталирам. Това се сещам за сега. 

problem.JPG

problem2.JPG

problem3.JPG

Това излезе след сканиране.

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by Admin (2016-03-22 19:21:09)
Running from C:\Users\Admin\Desktop
Windows 7 Home Premium (X64) (2015-05-26 13:40:33)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Admin (S-1-5-21-2986554481-2461458600-4217044059-1000 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-2986554481-2461458600-4217044059-500 - Administrator - Disabled)
Guest (S-1-5-21-2986554481-2461458600-4217044059-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2986554481-2461458600-4217044059-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

> Chrome Search (HKLM-x32\...\{2AEF02C351594C81A6888D954F0DEE56}_NewSearch) (Version:  - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 21.0.0.182 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
GoPro App (x32 Version: 5.7.549 - GoPro, Inc.) Hidden
GoPro Studio 2.5.7 (HKLM-x32\...\{b996dca2-156c-4d2c-b9a3-59fac08cef33}) (Version: 2.5.7.549 - GoPro, Inc.)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
K-Lite Codec Pack 11.1.0 Full (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.1.0 - )
KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 3.9.1.136 - PandoraTV)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Mozilla Firefox 43.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 43.0.1 (x86 en-US)) (Version: 43.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 43.0.1.5828 - Mozilla)
NETGEAR WNA3100 wireless USB 2.0 adapter (HKLM-x32\...\{C2425F91-1F7B-4037-9A05-9F290184798D}) (Version: 2.2.0.2 - NETGEAR)
NVIDIA Graphics Driver 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.44 - NVIDIA Corporation)
NVIDIA Update 17.12.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 17.12.8 - NVIDIA Corporation)
qBittorrent 3.2.0 (HKLM-x32\...\qBittorrent) (Version: 3.2.0 - The qBittorrent project)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5919 - Realtek Semiconductor Corp.)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {169043AF-75DE-4EF7-9058-62562F36EA66} - System32\Tasks\UpdateTask => C:\Users\Admin\AppData\Local\{9009A~1\UNINST~1.EXE
Task: {26F3F9B6-FBF9-4B05-954B-ED0DB39F8695} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2015-04-15] ()
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {37C1F675-0E7A-4715-A8C4-DAD796AAC713} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-22] (Google Inc.)
Task: {4548B1B0-E0AB-4F7D-8728-0AEC5E0B5AAB} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\WatTask => C:\Windows Activation Technologies\wat.exe [2006-04-21] ()
Task: {7F4FB640-B854-4FB1-8163-E914F8807B0D} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {8C2C93ED-0AF8-43D5-B251-AB99B3D6E9DF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-03-22] (Google Inc.)
Task: {994C86AD-A929-4B2C-88A0-4E25A107A029} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe
Task: {A6AF9377-77CE-47AB-AD7D-EC32CAD0C82D} - System32\Tasks\Microsoft\Windows\Location\Notifications => C:\Windows\System32\LocationNotificationWindows.exe
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {B261B452-3F35-471B-AB31-656016E66F55} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)
Task: {BBCB7A3D-C9BD-4C7F-AD4B-5E49DE2C0A6E} - System32\Tasks\{C7183A55-8897-4B4F-8D7F-180E45327495} => pcalua.exe -a C:\Users\Admin\Desktop\Audio_Win7-64_Win7_RV\Win7-64_Win7\Setup.exe -d C:\Users\Admin\Desktop\Audio_Win7-64_Win7_RV\Win7-64_Win7
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {D39132F1-C3E9-4C4F-88E3-999C9F8DFD33} - System32\Tasks\{E4DB7759-180F-D5B1-7095-93578238E268} => C:\Windows\system32\regsvr32.exe [2009-07-14] (Microsoft Corporation)
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\UpdateTask.job => C:\Users\Admin\AppData\Local\{9009A~1\UNINST~1.EXE

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-05-26 14:54 - 2015-02-04 03:21 - 00115400 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-10-22 19:06 - 2013-11-11 13:10 - 00307928 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
2015-10-22 19:06 - 2013-11-22 17:34 - 08266456 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
2015-10-22 19:06 - 2013-10-30 17:06 - 00380928 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiLib.dll
2016-01-11 10:36 - 2016-01-11 10:36 - 00932032 ____R () C:\Program Files (x86)\Skype\Phone\ssScreenVVS2.dll
2015-10-22 19:06 - 2013-11-01 15:31 - 00278528 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvcLib.dll
2015-10-02 23:15 - 2015-10-02 23:15 - 02287616 _____ () C:\Program Files (x86)\GoPro\Tools\Importer\gopro-lib-win-analytics.dll
2016-03-22 17:53 - 2016-03-08 03:48 - 01676440 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.87\libglesv2.dll
2016-03-22 17:53 - 2016-03-08 03:48 - 00086168 _____ () C:\Program Files (x86)\Google\Chrome\Application\49.0.2623.87\libegl.dll
2016-03-12 10:45 - 2016-03-08 12:16 - 17541312 _____ () C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PepperFlash\21.0.0.182\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.8.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{A0191EF7-4EF9-4EEA-9B93-94BFF7977E04}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7F4211E4-5E0A-4C29-8EF6-AC657C4343EC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{04E81FD6-DAEB-424C-8939-FD42CCA38B88}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{93FC34DE-52A3-4FE5-AA21-8F6DEAC29CAD}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{87167BEC-EC17-4608-8BF7-8F1E7C3F474A}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{59A88D20-774E-4BBD-B60A-64174793C293}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{4A94A4B1-28E7-432C-9799-A69ADFB44E90}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{48AB4F22-1A3E-4F68-A48E-A849CF84C5E7}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{8B3DC770-EA4F-4F9E-ADDE-EEB7E51C5E26}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{7137B698-F9E4-4266-A912-16BEA5C9F521}C:\program files (x86)\qbittorrent\qbittorrent.exe] => (Block) C:\program files (x86)\qbittorrent\qbittorrent.exe
FirewallRules: [UDP Query User{62DEA601-ADC5-4EE4-8FE9-97380B02984E}C:\program files (x86)\qbittorrent\qbittorrent.exe] => (Block) C:\program files (x86)\qbittorrent\qbittorrent.exe
FirewallRules: [TCP Query User{3562C10B-BAAA-486B-8E63-7B3260229848}C:\program files\bitcoin\bitcoin-qt.exe] => (Allow) C:\program files\bitcoin\bitcoin-qt.exe
FirewallRules: [UDP Query User{8A448605-5CE5-4356-AF8A-49E36BB68455}C:\program files\bitcoin\bitcoin-qt.exe] => (Allow) C:\program files\bitcoin\bitcoin-qt.exe
FirewallRules: [{C3FD9EB8-4D08-42E9-ACB1-2F44ACD01666}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B7AB575E-8F0A-4069-95B4-93453F35BDF4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9C95403A-A50A-4CF9-9AC6-D5787169026E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{4C7F925A-1C27-4204-8D6D-B2D3093450E4}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2EE2A638-DF2F-4032-976E-EE5DA06DD590}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{B2DD065F-460E-4E2B-A40D-3940BA7B817C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

21-03-2016 21:28:17 Removed Apple Mobile Device Support
21-03-2016 21:30:13 Removed Apple Software Update
22-03-2016 17:45:31 Removed Google Chrome

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/21/2016 10:01:59 PM) (Source: Winlogon) (EventID: 4103) (User: )
Description: Активирането на лиценза за Windows е неуспешно. Грешка 0x00000000.

Error: (03/21/2016 09:29:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: AppleMobileDeviceService.exe, версия: 17.364.0.34, времево клеймо: 0x54dd6d21
Име на модул с грешки: AppleMobileDeviceService_main.dll, версия: 17.364.0.34, времево клеймо: 0x5615652b
Код на изключение: 0xc0000005
Отместване на грешка: 0x000000000000fbf2
ИД на процес на грешка: 0x6c8
Начален час на приложението с грешки: 0xAppleMobileDeviceService.exe0
Път на приложението с грешки: AppleMobileDeviceService.exe1
Път на модула с грешки: AppleMobileDeviceService.exe2
ИД на доклад: AppleMobileDeviceService.exe3

Error: (03/20/2016 07:42:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 17703

Error: (03/20/2016 07:42:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 17703

Error: (03/20/2016 07:42:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/20/2016 07:40:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7781

Error: (03/20/2016 07:40:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7781

Error: (03/20/2016 07:40:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (03/20/2016 07:36:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7766

Error: (03/20/2016 07:36:38 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7766


System errors:
=============
Error: (03/22/2016 05:28:39 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Error: (03/22/2016 05:28:47 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 2:42:04 PM on ‎3/‎22/‎2016 was unexpected.

Error: (03/22/2016 02:35:04 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Error: (03/21/2016 10:04:15 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Error: (03/21/2016 10:01:30 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Error: (03/21/2016 06:28:24 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Error: (03/20/2016 06:26:45 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.

Error: (03/20/2016 06:26:58 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000000a (0x0000000000000000, 0x0000000000000002, 0x0000000000000001, 0xfffff800030939ec)C:\Windows\MEMORY.DMP032016-15359-01

Error: (03/20/2016 06:26:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 6:25:00 PM on ‎3/‎20/‎2016 was unexpected.

Error: (03/20/2016 06:12:00 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.


CodeIntegrity:
===================================
  Date: 2016-03-22 19:19:56.853
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-22 19:13:13.166
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-22 19:06:01.958
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-22 18:54:42.386
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-22 17:28:50.750
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-22 14:35:17.640
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-21 22:04:27.500
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-21 18:28:40.765
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-20 23:11:22.297
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.

  Date: 2016-03-20 20:51:14.723
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\user32.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz
Percentage of memory in use: 72%
Total physical RAM: 2047.3 MB
Available physical RAM: 569.74 MB
Total Virtual: 4094.61 MB
Available Virtual: 1889.06 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:68.26 GB) (Free:24.38 GB) NTFS
Drive d: () (Fixed) (Total:397.4 GB) (Free:278.93 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 354226CB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=68.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=397.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Addition.txt

  • Автор

Качвам го като мнение и прикачен файл, да не объркам пак нещо.

Благодаря.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Admin (administrator) on ADMIN-PC (22-03-2016 19:20:18)
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available Profiles: Admin)
Platform: Windows 7 Home Premium (X64) Language: Български (България)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(GoPro) C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_21_0_0_182_ActiveX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-29] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8067616 2009-08-18] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation)
HKLM-x32\...\Run: [GoPro Studio Importer] => C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe [3218184 2015-10-02] (GoPro)
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\...\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [874136 2016-03-08] (Google Inc.)
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\...\MountPoints2: {60e91189-4db9-11e5-a2b9-00252220ad23} - E:\windows\Install\Install.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100 Genie.lnk [2015-10-22]
ShortcutTarget: NETGEAR WNA3100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe ()
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\Parameters: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{0B0197EF-EC8F-4349-AD86-AFB96ACD0B18}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{19B715F9-DC88-4A69-BCE0-55E02D60AAE9}: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{2AA51617-F9F8-4AA7-9A3D-FC7615428570}: [DhcpNameServer] 82.163.143.171

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://at.search.yahoo.com/yhs/web?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://at.search.yahoo.com/yhs/web?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://at.search.yahoo.com/yhs/web?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
URLSearchHook: [S-1-5-21-2986554481-2461458600-4217044059-1000] ATTENTION => Default URLSearchHook is missing
URLSearchHook: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 - (No Name) - {0633EE93-D776-472f-A0FF-E1416B8B2E3D} - No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://at.search.yahoo.com/yhs/search?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://at.search.yahoo.com/yhs/search?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {73cd434e-8e1e-46b6-bb8d-7dd935140717} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-01a12b43&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3D} URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q=
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> {73cd434e-8e1e-46b6-bb8d-7dd935140717} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-01a12b43&q={searchTerms}
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
DPF: HKLM-x32 {A996E48C-D3DC-4244-89F7-AFA33EC60679} hxxps://online.bulbank.bg/capicom.cab
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-12-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-12-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-12-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-12-21] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default
FF NewTab: hxxp://www.yoursearching.com/newtab/?type=nt&ts=1456664338&z=293285dea68ed478e7bf25fg5zbw0qcqdq0z7c4ceb&from=itr&uid=wdcxwd5000aakx-00erma0_wd-wmc2e617105771057
FF DefaultSearchEngine: yoursearching
FF SelectedSearchEngine: Search Provided by Yahoo
FF Homepage: hxxp://www.yoursearching.com/?type=hp&ts=1456664338&z=293285dea68ed478e7bf25fg5zbw0qcqdq0z7c4ceb&from=itr&uid=wdcxwd5000aakx-00erma0_wd-wmc2e617105771057
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-22] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-22] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\Search Provided by Bing.xml [2016-02-24]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\Search Provided by Yahoo.xml [2016-02-27]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\yoursearching.xml [2016-02-28]
FF Extension: Youtube Mp3 Downloader - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\Extensions\[email protected] [2015-11-08]
FF Extension: FirefixTab - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\Extensions\[email protected] [2016-02-28] [not signed]
FF Extension: Video DownloadHelper - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-11-08]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Telering\InternetManager_Z\Bin\addon => not found
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\extensions\[email protected]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Презентации) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-27]
CHR Extension: (Google Документи) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-27]
CHR Extension: (Google Диск) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Търсене) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (АБВ Уведомител) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpbekonjicgkldkmopnamgglbfaiojje [2015-11-20]
CHR Extension: (Електронни таблици от Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-27]
CHR Extension: (Google Документи офлайн) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (AdBlock) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-03-21]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-31]
CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-27]
CHR HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bahkljhhdeciiaodlkppoonappfnheoi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bahkljhhdeciiaodlkppoonappfnheoi] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-29] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-29] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WSWNA3100; C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [307928 2013-11-11] ()
S3 EWSASERV; "C:\Program Files (x86)\Elcomsoft Password Recovery\Elcomsoft Wireless Security Auditor\ewsaserv64.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 int0800; C:\Windows\System32\DRIVERS\flashud.sys [51712 2009-09-09] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 NPF; C:\Windows\System32\DRIVERS\npf.sys [47632 2010-02-03] (CACE Technologies, Inc.)
R3 Serenum; C:\Windows\System32\DRIVERS\nuvserenum.sys [23552 2014-01-12] (Windows (R) Win 7 DDK provider)
R3 Serial; C:\Windows\System32\DRIVERS\nuvserial.sys [86016 2014-01-12] (Nuvoton Technology Corp.)
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-11-02] (ZTE) [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-22 19:20 - 2016-03-22 19:20 - 00017250 _____ C:\Users\Admin\Desktop\FRST.txt
2016-03-22 19:20 - 2016-03-22 19:20 - 00000000 ____D C:\FRST
2016-03-22 18:54 - 2016-03-22 18:55 - 02374144 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2016-03-22 17:53 - 2016-03-22 18:58 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-22 17:53 - 2016-03-22 17:58 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-22 17:53 - 2016-03-22 17:53 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-03-22 17:53 - 2016-03-22 17:53 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-03-22 17:53 - 2016-03-22 17:53 - 00002263 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-22 17:53 - 2016-03-22 17:53 - 00002251 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-22 17:52 - 2016-03-22 17:52 - 00987728 _____ (Google Inc.) C:\Users\Admin\Downloads\ChromeSetup.exe
2016-03-21 22:03 - 2011-01-16 01:01 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-03-21 22:03 - 2011-01-16 01:01 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2016-03-21 22:03 - 2010-11-19 21:21 - 00410112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\systemcpl.dll
2016-03-21 22:03 - 2010-11-19 21:21 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2016-03-21 22:03 - 2010-11-19 21:08 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-03-21 22:03 - 2009-07-14 02:39 - 00013312 _____ C:\Windows\system32\winver.exe
2016-03-21 22:03 - 2009-07-14 02:16 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppwmi.dll
2016-03-21 22:03 - 2009-07-14 02:14 - 00012288 _____ C:\Windows\SysWOW64\winver.exe
2016-03-21 19:10 - 2016-03-21 21:33 - 00000000 ____D C:\OutputFolder
2016-03-21 19:00 - 2016-03-21 19:00 - 10550447 _____ (Aone Software ) C:\Users\Admin\Downloads\uvjoiner.exe
2016-03-20 18:26 - 2016-03-20 18:26 - 00288888 _____ C:\Windows\Minidump\032016-15359-01.dmp
2016-03-20 18:15 - 2016-03-20 22:27 - 00000000 ____D C:\Users\Admin\Desktop\MesseSlbrg
2016-03-19 22:02 - 2016-03-19 22:02 - 00000000 ____D C:\ProgramData\57939570-67d7-0
2016-03-19 21:57 - 2016-03-19 21:57 - 00003728 _____ C:\Windows\System32\Tasks\{E4DB7759-180F-D5B1-7095-93578238E268}
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\57939570-11f3-0
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\44ba3e6e
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\{293b6a3f-412c-1}
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\{08b4e79a-012c-0}
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\{086b2c63-212c-0}
2016-03-16 17:58 - 2016-03-20 18:26 - 287570610 _____ C:\Windows\MEMORY.DMP
2016-03-16 17:58 - 2016-03-20 18:26 - 00000000 ____D C:\Windows\Minidump
2016-03-16 17:58 - 2016-03-16 17:59 - 00852184 _____ C:\Windows\Minidump\031616-15062-01.dmp
2016-03-16 08:30 - 2016-03-19 09:21 - 00000000 ____D C:\Users\Admin\Desktop\Nexus
2016-03-12 10:59 - 2016-03-12 11:00 - 00000000 ____D C:\Users\Admin\Desktop\Iva
2016-03-12 10:58 - 2016-03-12 10:58 - 00000000 ____D C:\Users\Admin\Desktop\VikiVideo
2016-03-12 10:58 - 2016-03-12 10:58 - 00000000 ____D C:\Users\Admin\Desktop\kopi docu
2016-03-06 20:28 - 2016-03-06 20:29 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Apple Computer
2016-03-06 20:28 - 2016-03-06 20:28 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-03-06 20:28 - 2016-03-06 20:28 - 00000000 ____D C:\Users\Admin\AppData\Local\Apple Computer
2016-03-06 20:28 - 2016-03-06 20:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-03-06 20:27 - 2016-03-06 20:28 - 00000000 ____D C:\Program Files\iTunes
2016-03-06 20:27 - 2016-03-06 20:27 - 00000000 ____D C:\ProgramData\Apple Computer
2016-03-06 20:27 - 2016-03-06 20:27 - 00000000 ____D C:\Program Files\iPod
2016-03-06 20:27 - 2016-03-06 20:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2016-03-06 20:26 - 2016-03-06 20:26 - 00000000 ____D C:\Users\Admin\AppData\Local\Apple
2016-03-06 20:25 - 2016-03-21 21:29 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-03-06 20:25 - 2016-03-06 20:25 - 00000000 ____D C:\Program Files\Bonjour
2016-03-06 20:25 - 2016-03-06 20:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2016-03-06 20:24 - 2016-03-06 20:26 - 00000000 ____D C:\ProgramData\Apple
2016-03-06 19:56 - 2016-03-06 20:19 - 167839512 _____ (Apple Inc.) C:\Users\Admin\Downloads\iTunes6464Setup_12-3-1.exe
2016-03-06 17:01 - 2016-03-06 17:23 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Bitcoin
2016-03-06 16:52 - 2016-03-06 16:54 - 13567200 _____ (Bitcoin Core project) C:\Users\Admin\Downloads\bitcoin-0.12.0-win64-setup.exe
2016-03-03 10:35 - 2016-03-03 10:35 - 00000000 ____D C:\Users\Admin\Downloads\firmware
2016-03-03 10:19 - 2016-03-03 11:42 - 00000000 ____D C:\Users\Admin\Desktop\Hangar 7
2016-02-28 19:42 - 2016-03-22 19:15 - 00000129 _____ C:\Windows\SysWOW64\L
2016-02-28 13:58 - 2016-02-28 13:58 - 00957440 _____ C:\Windows\SysWOW64\SearchProtectService.exe
2016-02-28 13:58 - 2016-02-28 13:58 - 00000008 __RSH C:\Users\Admin\ntuser.pol
2016-02-28 12:12 - 2016-02-28 12:12 - 00000000 ____D C:\Program Files\SAMSUNG
2016-02-28 12:11 - 2016-02-28 12:11 - 00000000 ____D C:\ProgramData\Samsung
2016-02-27 20:54 - 2016-02-27 21:48 - 00000000 ____D C:\Program Files (x86)\Elcomsoft Password Recovery
2016-02-27 20:50 - 2016-02-27 20:52 - 14184448 _____ C:\Users\Admin\Downloads\ewsa_setup_en.msi
2016-02-27 20:28 - 2016-03-19 21:58 - 00000000 ____D C:\ProgramData\f2857d71-40e1-0
2016-02-27 20:28 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\f2857d71-3443-1
2016-02-27 20:28 - 2016-02-27 20:28 - 00003984 _____ C:\Windows\System32\Tasks\LaunchPreSignup
2016-02-27 20:25 - 2016-02-27 20:26 - 01035056 _____ (Software Web ) C:\Users\Admin\Downloads\wifi_password_decryptor.exe
2016-02-25 19:25 - 2016-02-25 19:25 - 00151120 _____ C:\Users\Admin\Downloads\game_of_thrones_-_season_5_-_afgsubsunacs.net(subsunacs.net).zip
2016-02-24 22:20 - 2016-02-24 22:28 - 00000000 ____D C:\Users\Admin\AppData\Roaming\GoPro
2016-02-24 22:20 - 2016-02-24 22:20 - 00000000 ____D C:\Users\Admin\AppData\Local\GoPro
2016-02-24 22:19 - 2016-02-24 22:23 - 00000000 ____D C:\Users\Public\CineForm
2016-02-24 22:18 - 2016-02-24 22:18 - 00000810 _____ C:\Users\Public\Desktop\GoPro Studio.lnk
2016-02-24 22:18 - 2016-02-24 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoPro
2016-02-24 22:18 - 2016-02-24 22:18 - 00000000 ____D C:\Program Files (x86)\GoPro
2016-02-24 22:18 - 2016-02-24 22:18 - 00000000 ____D C:\Program Files (x86)\CineForm
2016-02-24 19:08 - 2016-02-24 19:08 - 00749404 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-02-24 19:04 - 2009-11-25 11:47 - 01942856 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 01130824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe
2016-02-24 19:04 - 2009-11-25 11:47 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe
2016-02-24 19:04 - 2009-11-25 11:47 - 00109912 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 00049472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll
2016-02-24 19:04 - 2009-11-25 11:47 - 00048960 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll
2016-02-24 19:03 - 2016-02-24 22:19 - 00000000 ____D C:\ProgramData\Package Cache
2016-02-24 18:53 - 2016-02-24 19:02 - 121291664 _____ (GoPro, Inc.) C:\Users\Admin\Downloads\GoProStudioPC-2.5.7.549.exe
2016-02-24 18:34 - 2016-02-26 18:30 - 00000101 _____ C:\Users\Admin\AppData\Roaming\WB.CFG
2016-02-24 17:40 - 2016-02-24 17:40 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Opera Software
2016-02-24 17:40 - 2016-02-24 17:40 - 00000000 ____D C:\Users\Admin\AppData\Local\Opera Software
2016-02-24 17:36 - 2016-02-28 19:43 - 00001870 _____ C:\Users\Admin\Desktop\Facebook.lnk
2016-02-24 17:36 - 2016-02-24 17:36 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Shortcut
2016-02-24 17:34 - 2016-03-22 19:15 - 00000290 __RSH C:\ProgramData\ntuser.pol
2016-02-24 17:34 - 2016-03-22 18:28 - 00000270 _____ C:\Windows\Tasks\UpdateTask.job
2016-02-24 17:34 - 2016-02-27 20:28 - 00003210 _____ C:\Windows\System32\Tasks\UpdateTask
2016-02-24 17:34 - 2016-02-24 17:34 - 00000000 ____D C:\Users\Admin\AppData\Local\Setup22276468
2016-02-24 17:33 - 2016-02-24 17:43 - 00000000 ____D C:\Program Files (x86)\Opera
2016-02-24 17:33 - 2016-02-24 17:34 - 00000000 ____D C:\Users\Admin\AppData\Local\cito

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-22 19:16 - 2015-05-27 09:08 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2016-03-22 19:09 - 2009-07-14 05:45 - 00018880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-22 19:09 - 2009-07-14 05:45 - 00018880 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-22 17:53 - 2015-05-27 08:07 - 00000000 ____D C:\Program Files (x86)\Google
2016-03-22 17:28 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-21 22:03 - 2015-05-27 08:10 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-21 22:03 - 2015-05-27 08:10 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-21 21:31 - 2015-05-27 08:08 - 00000000 ____D C:\Program Files (x86)\Winamp
2016-03-21 21:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-03-16 18:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2016-03-16 08:40 - 2009-07-14 06:13 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-09 14:07 - 2015-05-27 08:09 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-03 10:26 - 2016-02-20 19:25 - 00000000 ____D C:\Users\Admin\Desktop\slz
2016-02-28 20:58 - 2016-02-13 10:29 - 00000075 _____ C:\Users\Admin\Desktop\T.txt
2016-02-28 19:43 - 2015-05-27 08:06 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-28 19:43 - 2015-05-27 08:06 - 00001151 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-02-28 19:43 - 2015-05-26 14:41 - 00001431 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-28 19:43 - 2015-05-26 14:41 - 00001409 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-02-28 19:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2016-02-28 13:58 - 2015-05-26 14:40 - 00000000 ____D C:\Users\Admin
2016-02-28 13:58 - 2009-07-14 04:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-02-24 22:21 - 2015-09-04 19:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\NVIDIA

==================== Files in the root of some directories =======

2016-02-24 18:34 - 2016-02-26 18:30 - 0000101 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe
[2016-03-21 22:03] - [2011-01-16 01:01] - 0389632 ____A (Microsoft Corporation) 81257415084B84F3C0D95C381A8D4C8F

C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2016-03-21 22:03] - [2011-01-16 01:01] - 1008640 ____A (Microsoft Corporation) 0B864E15A0BADFF0E7BB8B59009FDDCF

C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-12-30 09:11

==================== End of FRST.txt ============================

FRST.txt

Изтеглете edit-text.giffixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете как е положението.

  • Автор

Фикс файлът трябва да е това.

За сега Google Chrome не се стратира.

Fix result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by Admin (2016-03-23 17:30:21) Run:1
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available Profiles: Admin)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
Task: {169043AF-75DE-4EF7-9058-62562F36EA66} - System32\Tasks\UpdateTask => C:\Users\Admin\AppData\Local\{9009A~1\UNINST~1.EXE
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {7F4FB640-B854-4FB1-8163-E914F8807B0D} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {BBCB7A3D-C9BD-4C7F-AD4B-5E49DE2C0A6E} - System32\Tasks\{C7183A55-8897-4B4F-8D7F-180E45327495} => pcalua.exe -a C:\Users\Admin\Desktop\Audio_Win7-64_Win7_RV\Win7-64_Win7\Setup.exe -d C:\Users\Admin\Desktop\Audio_Win7-64_Win7_RV\Win7-64_Win7
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
Task: C:\Windows\Tasks\UpdateTask.job => C:\Users\Admin\AppData\Local\{9009A~1\UNINST~1.EXE
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://at.search.yahoo.com/yhs/web?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://at.search.yahoo.com/yhs/web?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://at.search.yahoo.com/yhs/web?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
URLSearchHook: [S-1-5-21-2986554481-2461458600-4217044059-1000] ATTENTION => Default URLSearchHook is missing
URLSearchHook: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 - (No Name) - {0633EE93-D776-472f-A0FF-E1416B8B2E3D} - No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://at.search.yahoo.com/yhs/search?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://at.search.yahoo.com/yhs/search?hspart=itm&hsimp=yhs-001&type=jmb_dnldastr_16_08&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dat%26pa%3DJoomborio%26cd%3D2XzuyEtN2Y1L1Qzu0AyEtB0Bzz0C0Ezz0BtByByBtByE0D0DtN0D0Tzu0StCyDtCzztN1L2XzutAtFtCyBtFtCtCtFyCtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2SyE0FtA0Azy0C0E0FtGtA0AyEyDtGyDtAtCyEtGyC0BzytCtGyBzzyEtByBzy0FyCtByByDtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0F0ByC0FyB0B0ByDtGyEyDzztCtGyEyB0F0DtGzy0B0D0DtGtA0D0F0DzztA0EtC0EzytB0C2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCyDzyyE%26cr%3D1167369789%26a%3Djmb_dnldastr_16_08%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {73cd434e-8e1e-46b6-bb8d-7dd935140717} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-01a12b43&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3D} URL = hxxp://cosmosearch.ru/?ri=1&rsid=46fab523044e7d781ea635d129c67220&q=
SearchScopes: HKU\S-1-5-21-2986554481-2461458600-4217044059-1000 -> {73cd434e-8e1e-46b6-bb8d-7dd935140717} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-01a12b43&q={searchTerms}
FF NewTab: hxxp://www.yoursearching.com/newtab/?type=nt&ts=1456664338&z=293285dea68ed478e7bf25fg5zbw0qcqdq0z7c4ceb&from=itr&uid=wdcxwd5000aakx-00erma0_wd-wmc2e617105771057
FF DefaultSearchEngine: yoursearching
FF SelectedSearchEngine: Search Provided by Yahoo
FF Homepage: hxxp://www.yoursearching.com/?type=hp&ts=1456664338&z=293285dea68ed478e7bf25fg5zbw0qcqdq0z7c4ceb&from=itr&uid=wdcxwd5000aakx-00erma0_wd-wmc2e617105771057
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\Search Provided by Bing.xml [2016-02-24]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\Search Provided by Yahoo.xml [2016-02-27]
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\yoursearching.xml [2016-02-28]
FF Extension: FirefixTab - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\Extensions\[email protected] [2016-02-28] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Telering\InternetManager_Z\Bin\addon => not found
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\extensions\[email protected]
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
2016-03-19 22:02 - 2016-03-19 22:02 - 00000000 ____D C:\ProgramData\57939570-67d7-0
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\57939570-11f3-0
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\44ba3e6e
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\{293b6a3f-412c-1}
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\{08b4e79a-012c-0}
2016-03-19 21:57 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\{086b2c63-212c-0}
2016-02-28 13:58 - 2016-02-28 13:58 - 00957440 _____ C:\Windows\SysWOW64\SearchProtectService.exe
2016-02-27 20:28 - 2016-03-19 21:58 - 00000000 ____D C:\ProgramData\f2857d71-40e1-0
2016-02-27 20:28 - 2016-03-19 21:57 - 00000000 ____D C:\ProgramData\f2857d71-3443-1
File: C:\Windows\SysWOW64\L
Hosts:
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{169043AF-75DE-4EF7-9058-62562F36EA66}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{169043AF-75DE-4EF7-9058-62562F36EA66}" => key removed successfully
C:\Windows\System32\Tasks\UpdateTask => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UpdateTask" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsBackup\ConfigNotification" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7F4FB640-B854-4FB1-8163-E914F8807B0D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7F4FB640-B854-4FB1-8163-E914F8807B0D}" => key removed successfully
C:\Windows\System32\Tasks\LaunchPreSignup => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchPreSignup" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\AitAgent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BBCB7A3D-C9BD-4C7F-AD4B-5E49DE2C0A6E}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BBCB7A3D-C9BD-4C7F-AD4B-5E49DE2C0A6E}" => key removed successfully
C:\Windows\System32\Tasks\{C7183A55-8897-4B4F-8D7F-180E45327495} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C7183A55-8897-4B4F-8D7F-180E45327495}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\CorruptionDetector" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector" => key removed successfully
C:\Windows\Tasks\UpdateTask.job => moved successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
Could not restore Default URLSearchHook.
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{0633EE93-D776-472f-A0FF-E1416B8B2E3D} => value removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{73cd434e-8e1e-46b6-bb8d-7dd935140717}" => key removed successfully
HKCR\CLSID\{73cd434e-8e1e-46b6-bb8d-7dd935140717} => key not found.
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3C}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3C} => key not found.
"HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3D}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3D} => key not found.
"HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{73cd434e-8e1e-46b6-bb8d-7dd935140717}" => key removed successfully
HKCR\CLSID\{73cd434e-8e1e-46b6-bb8d-7dd935140717} => key not found.
Firefox "newtab" removed successfully
Firefox DefaultSearchEngine removed successfully
Firefox SelectedSearchEngine removed successfully
Firefox "homepage" removed successfully
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\Search Provided by Bing.xml => moved successfully
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\Search Provided by Yahoo.xml => moved successfully
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\searchplugins\yoursearching.xml => moved successfully
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfvqqjxi.default\Extensions\[email protected] => moved successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\[email protected] => value removed successfully
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSuggestURL => removed successfully
C:\ProgramData\57939570-67d7-0 => moved successfully
C:\ProgramData\57939570-11f3-0 => moved successfully
C:\ProgramData\44ba3e6e => moved successfully
C:\ProgramData\{293b6a3f-412c-1} => moved successfully
C:\ProgramData\{08b4e79a-012c-0} => moved successfully
C:\ProgramData\{086b2c63-212c-0} => moved successfully
C:\Windows\SysWOW64\SearchProtectService.exe => moved successfully
C:\ProgramData\f2857d71-40e1-0 => moved successfully
C:\ProgramData\f2857d71-3443-1 => moved successfully

========================= File: C:\Windows\SysWOW64\L ========================

File not signed
MD5: 63F0D99693F87A8CABE956D8A6A6CAF5
Creation and modification date: 2016-02-28 19:42 - 2016-03-22 19:15
Size: 0000129
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========  bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7600 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

{5D0D2371-01AD-45DD-8E57-74577392EBB8} canceled.
{52F57968-0DF0-433F-AB50-71D4985C38AC} canceled.
{A067C080-2AE5-4167-99CE-410EA3D4AA59} canceled.
{50477E0C-45CB-46AA-8C12-D9F964048F37} canceled.
{C7C858F5-53E3-4E22-84B9-97139961FE58} canceled.
{F660F63C-9FAA-4B5A-B27B-749ED6B02E48} canceled.
6 out of 6 jobs canceled.

========= End of CMD: =========


=========  netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2986554481-2461458600-4217044059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========

EmptyTemp: => 6.3 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 17:31:39 ====

преди 5 часа, kosama86 написа:

Фикс файлът трябва да е това.

За сега Google Chrome не се стратира.

Не ви разбрах? Кое не се стартира? Аз очаквах да споделите кои от проблемите за които говорихте в първия ви пост са все още налице...

  • Автор

Исках да напиша, че Google Chrome  браузърът не можеше да се стартира, но сега като се прибрах от работа и включих компютъра всичко си беше наред.

Проблемът със търсачката изчезна, сега вече е друга работа. Благодаря много.

Другото което остана файлът който не мога да деинсталирам Chrome Search. Излиза съобщение че услугата не е инсталирана. А и не знам дали изобщо трябва да го пипам този файл(програма).

Пробвайте да го премахнете с GeekUninstaller

Изтеглете програмата GeekUninstaller и я запазете на десктопа.

Разархивирайте я и стартирайте файла geek.exe IxXO5oO.jpg
От списъка намерете Chrome Search (примера е за Mozilla Firefox, но това е просто за пример, не деинсталирайте Mozilla).

Кликнете с десен бутон върху програмата и изберете Uninstall
 
XhV2QLa.png

След края на инсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи):

Пример за Mozilla браузъра:

geekuninstaller-3.png

Натиснете бутона Finish за да изтриете останките от програмата.

Ако не се получи с Uninstall, пробвайте с Force Removal или Remove Entry.

Aко не стане направете следното:

Въведете в Start Menu на Windows CMD.exe => кликнете с десен бутон върху CMD.exe и изберете Run as administrator => в конзолата с десен бутон Copy копирайте следната команда и с десен бутон Paste в CMD.exe поставете командата в конзолата и натиснете Enter:

reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2AEF02C351594C81A6888D954F0DEE56}_NewSearch" /f

Сега копирайте следната команда и отново натиснете Enter след нея:

reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{2AEF02C351594C81A6888D954F0DEE56}_NewSearch" /f

Би трябвало вече да е изчезнала от списъка с инсталираните програми.

Ако всичко е наред ето малко финални препоръки:

1. За да почистим използваните от нас инструменти направете следното:

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и Purge system restore (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

Ако има папки, които не са се изтрили след гореспоменатите процедури пишете и ще ги премахнем ръчно.

2. Проверете за стари приложения с помощта на PatchMyPC или с програмата Secunia Personal Software Inspector.

3. Инсталирайте Unchecky за да се предпазите от адуер по време на инсталацията на даден софтуер.

4. За защита от криптовирусите, освен обновяване на ОС и антивирусната програма е добре да имунизирате системата си с CryptoPrevent и профила Maximum Protection: (Не използвайте последната опция, защото още е бъгава и не работи коректно).

mtBkCIZ.jpg

Ако имате проблеми с инсталацията на програми след използването на CryptoPrevent вижте следните съвети

както и тези

Не забравяйте да изключите и Autorun в Windows, защото криптовирусите могат да се настанят и на външните дискове и флашки и да заразят информацията на тези носители при свързването им с инфектирана система и след това да заразят и други системи при свързването на външните дискове към други компютри (и така да го предадете и на тях). Microsoft са създали автоматичен инструмент за целта => MSFixIt. Добре е също така след като вкарате външния диск дори и при спрян Autorun просто да сканирате буквата на устройството с обновена антивирусна програма преди да започнете да прехвърляте данни от и към външния диск.

Има и други програми, но са главно за напреднали потребители и няма да се спирам много задълбочено на тях, защото са сравнително по-сложни за употреба на средностатистическите потребители.. Затова ще ги пропусна. Добре е да не се спира System Restore (и File History в Windows 8), да не се спира UAC - User Account Control (даже да се направи на максималното ниво на защита), да не се спира SmartScreen (наличен само в Windows 8), да се внимава с прикачените файлове към електронната поща. Добра идея е и да забраните скриптовете, ако не използвате такива с помощта на инструмента - Noscript.exe. Стартирайте го и изберете Disable. Ако ви потрябва да стартирате някога (js или vbs файлове, просто стартирайте инструмента и го направете на Enable). Добре е да се внимава и с PDF файловете (повечето програми позволяват да се изключи java script в PDF четците, да се забрани на PDF файловете да стартират външни програми и да комуникират с интернет и прочие), да се внимава с офис файловете за макрос вируси и експлоити (пак може да се затегне сигурността от настройките на офис пакетите), добре е да се внимава за файлове с двойни разширения (например ако в My Computer => Tools => Folder Options => не е премахната отметката пред "Hide extensions for known file types" ако свалите даден файл от интернет с името image.exe.jpg, вие ще го видите като image.jpg, но всъщност файла ще е image.exe и щом го стартирате това ще задейства и вируса).

5. Добра идея е да инсталирате Malwarebytes Anti-Exploit за да си осигурите спокойствие при сърфиране. Трудничко е, но просто няма как. Потребителите трябва да се научат да проявяват бдителност и хигиена при сърфиране.

6. За подобряване на производителността (ако системата ви се вижда мудна) вижте следните няколко теми:

Оптимизиране на Windows с цел по-добра производителност

Ръководство за поддръжка на Windows (XP, Vista и 7) [Revision 2.0]

Какво да направя, ако компютърът ми работи бавно

7. Проверете системата си актуални драйвери от сайтовете на производителите на компонентите ако ви се занимава (не използвайте програми за автоматично обновяване на драйверите за да си спестите главоболията после) и направете пълна проверка за гадини с наличната ви антивирусна програма за всеки случай.

8. Винаги правете бекъп на важните си документи на външни носители и за не толкова ценните неща на cloud услуги. Научете се да не инсталирате програми от съмнителни източници. Добра идея е да се научите да си създавате огледални образи на текущото работещо състояние на дяла на който се намира Операционната Система. Възстановяването на такъв образ при нужда в пъти по-лесен и бърз начин за връщане на работещото състояние на системата от преинсталация или опит за ръчно премахване на даден проблем. Такъв образ може да се създаде с външна програма като Macrium Reflect Free. Можете да видите и тази тема

Поздрави и усмихната седмица! Ще маркирам случая като решен! :bye1:

Поздрави!

  • Автор

УРАА :)  Стана с Force Removel. Благодаря много. Страхотни сте.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.