Лаг по време на филм или видео

8 май 201610 г.

Здравейте! Имам проблеми по време на гледане на филм или видео на телевизора ми! Използвам HDMI кабел от PC към ТВ. По точно проблема е, че когато пускам филм от компютъра към телевизора и минават 1-2 минути започва да ми насича/лаг много, че дори не е възможно да се гледа филма. Пробвах много варианти да реша проблема и най-накрая пробвах да изключа мрежовият кабел т.е. интернета и проблема изчезна, в смисъл вече не ми лъги/насича. Възможно ли е да е вирус ? Пуснах едно сканиране с malware и ми откри някакви trojan agent на taskhost.exe

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-05-2016
Ran by Hellioob (administrator) on STEFAN (08-05-2016 22:15:33)
Running from C:\Users\Hellioob\Desktop
Loaded Profiles: Hellioob (Available Profiles: Hellioob)
Platform: Windows 8.1 Pro (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
() C:\Users\Hellioob\AppData\Local\MiPhoneManager\main\MiPhoneHelper.exe
(Microsoft) C:\Program Files (x86)\Common Files\Microsoft Windows\taskhost.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
() C:\Users\Hellioob\AppData\Roaming\ACEStream\updater\ace_update.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161728 2015-08-09] (IvoSoft)
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4700160 2015-07-02] (VIA)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2771576 2015-12-16] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM-x32\...\Run: [MTview] => C:\Program Files (x86)\MTV20160128\MTView.exe -mini
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [51656320 2016-04-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-04-30] (Valve Corporation)
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [Spotify] => C:\Users\Hellioob\AppData\Roaming\Spotify\Spotify.exe [6890608 2016-04-28] (Spotify Ltd)
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [AceStream] => C:\Users\Hellioob\AppData\Roaming\ACEStream\engine\ace_engine.exe [27000 2015-12-18] ()
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [MiPhoneManager] => C:\Users\Hellioob\AppData\Local\MiPhoneManager\main\MiPhoneHelper.exe [157624 2016-03-27] ()
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [Spotify Web Helper] => C:\Users\Hellioob\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1525360 2016-04-28] (Spotify Ltd)
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [Microsoft Viewer Monitor Manager] => C:\Program Files (x86)\Common Files\Microsoft Windows\taskhost.exe [2013184 2016-04-26] (Microsoft)
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\MountPoints2: {a5479d6d-e9d5-11e5-826d-50465d754618} - "G:\autorun.exe"
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\MountPoints2: {d8b9fbcf-de43-11e5-825b-50465d754618} - "E:\setup.exe"
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-08-09] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-08-09] (IvoSoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2B7E88B3-58FD-47DA-BE66-0C763A6588BF}: [DhcpNameServer] 7.254.254.254
Tcpip\..\Interfaces\{4AD02373-853C-426F-91FA-B293659F0498}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE07&ocid=UE07DHP
HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?pc=UE07&ocid=UE07DHP
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-08-09] (IvoSoft)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2011-02-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2015-08-09] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-08-09] (IvoSoft)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2011-02-12] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-22] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-22] (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2015-08-09] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-08-09] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-08-09] (IvoSoft)
Handler: csnet - {FF3EFE67-7569-11D2-9F80-00104B107C97} - C:\NormaCS\Demo Client\pph_demo_net.dll No File

FireFox:
========
FF ProfilePath: C:\Users\Hellioob\AppData\Roaming\Mozilla\Firefox\Profiles\4tdasjcd.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-07] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-07] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-09] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-09] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-22] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-27] (Google Inc.)
FF Plugin HKU\S-1-5-21-2496513731-3331037878-1672677334-1001: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\Hellioob\AppData\Roaming\ACEStream\player\npace_plugin.dll [2015-08-06] (Innovative Digital Technologies)
FF HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Firefox\Extensions: [[email protected]] - C:\Users\Hellioob\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi
FF Extension: Ace Stream Web Extension - C:\Users\Hellioob\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi [2015-12-18]

Chrome:
=======
CHR HomePage: Default -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWqeVBuxgrc8GREvVYeuqlukOWlzmTqpykl1k91bsKMc6YZHbXwWU_Gxm_FjvTU6a_b-c8rYXFRWzocHcMUcWhj27WP1EA6G4BdJ_UEa_w1rsVFU4R_l0c17Fb2PM2nKNQvVpOuV-JV39LL2NN1-UiWzgTq01elx8sq-dyNFbj
CHR StartupUrls: Default -> "hxxps://www.google.bg/"
CHR Profile: C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Преводач) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2016-02-27]
CHR Extension: (Google Диск) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-27]
CHR Extension: (Gismeteo) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfegaehidkkcfaikpaijcdahnpikhobf [2016-04-27]
CHR Extension: (АБВ Уведомител) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpbekonjicgkldkmopnamgglbfaiojje [2016-02-27]
CHR Extension: (Dropbox for Gmail) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpdmhfocilnekecfjgimjdeckachfbec [2016-02-27]
CHR Extension: (Gmail Офлайн) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2016-02-27]
CHR Extension: (Google Календар) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2016-02-27]
CHR Extension: (Black & white theme) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmohofkmppcgglcmlccpbokkkefigipi [2016-02-27]
CHR Extension: (Musixmatch Lyrics for YouTube) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfenjblodoldnbiddmggcbkcapiolbig [2016-02-27]
CHR Extension: (Google Документи офлайн) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
CHR Extension: (AdBlock) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-04-17]
CHR Extension: (Google Calendar (by Google)) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmbgaklkmjakoegficnlkhebmhkjfich [2016-02-27]
CHR Extension: (LastPass: Free Password Manager) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2016-04-26]
CHR Extension: (Google Keep – бележки и списъци) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmjkmjkepdijhoojdojkdfohbdgmmhki [2016-05-03]
CHR Extension: (Google Проверка на пощата) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2016-02-27]
CHR Extension: (Ace Stream Web Extension) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjbepbhonbojpoaenhckjocchgfiaofo [2016-03-11]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [241936 2015-12-18] (EasyAntiCheat Ltd)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156216 2015-12-16] (NVIDIA Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-09] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-12-16] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [8185464 2015-12-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [6477432 2015-12-16] (NVIDIA Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [814064 2015-12-22] (Tunngle.net GmbH)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [36504 2015-06-22] (VIA Technologies, Inc.)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ampa; C:\Windows\system32\ampa.sys [19568 2015-11-10] ()
S3 ampa; C:\Windows\SysWOW64\ampa.sys [19568 2015-11-10] ()
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-05-08] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-09] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-12-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50472 2015-12-16] (NVIDIA Corporation)
R3 tap0901t; C:\Windows\system32\DRIVERS\tap0901t.sys [47736 2015-12-21] (Tunngle.net)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2015-04-25] (Microsoft Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.2.17063.223\QMUdisk64.sys [X]
S1 softaal; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.2.17063.223\softaal64.sys [X]
S1 SRepairDrv; \??\C:\Windows\GJFix\SRepairDrv [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-08 22:15 - 2016-05-08 22:15 - 00020770 _____ C:\Users\Hellioob\Desktop\FRST.txt
2016-05-08 22:15 - 2016-05-08 22:15 - 00000542 _____ C:\Users\Hellioob\Desktop\New Text Document.txt
2016-05-08 22:15 - 2016-05-08 22:15 - 00000000 ____D C:\FRST
2016-05-08 22:07 - 2016-05-08 22:07 - 02379264 _____ (Farbar) C:\Users\Hellioob\Desktop\FRST64.exe
2016-05-08 22:04 - 2016-05-08 22:04 - 00001776 _____ C:\Users\Hellioob\Desktop\1.txt
2016-05-08 21:30 - 2016-05-08 21:30 - 00000017 _____ C:\Users\Hellioob\AppData\Local\resmon.resmoncfg
2016-05-08 21:24 - 2016-05-08 21:24 - 00000000 ____D C:\ProgramData\Temp
2016-05-08 21:17 - 2016-05-08 21:17 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\NVIDIA
2016-05-08 21:16 - 2016-05-08 21:16 - 00000000 ____D C:\Users\Hellioob\AppData\Local\NVIDIA Corporation
2016-05-08 21:16 - 2016-05-08 21:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2016-05-08 21:16 - 2015-12-16 20:34 - 01846016 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2016-05-08 21:16 - 2015-12-16 20:34 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2016-05-08 21:16 - 2015-12-16 20:34 - 01530240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2016-05-08 21:16 - 2015-12-16 20:34 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2016-05-08 21:16 - 2015-12-16 20:34 - 00111520 _____ C:\Windows\system32\NvRtmpStreamer64.dll
2016-05-08 21:16 - 2015-12-16 17:39 - 00103032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2016-05-08 21:15 - 2016-05-08 21:17 - 00000000 ____D C:\ProgramData\NVIDIA
2016-05-08 21:15 - 2016-05-08 21:16 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-05-08 21:15 - 2016-05-08 21:16 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2016-05-08 21:15 - 2015-12-16 20:34 - 42977072 _____ C:\Windows\system32\nvcompiler.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 37609080 _____ C:\Windows\SysWOW64\nvcompiler.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 31061624 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 24895792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 21122456 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 20663816 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 18716176 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 17561432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 17156968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 16981976 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 16286888 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 14005408 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 12334200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2016-05-08 21:15 - 2015-12-16 20:34 - 03637352 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 03211760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 03168376 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 02755704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 01915696 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6436143.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 01572496 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 01564976 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6436143.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00938104 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00878816 _____ C:\Windows\system32\nvmcumd.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00872056 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00734512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00681592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00502080 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00469144 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00423264 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00416376 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00388560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00370808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00207152 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00205456 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2016-05-08 21:15 - 2015-12-16 20:34 - 00194680 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00175368 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00153392 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00151184 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00128696 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00072504 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00069416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00050472 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2016-05-08 21:15 - 2015-12-16 20:34 - 00039240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2016-05-08 21:15 - 2015-12-16 20:34 - 00034848 _____ C:\Windows\system32\nvinfo.pb
2016-05-08 21:15 - 2015-12-16 17:53 - 06359672 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2016-05-08 21:15 - 2015-12-16 17:53 - 02985080 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2016-05-08 21:15 - 2015-12-16 17:53 - 02554488 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2016-05-08 21:15 - 2015-12-16 17:53 - 01256240 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2016-05-08 21:15 - 2015-12-16 17:53 - 00523384 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2016-05-08 21:15 - 2015-12-16 17:53 - 00385328 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2016-05-08 21:15 - 2015-12-16 17:53 - 00075056 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2016-05-08 21:15 - 2015-12-16 17:53 - 00062768 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2016-05-08 21:15 - 2015-12-16 17:49 - 06090019 _____ C:\Windows\system32\nvcoproc.bin
2016-05-08 21:14 - 2016-05-08 21:16 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-05-08 21:11 - 2016-05-08 21:12 - 00000000 ____D C:\Users\Hellioob\Desktop\New folder
2016-05-08 20:38 - 2016-05-08 20:38 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\PotPlayerMini64
2016-05-08 20:37 - 2016-05-08 20:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daum
2016-05-08 20:37 - 2016-05-08 20:37 - 00000000 ____D C:\Program Files\DAUM
2016-05-08 20:36 - 2016-05-08 20:36 - 00000000 ____D C:\Users\Hellioob\Documents\CyberLink
2016-05-08 20:36 - 2016-05-08 20:36 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\CyberLink
2016-05-08 20:35 - 2016-05-08 21:24 - 00000000 ____D C:\ProgramData\CyberLink
2016-05-08 20:35 - 2016-05-08 20:36 - 00000000 ____D C:\ProgramData\PDVD
2016-05-08 20:35 - 2016-05-08 20:35 - 00000000 ____D C:\Users\Hellioob\AppData\Local\CyberLink
2016-05-08 20:35 - 2016-05-08 20:35 - 00000000 ____D C:\Program Files (x86)\NSIS Uninstall Information
2016-05-08 20:34 - 2016-05-08 21:24 - 00000000 ____D C:\ProgramData\SUPPORTDIR
2016-05-08 20:34 - 2016-05-08 21:24 - 00000000 ____D C:\ProgramData\install_clap
2016-05-08 20:08 - 2016-05-08 20:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NR-CP
2016-05-08 20:08 - 2016-05-08 20:08 - 00000000 ____D C:\Program Files\NR-CP
2016-05-08 20:08 - 2015-11-15 15:59 - 11076688 _____ (FFmpeg Project) C:\Windows\system32\avcodec-lav-57.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 10672720 _____ (FFmpeg Project) C:\Windows\SysWOW64\avcodec-lav-57.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 01672272 _____ (FFmpeg Project) C:\Windows\SysWOW64\avformat-lav-57.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 01567312 _____ (FFmpeg Project) C:\Windows\system32\avformat-lav-57.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 01219664 _____ (1f0.de - Hendrik Leppkes) C:\Windows\system32\LAVVideo.ax
2016-05-08 20:08 - 2015-11-15 15:59 - 01013840 _____ (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVVideo.ax
2016-05-08 20:08 - 2015-11-15 15:59 - 00629840 _____ (1f0.de - Hendrik Leppkes) C:\Windows\system32\LAVSplitter.ax
2016-05-08 20:08 - 2015-11-15 15:59 - 00544848 _____ (FFmpeg Project) C:\Windows\SysWOW64\avutil-lav-55.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00534608 _____ (FFmpeg Project) C:\Windows\SysWOW64\swscale-lav-4.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00530512 _____ (FFmpeg Project) C:\Windows\system32\swscale-lav-4.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00521808 _____ (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVSplitter.ax
2016-05-08 20:08 - 2015-11-15 15:59 - 00511056 _____ (Intel Corp.) C:\Windows\system32\IntelQuickSyncDecoder.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00494160 _____ (FFmpeg Project) C:\Windows\system32\avutil-lav-55.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00399952 _____ (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00315472 _____ C:\Windows\system32\libbluray.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00302672 _____ (1f0.de - Hendrik Leppkes) C:\Windows\system32\LAVAudio.ax
2016-05-08 20:08 - 2015-11-15 15:59 - 00265296 _____ C:\Windows\SysWOW64\libbluray.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00256080 _____ (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVAudio.ax
2016-05-08 20:08 - 2015-11-15 15:59 - 00182352 _____ (FFmpeg Project) C:\Windows\system32\avfilter-lav-6.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00178768 _____ (FFmpeg Project) C:\Windows\SysWOW64\avfilter-lav-6.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00168016 _____ (FFmpeg Project) C:\Windows\system32\avresample-lav-3.dll
2016-05-08 20:08 - 2015-11-15 15:59 - 00160336 _____ (FFmpeg Project) C:\Windows\SysWOW64\avresample-lav-3.dll
2016-05-08 20:08 - 2015-11-15 15:50 - 00000493 _____ C:\Windows\SysWOW64\LAVFilters.Dependencies.manifest
2016-05-08 20:08 - 2015-11-15 15:50 - 00000493 _____ C:\Windows\system32\LAVFilters.Dependencies.manifest
2016-05-08 20:08 - 2015-06-01 08:20 - 01943792 _____ (MPC-HC Team) C:\Windows\system32\VSFilter.dll
2016-05-08 20:08 - 2015-06-01 08:12 - 01570032 _____ (MPC-HC Team) C:\Windows\SysWOW64\VSFilter.dll
2016-05-07 17:34 - 2016-05-07 17:34 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-05-07 17:34 - 2016-04-16 01:53 - 00130328 _____ C:\Windows\SysWOW64\vulkan-1.dll
2016-05-07 17:34 - 2016-04-16 01:53 - 00040216 _____ C:\Windows\SysWOW64\vulkaninfo.exe
2016-05-07 17:34 - 2016-04-16 01:52 - 00130840 _____ C:\Windows\system32\vulkan-1.dll
2016-05-07 17:34 - 2016-04-16 01:52 - 00045336 _____ C:\Windows\system32\vulkaninfo.exe
2016-05-07 17:32 - 2016-05-07 17:32 - 00000000 ____D C:\NVIDIA
2016-05-07 16:40 - 2016-05-07 16:40 - 00000000 ____D C:\Windows\LastGood.Tmp
2016-05-06 23:59 - 2016-05-07 20:59 - 00000000 ____D C:\Users\Hellioob\Documents\Hellioob
2016-05-06 22:24 - 2016-05-07 16:12 - 00000000 ____D C:\Users\Hellioob\Documents\RèÐ ĎEVΊĹ
2016-05-06 12:28 - 2016-05-08 17:58 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Ethash
2016-05-06 12:08 - 2016-05-06 12:23 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Ori and the Blind Forest DE
2016-05-06 12:03 - 2016-05-06 12:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ori and the Blind Forest Definitive Edition
2016-05-05 20:14 - 2016-05-05 20:14 - 00000000 ____D C:\Users\Hellioob\AppData\Local\calibre-cache
2016-05-05 20:13 - 2016-05-05 20:31 - 00000000 ____D C:\Users\Hellioob\Documents\Calibre Library
2016-05-05 20:13 - 2016-05-05 20:23 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\calibre
2016-05-05 20:13 - 2016-05-05 20:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management
2016-05-05 20:13 - 2016-05-05 20:13 - 00000000 ____D C:\Program Files\Calibre2
2016-05-02 18:30 - 2016-05-02 18:36 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Mozilla
2016-05-02 18:29 - 2016-05-02 18:29 - 00000948 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-02 18:29 - 2016-05-02 18:29 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-05-02 18:29 - 2016-05-02 18:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-02 14:34 - 2016-05-02 14:39 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Factorio
2016-05-02 14:34 - 2016-05-02 14:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Factorio
2016-05-02 12:08 - 2016-05-02 12:08 - 00000000 ____D C:\ProgramData\HitmanPro
2016-04-29 18:16 - 2016-04-29 18:16 - 00000000 ____D C:\Users\Hellioob\AppData\LocalLow\Unity
2016-04-29 18:09 - 2016-04-29 18:09 - 00000000 ____D C:\Users\Hellioob\AppData\LocalLow\Hyper Hippo Productions Ltd_
2016-04-28 19:34 - 2016-04-28 19:34 - 00000066 _____ C:\Windows\ATTODiskBenchmark.INI
2016-04-28 19:24 - 2016-04-28 19:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2016-04-28 19:24 - 2016-04-28 19:24 - 00000000 ____D C:\Program Files (x86)\CrystalDiskInfo
2016-04-28 19:23 - 2016-04-28 19:23 - 00000000 ____D C:\Users\Hellioob\AppData\Local\CrystalDiskMark5
2016-04-28 19:01 - 2016-04-28 19:01 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-04-27 14:12 - 2016-04-27 14:12 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Apps\2.0
2016-04-27 11:57 - 2016-05-08 17:59 - 00000000 ____D C:\Users\Hellioob\Documents\Outlook Files
2016-04-25 13:35 - 2016-04-25 13:35 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Introversion
2016-04-24 18:59 - 2016-04-24 18:59 - 00000000 ____D C:\Users\Hellioob\AppData\Local\StardewValley
2016-04-24 18:59 - 2016-04-24 18:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-04-23 22:51 - 2016-04-23 22:51 - 00000000 ____D C:\Users\Hellioob\Documents\Petroglyph
2016-04-20 13:23 - 2016-04-20 13:29 - 00000000 ____D C:\Users\Hellioob\Documents\Euro Truck Simulator 2
2016-04-16 01:53 - 2016-04-16 01:53 - 00130328 _____ C:\Windows\SysWOW64\vulkan-1-1-0-8-1.dll
2016-04-16 01:53 - 2016-04-16 01:53 - 00040216 _____ C:\Windows\SysWOW64\vulkaninfo-1-1-0-8-1.exe
2016-04-16 01:52 - 2016-04-16 01:52 - 00130840 _____ C:\Windows\system32\vulkan-1-1-0-8-1.dll
2016-04-16 01:52 - 2016-04-16 01:52 - 00045336 _____ C:\Windows\system32\vulkaninfo-1-1-0-8-1.exe
2016-04-14 18:35 - 2016-04-14 18:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2016-04-14 18:31 - 2016-04-14 19:32 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Samsung
2016-04-14 18:31 - 2016-04-14 19:32 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Samsung
2016-04-14 18:31 - 2016-04-14 18:31 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2016-04-14 18:30 - 2016-01-08 11:51 - 01490656 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01007.dll
2016-04-14 18:30 - 2016-01-08 11:51 - 00708168 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller.dll
2016-04-14 18:30 - 2016-01-08 11:51 - 00213088 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys
2016-04-14 18:30 - 2016-01-08 11:51 - 00120416 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudbus.sys
2016-04-14 18:29 - 2016-04-14 19:32 - 00000000 ____D C:\Program Files (x86)\Samsung
2016-04-14 18:29 - 2013-12-30 10:53 - 04659712 _____ (Dmitry Streblechenko) C:\Windows\SysWOW64\Redemption.dll
2016-04-14 18:29 - 2013-12-30 10:53 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2016-04-14 18:28 - 2016-04-14 18:28 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Downloaded Installations
2016-04-13 21:03 - 2016-03-31 03:54 - 25817600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-04-13 21:03 - 2016-03-31 03:31 - 02892800 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-04-13 21:03 - 2016-03-31 03:28 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-04-13 21:03 - 2016-03-31 03:25 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-04-13 21:03 - 2016-03-31 03:17 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-04-13 21:03 - 2016-03-31 03:03 - 20352512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-04-13 21:03 - 2016-03-31 02:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2016-04-13 21:03 - 2016-03-31 02:56 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-04-13 21:03 - 2016-03-31 02:55 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-04-13 21:03 - 2016-03-31 02:53 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-04-13 21:03 - 2016-03-31 02:51 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-04-13 21:03 - 2016-03-31 02:50 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-04-13 21:03 - 2016-03-31 02:45 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-04-13 21:03 - 2016-03-31 02:45 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-04-13 21:03 - 2016-03-31 02:43 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-04-13 21:03 - 2016-03-31 02:43 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-04-13 21:03 - 2016-03-31 02:43 - 00379392 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-04-13 21:03 - 2016-03-31 02:42 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-04-13 21:03 - 2016-03-31 02:39 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-04-13 21:03 - 2016-03-31 02:30 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-04-13 21:03 - 2016-03-31 02:30 - 02596864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-04-13 21:03 - 2016-03-31 02:30 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-04-13 21:03 - 2016-03-31 02:30 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2016-04-13 21:03 - 2016-03-31 02:27 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-04-13 21:03 - 2016-03-31 02:24 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-04-13 21:03 - 2016-03-31 02:23 - 02056192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-04-13 21:03 - 2016-03-31 02:23 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-04-13 21:03 - 2016-03-31 02:23 - 00330752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-04-13 21:03 - 2016-03-31 02:21 - 13811712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-04-13 21:03 - 2016-03-31 02:18 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-04-13 21:03 - 2016-03-31 02:06 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-04-13 21:03 - 2016-03-31 02:05 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-04-13 21:03 - 2016-03-31 02:02 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-04-13 21:03 - 2016-03-31 02:00 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-04-13 21:03 - 2016-02-02 21:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2016-04-13 21:02 - 2016-04-04 09:35 - 00046768 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-04-13 21:02 - 2016-04-02 16:26 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-04-13 21:02 - 2016-04-02 16:26 - 01169408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-04-13 21:02 - 2016-03-29 17:05 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-04-13 21:02 - 2016-03-28 16:21 - 00698368 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-04-13 21:02 - 2016-03-28 16:21 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-04-13 21:02 - 2016-03-28 16:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-04-13 21:02 - 2016-03-28 16:21 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-04-13 21:02 - 2016-03-28 16:21 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-04-13 21:02 - 2016-03-16 02:00 - 00561952 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-04-13 21:02 - 2016-03-15 17:14 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-04-13 21:02 - 2016-03-11 17:48 - 00833024 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2016-04-13 21:02 - 2016-03-10 22:19 - 07452512 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-04-13 21:02 - 2016-03-10 22:17 - 01663192 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-04-13 21:02 - 2016-03-10 22:17 - 01523216 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-04-13 21:02 - 2016-03-10 22:17 - 01490128 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-04-13 21:02 - 2016-03-10 22:17 - 01358960 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-04-13 21:02 - 2016-03-10 22:17 - 01133752 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-04-13 21:02 - 2016-03-10 21:22 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-04-13 21:02 - 2016-03-10 21:21 - 00401920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-04-13 21:02 - 2016-03-10 21:20 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-04-13 21:02 - 2016-03-10 20:48 - 00862720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-04-13 21:02 - 2016-03-10 20:44 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-04-13 21:02 - 2016-03-10 20:43 - 00161280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-04-13 21:02 - 2016-03-10 20:16 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-04-13 21:02 - 2016-03-10 20:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2016-04-13 21:02 - 2016-03-10 19:55 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-04-13 21:02 - 2016-03-10 19:48 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2016-04-13 21:02 - 2016-03-10 19:42 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-04-13 21:02 - 2016-03-03 19:47 - 02345472 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2016-04-13 21:02 - 2016-03-03 19:33 - 01556992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2016-04-13 21:02 - 2016-03-03 19:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2016-04-13 21:02 - 2016-03-03 04:39 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-04-13 21:02 - 2016-03-03 04:39 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-04-13 21:02 - 2016-02-09 04:31 - 22365472 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-04-13 21:02 - 2016-02-09 04:31 - 19794896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-04-13 21:02 - 2016-02-09 04:31 - 02757616 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-04-13 21:02 - 2016-02-09 04:31 - 02412576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-04-13 21:02 - 2016-02-09 04:31 - 00273264 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2016-04-13 21:02 - 2016-02-08 23:55 - 02712576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-04-13 21:02 - 2016-02-08 23:15 - 02551808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2016-04-13 21:02 - 2016-02-08 23:02 - 01197056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2016-04-13 21:02 - 2016-02-08 22:48 - 12879360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-04-13 21:02 - 2016-02-08 22:43 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2016-04-13 21:02 - 2016-02-08 22:40 - 00539648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2016-04-13 21:02 - 2016-02-08 22:39 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2016-04-13 21:02 - 2016-02-08 22:37 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingMonitor.dll
2016-04-13 21:02 - 2016-02-08 22:35 - 00954880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2016-04-13 21:02 - 2016-02-08 22:34 - 00667648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2016-04-13 21:02 - 2016-02-08 22:33 - 00520192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2016-04-13 21:02 - 2016-02-08 21:50 - 03120640 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-04-13 21:02 - 2016-02-08 20:55 - 02592256 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2016-04-13 21:02 - 2016-02-08 20:33 - 01278464 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2016-04-13 21:02 - 2016-02-08 20:12 - 14466560 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-04-13 21:02 - 2016-02-08 20:02 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2016-04-13 21:02 - 2016-02-08 20:00 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll
2016-04-13 21:02 - 2016-02-08 19:58 - 00336384 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2016-04-13 21:02 - 2016-02-08 19:55 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\SettingMonitor.dll
2016-04-13 21:02 - 2016-02-08 19:53 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2016-04-13 21:02 - 2016-02-08 19:53 - 01348096 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-04-13 21:02 - 2016-02-08 19:50 - 01220096 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2016-04-13 21:02 - 2016-02-08 19:50 - 00841728 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2016-04-13 21:02 - 2016-02-08 19:48 - 00655872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2016-04-13 21:02 - 2016-02-08 19:47 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2016-04-13 21:02 - 2016-02-08 19:44 - 00955392 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-04-13 21:02 - 2016-02-07 02:05 - 00551256 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2016-04-13 21:02 - 2016-02-07 01:41 - 00316760 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2016-04-13 21:02 - 2016-02-05 22:07 - 00378712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-04-13 21:02 - 2016-02-05 18:11 - 00845312 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2016-04-13 21:02 - 2016-02-05 18:11 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2016-04-13 21:02 - 2016-02-05 18:07 - 00272384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2016-04-13 21:02 - 2016-02-05 18:02 - 01083904 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2016-04-13 21:02 - 2016-02-05 17:46 - 01455104 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2016-04-13 21:02 - 2016-02-04 21:07 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\dhcpsapi.dll
2016-04-13 21:02 - 2016-02-04 20:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpsapi.dll
2016-04-13 21:02 - 2016-02-04 19:23 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2016-04-13 21:02 - 2016-02-04 19:22 - 00561664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2016-04-13 21:02 - 2016-02-03 18:14 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2016-04-13 21:02 - 2016-02-03 18:11 - 01673728 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll
2016-04-13 21:02 - 2016-02-02 20:51 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2016-04-13 21:02 - 2016-02-02 20:19 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2016-04-13 21:02 - 2016-02-02 20:18 - 01574912 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2016-04-13 21:02 - 2016-02-02 20:15 - 00787456 _____ (Microsoft Corporation) C:\Windows\system32\WorkfoldersControl.dll
2016-04-13 21:02 - 2016-02-02 20:01 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\WsmAgent.dll
2016-04-13 21:02 - 2016-02-02 19:51 - 02609152 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2016-04-13 21:02 - 2016-02-02 19:48 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2016-04-13 21:02 - 2016-02-02 19:46 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAgent.dll
2016-04-13 21:02 - 2016-02-02 19:41 - 02170880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2016-04-13 21:02 - 2016-02-02 19:39 - 00236032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2016-04-13 21:02 - 2016-01-27 18:18 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2016-04-13 21:02 - 2016-01-26 22:15 - 00072024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpci.sys
2016-04-13 21:02 - 2016-01-26 17:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpcivsp.sys
2016-04-13 21:02 - 2016-01-22 08:22 - 02487296 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2016-04-13 21:02 - 2016-01-22 08:11 - 01482240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2016-04-13 21:02 - 2016-01-21 22:35 - 00952928 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2016-04-13 21:02 - 2016-01-21 21:42 - 00786152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2016-04-13 21:02 - 2016-01-21 01:40 - 00099672 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2016-04-13 21:02 - 2014-11-08 05:38 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2016-04-13 21:02 - 2014-11-08 05:17 - 00143360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2016-04-13 19:45 - 2016-04-24 19:00 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WebTorrent
2016-04-13 19:45 - 2016-04-24 19:00 - 00000000 ____D C:\Users\Hellioob\AppData\Local\WebTorrent
2016-04-13 19:45 - 2016-04-13 19:48 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\WebTorrent
2016-04-13 19:45 - 2016-04-13 19:45 - 00000000 ____D C:\Users\Hellioob\AppData\Local\SquirrelTemp
2016-04-08 20:22 - 2016-04-10 16:54 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\StardewValley
2016-04-08 20:22 - 2016-04-08 20:22 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-08 22:06 - 2016-02-27 03:43 - 00000000 ____D C:\Users\Hellioob\AppData\Local\ClassicShell
2016-05-08 22:02 - 2016-02-27 05:04 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Skype
2016-05-08 21:55 - 2016-03-09 00:54 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-05-08 21:51 - 2016-02-27 03:46 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-08 21:43 - 2016-02-27 03:04 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2496513731-3331037878-1672677334-1001
2016-05-08 21:39 - 2016-03-02 12:46 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-05-08 21:37 - 2016-03-02 12:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-05-08 21:37 - 2016-03-02 12:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-05-08 21:26 - 2016-02-27 05:20 - 00000000 ____D C:\Program Files (x86)\Steam
2016-05-08 21:24 - 2016-02-27 03:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-05-08 21:23 - 2016-02-27 04:56 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\MPC-HC
2016-05-08 21:23 - 2014-11-21 10:38 - 00863592 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-08 21:23 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\Inf
2016-05-08 21:17 - 2016-02-27 03:46 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-08 21:17 - 2013-08-22 17:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-08 21:16 - 2016-02-27 03:08 - 00000000 ____D C:\Users\Hellioob\AppData\Local\NVIDIA
2016-05-08 21:15 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\Help
2016-05-08 21:12 - 2013-08-22 17:44 - 00485136 _____ C:\Windows\system32\FNTCACHE.DAT
2016-05-08 21:07 - 2016-02-27 11:14 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\qBittorrent
2016-05-08 20:04 - 2016-02-29 00:56 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\.ACEStream
2016-05-08 19:38 - 2016-02-27 05:37 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Spotify
2016-05-08 19:08 - 2016-02-27 05:38 - 00000000 ____D C:\Users\Hellioob\AppData\Local\Spotify
2016-05-08 18:07 - 2016-02-27 03:20 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{47A8EEA2-0B68-4E52-A99A-6B8BA7194E30}
2016-05-07 13:59 - 2016-03-20 01:23 - 00000000 ____D C:\ProgramData\Home Media Server
2016-05-06 16:11 - 2016-02-27 04:42 - 00000000 ____D C:\Windows\system32\appraiser
2016-05-06 16:11 - 2013-08-22 18:20 - 00000000 ____D C:\Windows\CbsTemp
2016-05-06 16:02 - 2016-02-27 02:59 - 00000000 ____D C:\Users\Hellioob
2016-05-06 15:51 - 2016-02-27 03:09 - 00000000 ____D C:\Program Files\WinRAR
2016-05-04 14:48 - 2016-03-25 22:15 - 00000000 ____D C:\ProgramData\Tunngle
2016-05-03 02:01 - 2016-02-27 03:46 - 00002215 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-02 18:30 - 2016-03-02 12:19 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Mozilla
2016-05-02 14:23 - 2016-03-25 22:15 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Tunngle
2016-05-01 18:51 - 2016-03-17 23:04 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\foobar2000
2016-04-29 20:28 - 2016-02-27 03:09 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-04-29 20:28 - 2016-02-27 03:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-04-29 17:42 - 2013-08-22 18:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-29 17:42 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\AppReadiness
2016-04-27 14:55 - 2013-08-22 16:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-04-27 12:10 - 2016-02-27 03:43 - 00000000 ____D C:\ProgramData\ClassicShell
2016-04-27 11:51 - 2016-02-27 04:56 - 00001129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
2016-04-27 11:51 - 2016-02-27 04:56 - 00000000 ____D C:\Program Files (x86)\foobar2000
2016-04-27 10:50 - 2016-02-27 05:04 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-04-27 10:50 - 2016-02-27 05:04 - 00000000 ____D C:\ProgramData\Skype
2016-04-24 22:49 - 2016-03-06 15:39 - 00000000 ____D C:\Users\Hellioob\Desktop\РАБОТИЛНИЦА
2016-04-24 19:01 - 2016-03-22 19:08 - 00000000 ____D C:\Program Files (x86)\Vertus Fluid Mask 3
2016-04-24 19:01 - 2016-03-01 16:47 - 00000000 ____D C:\Users\Hellioob\Photoshop2015
2016-04-22 22:22 - 2016-02-27 17:08 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2016-04-22 22:22 - 2016-02-27 17:08 - 00000000 ____D C:\Users\Hellioob\.oracle_jre_usage
2016-04-22 22:22 - 2016-02-27 17:08 - 00000000 ____D C:\ProgramData\Oracle
2016-04-22 22:22 - 2016-02-27 17:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-04-22 22:22 - 2016-02-27 17:08 - 00000000 ____D C:\Program Files (x86)\Java
2016-04-22 10:57 - 2016-02-27 04:04 - 00453288 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-04-15 18:56 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\rescache
2016-04-14 19:32 - 2016-03-15 23:03 - 00000000 ____D C:\ProgramData\Samsung
2016-04-14 00:03 - 2013-08-22 18:36 - 00000000 ___RD C:\Windows\ToastData
2016-04-13 21:08 - 2016-02-27 04:03 - 00000000 ____D C:\Windows\system32\MRT
2016-04-13 21:04 - 2016-02-27 04:03 - 135176864 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-04-13 21:02 - 2016-03-10 13:46 - 01737080 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-04-13 21:02 - 2016-03-10 13:46 - 01501488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-04-13 21:02 - 2016-03-10 13:46 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-04-13 21:02 - 2016-02-27 03:49 - 00177488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-04-13 20:45 - 2016-02-27 11:31 - 00000000 ____D C:\Users\Hellioob\AppData\Local\CrashDumps
2016-04-13 20:32 - 2016-02-27 17:09 - 00000000 ____D C:\Users\Hellioob\AppData\Roaming\.minecraft
2016-04-11 13:36 - 2016-03-13 18:33 - 00000000 ____D C:\Windows\System32\Tasks\Games

==================== Files in the root of some directories =======

2016-03-02 12:19 - 2016-03-02 12:19 - 8003072 _____ () C:\Users\Hellioob\AppData\Roaming\agent.dat
2016-03-02 12:19 - 2016-03-02 12:19 - 0072825 _____ () C:\Users\Hellioob\AppData\Roaming\Doubleis.tst
2016-03-02 12:23 - 2016-03-02 12:23 - 0005120 _____ () C:\Users\Hellioob\AppData\Roaming\GiftBag.db
2016-03-02 12:19 - 2016-03-02 12:19 - 0127488 _____ () C:\Users\Hellioob\AppData\Roaming\Installer.dat
2016-03-02 12:19 - 2016-03-02 12:19 - 0018432 _____ () C:\Users\Hellioob\AppData\Roaming\Main.dat
2016-03-17 22:51 - 2016-03-17 22:54 - 0004751 _____ () C:\Users\Hellioob\AppData\Roaming\SpeedRunnersLog.txt
2016-03-02 12:19 - 2016-03-02 12:19 - 1894786 _____ () C:\Users\Hellioob\AppData\Roaming\Stimquocore.tst
2016-05-08 21:30 - 2016-05-08 21:30 - 0000017 _____ () C:\Users\Hellioob\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
C:\Users\Hellioob\AppData\Local\Temp\3d51890c7b88e4feeeed777176b46429.dll
C:\Users\Hellioob\AppData\Local\Temp\c0e36468fc0b05888bb6ed6a760e198d.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-2595015588636739178.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-3153040513499009260.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-3670542002207534080.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-4332971944192229166.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-4651562394124083652.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-4894875106116113450.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-4965188398689135629.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-5587898061108978450.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-5876414938220548752.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-7042361901882332408.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-7273704884229417585.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-7591950241856703297.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-7606884176299332275.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-768808310111513279.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-7798954140522189969.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-32-8056117445882664782.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-1396344374814088734.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-1769609885355114838.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-2061963716097499010.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-2140858723594764765.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-2310165196815639031.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-2409415276975776822.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-3547625142182033704.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-3871128433662209603.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-4339095692012153307.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-5026064828061285745.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-5348764894246140420.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-6401913983871496581.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-654428303940005394.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-7539140585193102041.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-7644037842133733711.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-7779534215315763445.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-7860868708013319332.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-7975759373402747975.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-810093193190372656.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-8173549267095820416.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-8316392092831757156.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-8554332652111969471.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-8734701927376154363.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-8961161108262856267.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-9094178754980046733.dll
C:\Users\Hellioob\AppData\Local\Temp\jansi-64-957098154258252153.dll
C:\Users\Hellioob\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\Hellioob\AppData\Local\Temp\jre-8u91-windows-au.exe
C:\Users\Hellioob\AppData\Local\Temp\ose00000.exe
C:\Users\Hellioob\AppData\Local\Temp\PidGenX.dll
C:\Users\Hellioob\AppData\Local\Temp\Uninstall.exe
C:\Users\Hellioob\AppData\Local\Temp\vcredist12_x86.exe
C:\Users\Hellioob\AppData\Local\Temp\vcredist9_x86.exe
C:\Users\Hellioob\AppData\Local\Temp\xmlUpdater.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-05-08 18:28

==================== End of FRST.txt ============================

Addition.txt

9 май 201610 г.

Здравейте,

Предоставете и лог файла от Malwarebytes Anti-Malware за да видя какво точно е премахнала.

Лог файла от FRST преди или след сканирането с Malwarebytes го направихте? Питам, защото в лог файла се вижда файла, за който говорите...и или не е успяла да го премахне или сте ми предоставили неактуален лог файл!

Брей...гадината има и описание на Microsoft

Цитат

(Microsoft) C:\Program Files (x86)\Common Files\Microsoft Windows\taskhost.exe

HKU\S-1-5-21-2496513731-3331037878-1672677334-1001\...\Run: [Microsoft Viewer Monitor Manager] => C:\Program Files (x86)\Common Files\Microsoft Windows\taskhost.exe [2013184 2016-04-26] (Microsoft)

По време на гледането защо не отворите един Task Manager и да видите дали се появява процес, който да товари системата?

Телевизора няма ли USB? Доста по-удобно е с флашка/външен хард да се гледат филми, защото така се използва и плеъра на самия телевизор, а с кабел използвате плеъра на компютъра и дори често звука се пуска от стерео уредбата ви, не от телевизора.

9 май 201610 г.

Автор

Моя грешка! Аз сканирах, но не изтрих вирусите, защото си помислих, че това е trojan и няма да се маха лесно. Сега правя наново сканира и ще изтрия, след което ще изпратя лог файла.

Относно филмите! Аз свалям bluray филми с повече от 20гб размер и няма как да ги сложа във флашка, за да гледам филма на ТВ.

Редактирано 9 май 201610 г. от Blue_Hulk (преглед на промените)

9 май 201610 г.

Автор

Това е лог файла! Направих ново сканиране, този път не открива вирус. Проблема относно сеч/лаг вече изчезна!

Бих искал да направя цялостно сканиране на компютъра за вируси и тем заплахи,,malware сканира много бързо няма и 5 минути и ме съмнява да сканира подробно всяка папка. Каква програма би ми препоръчал за цялостно сканиране ?

protection-log-2016-05-09.xml

Редактирано 9 май 201610 г. от Blue_Hulk (преглед на промените)

DarkEdge

Потребител

Пол:Мъж
Град:127.0.0.1:65535
Интереси:Няма начин да няма начин! Професия - каруцарин. Моля, колеги!

9 май 201610 г.

Купи си 32/64GB флашка.

9 май 201610 г.

преди 1 час, Blue_Hulk написа:

Това е лог файла! Направих ново сканиране, този път не открива вирус. Проблема относно сеч/лаг вече изчезна!

Бих искал да направя цялостно сканиране на компютъра за вируси и тем заплахи,,malware сканира много бързо няма и 5 минути и ме съмнява да сканира подробно всяка папка. Каква програма би ми препоръчал за цялостно сканиране ?

protection-log-2016-05-09.xml

Това не е правилния лог файл. Това е Protection log-a от защитата в реално време. Лог файла от сканирането и изобщо правилните логове в txt (а не в xml) се намират така:

Стартирайте Malwarebytes Anti-Malware
Отидете то табът History > Application Logs.

Отворете рапорта с последната дата и час (пред който пише Scan Log, не Protection Log) и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.
Направете и нова проверка с FRST като сложите отметка пред Addition.txt преди да натиснете бутона SCAN и прикачете и новите резултати - FRST.txt и Addition.txt

Поздрави!

9 май 201610 г.

Този конфликт . лаг може да се получава и при не достатъчно мошна видео карта . Аз преди имах проблеми на моя лаптоп когато за първи път пуснах филм да гледам на тв и след половин час лаптопа яко нагря . Явно HDMI кабела прави белята . Та реших да не мъча лаптопа и да си пусна филм директно от флашката и да друго е там вече ефекта Но от време на време пускам лаптопа към тв за някоя игрица или за кеф да си чета нещо

9 май 201610 г.

Автор

Malwarebytes Anti-Malware
www.malwarebytes.org

Дата на сканиране: 09-May-16
Час на сканиране: 13:02
Дневник:
Администратор: Да

Версия: 2.2.1.1043
База от данни за злонамерен софтуер: v2016.05.09.01
База от данни за рууткити: v2016.05.06.01
Лиценз: Пробен период
Защита от злонамерен софтуер: Разрешено
Защита от злонамерени страници: Разрешено
Самозащита: Забранено

ОС: Windows 8.1
Процесор: x64
Файлова система: NTFS
Потребител: Hellioob

Тип сканиране: Сканиране за заплахи
Резултат: Завършено
Сканиране обекти: 304365
Изминало време: 4 мин. 23 сек.

Памет: Разрешено
Начално стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
Рууткити: Забранено
Евристика: Разрешено
ПНП: Разрешено
ПНИ: Разрешено

Процеси: 0
(Не бяха открити злонамерени обекти)

Модули: 0
(Не бяха открити злонамерени обекти)

Ключове в системния регистър: 0
(Не бяха открити злонамерени обекти)

Стойности в системния регистър: 0
(Не бяха открити злонамерени обекти)

Данни в системния регистър: 0
(Не бяха открити злонамерени обекти)

Папки: 0
(Не бяха открити злонамерени обекти)

Файлове: 1
Trojan.Agent.E, C:\Program Files (x86)\Common Files\Microsoft Windows\taskhost.exe.config, Поставен под карантина, [34a1a82bb6e33303480be2ea9d6617e9],

Физически сектори: 0
(Не бяха открити злонамерени обекти)

(end)

Addition.txt

FRST.txt

Редактирано 9 май 201610 г. от Blue_Hulk (преглед на промените)

9 май 201610 г.

преди 4 часа, adersa написа:

Този конфликт . лаг може да се получава и при не достатъчно мошна видео карта . Аз преди имах проблеми на моя лаптоп когато за първи път пуснах филм да гледам на тв и след половин час лаптопа яко нагря . Явно HDMI кабела прави белята . Та реших да не мъча лаптопа и да си пусна филм директно от флашката и да друго е там вече ефекта Но от време на време пускам лаптопа към тв за някоя игрица или за кеф да си чета нещо

В случая вируса е бил причината за проблема.

преди 2 часа, Blue_Hulk написа:

Addition.txt

FRST.txt

Довечера ще напиша скрипт, защото съм на работа. В случая основния вредител си стои. Странно защо MBAM е премахнала само config файла. Ще им го пратя като приключим.

11 май 201610 г.

Здравейте,

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете как е положението!

Поздрави!

11 май 201610 г.

Автор

Всичко е тип топ. Благодаря!

Fixlog.txt

11 май 201610 г.

Радвам се. Иначе явно публикувания лог файл от FRST отново е бил стар, защото според скрипта, вируса е бил напълно премахнат (нещо, което не се видя в лог файла на MBAM, защото вируса още бе активен според последния FRST лог файл). Или сте почиствали и с други инструменти или просто FRST лог файла отново не е бил актуален. Както и да е.

Да направим финалните проверки:

СТЪПКА1 (ще повторим сканирането с MBAM, но този пък с включена проверка за рууткити).

Моля изтеглете Malwarebytes Anti-Malware 2.2.1.1043 Final и я запазете на вашия десктоп.

Стартирайте файла mbam-setup-2.1.8.1057.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи се уверете че сте сложили отметка пред:
Launch Malwarebytes Anti-Malware
Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

Натиснете бутона Finish.
Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
Ще започне проверка за зловреден софтуер.
При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи натиснете бутона Apply Actions.
Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
Отидете то табът History > Application Logs.

Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

СТЪПКА 2

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар. Пак повтарям, не трийте нищо с програмата, защото е доста мощна и може да бъде опасна!

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

СТЪПКА 3

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.

След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
Натиснете Next за да започне проверката.
Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

СТЪПКА 4

Изтеглете Security Check от screen317 от този линк и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.

Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия ви коментар в тази тема.

Поздрави!

11 май 201610 г.

Автор

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11-May-16
Scan Time: 23:37
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.05.11.06
Rootkit Database: v2016.05.06.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Hellioob

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 305693
Time Elapsed: 7 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

	HitmanPro 3.7.14.265
	www.hitmanpro.com
	   Computer name . . . . : STEFAN
	   Windows . . . . . . . : 6.3.0.9600.X64/4
	   User name . . . . . . : STEFAN\Hellioob
	   UAC . . . . . . . . . : Enabled
	   License . . . . . . . : Free
	   Scan date . . . . . . : 2016-05-11 23:48:23
	   Scan mode . . . . . . : Normal
	   Scan duration . . . . : 1m 4s
	   Disk access mode  . . : Direct disk access (SRB)
	   Cloud . . . . . . . . : Internet
	   Reboot  . . . . . . . : No
	   Threats . . . . . . . : 1
	   Traces  . . . . . . . : 10
	   Objects scanned . . . : 1,747,519
	   Files scanned . . . . : 61,029
	   Remnants scanned  . . : 405,769 files / 1,280,721 keys
	Malware _____________________________________________________________________
	   C:\Users\Hellioob\Documents\Hellioob\Програми\CheatEngine65.exe
	      Size . . . . . . . : 10,842,040 bytes
	      Age  . . . . . . . : 5.0 days (2016-05-06 22:48:37)
	      Entropy  . . . . . : 8.0
	      SHA-256  . . . . . : C0804C963983AAA16BFC1CBEAB63EF3E52784204192B1929FD3CDB8A7D4D7D3B
	      Product  . . . . . : Cheat Engine 6.5                                            
	      Publisher  . . . . : Cheat Engine                                                
	      Description  . . . : Cheat Engine 6.5 Setup                                      
	      Version  . . . . . : 6.5.0.3
	      RSA Key Size . . . : 2048
	      LanguageID . . . . : 0
	      Authenticode . . . : Valid
	    &gt; Kaspersky  . . . . : not-a-virus:AdWare.Win32.OpenCandy.bp
	      Fuzzy  . . . . . . : 98.0
	      Forensic Cluster
	          0.0s C:\Users\Hellioob\Documents\Hellioob\Програми\CheatEngine65.exe
	          0.2s C:\Users\Hellioob\Documents\Hellioob\Програми\Click here to install IRender_6_NJ15.exe
	          1.9s C:\Users\Hellioob\Documents\Hellioob\Програми\xampp-win32-5.5.30-6-VC11-installer.exe
	          2.9s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\ScanMaster-ELM-v2.1.rar
	          3.1s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\ScanMaster-ELM_DEMO_5.0.0.3100.zip
	          3.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Torque_Pro_v1.8.14.apk
	          3.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\
	          3.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\scantool_net113win\
	          3.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\scantool_net113win\scantool_net113win.rar
	          3.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\
	          3.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\
	          3.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\
	          3.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\DRemover98_2K.exe
	          3.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\ser2pl.sys
	          3.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\SER9PL.sys
	          3.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\SERSPL.INF
	          3.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\SERSPL.VXD
	          3.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\98_ME_2K\SERWPL.INF
	          3.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\Vista\
	          4.1s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\Vista\PL-2303 Vista Driver Installer.exe
	          4.1s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\Win7\
	          4.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\Win7\PL2303_Prolific_DriverInstaller_v1210.exe
	          4.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\Win7\releasenote.txt
	          4.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\XP\
	          4.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB Driver\PL2303\XP\PL-2303_Driver_Installer.exe
	          4.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB driver ELM327\
	          4.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB driver ELM327\CDM v2.12.06 WHQL Certified.zip
	          4.7s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\33\B269ABE5BF1E2E35.dat
	          5.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB driver VAG-COM KKL\
	          5.8s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\Driver OB2\USB driver VAG-COM KKL\CP210x_VCP_Windows.zip
	          6.0s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\66\152253225BB28AF2.dat
	          6.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\98\D7E876EB1CBC9936.dat
	          6.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\84\BF7AC569C81BD89C.dat
	          6.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\13\60F42D8082FB236D.dat
	          6.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\
	          6.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ScanMaster-ELM-v2.1.rar
	          6.9s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ScanMaster-ELM_DEMO_5.0.0.3100.zip
	          7.1s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\
	          7.1s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\scantool_net113win\
	          7.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\scantool_net113win\scantool_net113win.exe
	          7.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\scantool_net113win\scantool_net113win.rar
	          7.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\
	          7.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\
	          7.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\
	          7.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\DRemover98_2K.exe
	          7.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\ser2pl.sys
	          7.5s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\SER9PL.sys
	          7.5s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\SERSPL.INF
	          7.5s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\SERSPL.VXD
	          7.5s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\98_ME_2K\SERWPL.INF
	          7.5s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\Vista\
	          7.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\Vista\PL-2303 Vista Driver Installer.exe
	          7.7s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\Win7\
	          8.0s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\Win7\PL2303_Prolific_DriverInstaller_v1210.exe
	          8.0s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\Win7\releasenote.txt
	          8.0s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\XP\
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\Driver OB2\USB Driver\PL2303\XP\PL-2303_Driver_Installer.exe
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\1.glf
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\1.png
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\2.png
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\3.png
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\4.png
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\p,ic\5.png
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ru\
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ru\LC_MESSAGES\
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ru\LC_MESSAGES\default.mo
	          8.3s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ScanMaster-ELM v2.1\
	          8.4s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ScanMaster-ELM v2.1\KeyGen-scanmaster-2.1.exe
	          8.5s C:\Users\Hellioob\Documents\Hellioob\Програми\Програми за автомобили\OBD2\ScanMaster-ELM v2.1\ScanMasterELM_2.1.104.771.exe
	          8.7s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\logo.png
	          8.7s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\logo.psd
	          8.9s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\
	          8.9s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PlayOn.png
	          9.0s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PlayOn.psd
	          9.0s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\
	          9.0s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\ACU_Arno_Dorian_render.png
	          9.1s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\call_of_duty_advanced_warfare_render_by_zero0kiryu-d7h39ua.png
	          9.1s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\gta_5_michael_by_juniorbunny-d60p3ou.png
	          9.1s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\image.jpg
	          9.1s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\M3rT7Tr.png
	          9.2s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\the_elder_scrolls_online_by_ivances-d5c2iam.png
	          9.2s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\PlayOnBg\PNG\watch-dogs-pngwatch-dogs-forum-----view-topic---vaas-carv3rs-image-gallery-pxb39zpr.png
	          9.3s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\Textures\
	          9.4s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\Textures\FreeWatercolorTextures.zip
	          9.4s C:\Users\Hellioob\Documents\Hellioob\Проект Photoshop\Textures\LRS_Jack_o_Lantern.zip
	          9.9s C:\Users\Hellioob\Documents\Hellioob\Проект Видео клипове\Amazing Balloon Skewer Party\
	          9.9s C:\Users\Hellioob\Documents\Hellioob\Проект Видео клипове\Amazing Balloon Skewer Party\Amazing Balloon Skewer Party Trick.mp4
	         10.1s C:\Users\Hellioob\Documents\Hellioob\Проект Видео клипове\Amazing Balloon Skewer Party\Amazing Balloon Skewer Party Trick.srt
	
	Suspicious files ____________________________________________________________
	   C:\Users\Hellioob\Desktop\FRST-OlderVersion\FRST64.exe
	      Size . . . . . . . : 2,379,264 bytes
	      Age  . . . . . . . : 3.1 days (2016-05-08 22:07:35)
	      Entropy  . . . . . : 7.6
	      SHA-256  . . . . . : 87FBF1A3EA732E39FAFCE6E348EF141693D5C79B56C1A9472ABD94CC18D5501D
	      Needs elevation  . : Yes
	      Fuzzy  . . . . . . : 24.0
	         Program has no publisher information but prompts the user for permission elevation.
	         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
	         Authors name is missing in version info. This is not common to most programs.
	         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
	         Time indicates that the file appeared recently on this computer.
	      Forensic Cluster
	          0.0s C:\Users\Hellioob\Desktop\FRST-OlderVersion\FRST64.exe
	          1.3s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\31\BD1247CE1A350F53.dat
	          1.3s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\31\BD1247CE1A350F53.dat
	   C:\Users\Hellioob\Desktop\FRST64.exe
	      Size . . . . . . . : 2,381,312 bytes
	      Age  . . . . . . . : 0.1 days (2016-05-11 21:23:59)
	      Entropy  . . . . . : 7.6
	      SHA-256  . . . . . : 1CA0034CA00C4197E3BA9112F61D854AAA72C6D21EAA7C199E4B4BC1A1E0327A
	      Needs elevation  . : Yes
	      Fuzzy  . . . . . . : 24.0
	         Program has no publisher information but prompts the user for permission elevation.
	         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
	         Authors name is missing in version info. This is not common to most programs.
	         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
	         Time indicates that the file appeared recently on this computer.
	      Forensic Cluster
	         -2.3s C:\Windows\Prefetch\NVTRAY.EXE-DB83881B.pf
	          0.0s C:\Users\Hellioob\Desktop\FRST64.exe
	          0.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\95\D692D99A6825A11B.dat
	          0.7s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\68\7E43BDF9BABC8E74.dat
	          2.8s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\0448989D66188EA3EA8B41F62BB66681
	          3.4s C:\Windows\Prefetch\DLLHOST.EXE-766398D2.pf
	          3.6s C:\Users\Hellioob\Desktop\FRST-OlderVersion\
	          4.0s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{7046EC60-ABAC-4E63-823D-9E9D9D292830}
	          4.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\24\90EC2479B42ABEF0.dat
	          4.6s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\1\80\6BB8A6DDF695E3B4.dat
	          8.8s C:\Users\Hellioob\Desktop\Fixlog.txt
	          8.8s C:\FRST\Logs\ct
	         12.7s C:\System Volume Information\SPP\OnlineMetadataCache\{874469cb-c77e-42ea-aa22-80ba0a0bd0e4}_OnDiskSnapshotProp
	         12.9s C:\System Volume Information\{41f3b7e2-17a5-11e6-828c-50465d754618}{3808876b-c176-4e48-b7ae-04046e6cc752}
	         14.0s C:\Windows\Prefetch\DLLHOST.EXE-B2EB1806.pf
	         14.0s C:\Windows\Prefetch\SRTASKS.EXE-4F77756F.pf
	         14.7s C:\FRST\Quarantine\C\
	         14.7s C:\FRST\Quarantine\C\Program Files (x86)\
	         14.7s C:\FRST\Quarantine\C\Windows\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\Microsoft\Windows\
	         14.7s C:\FRST\Quarantine\C\Users\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\Microsoft\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Start Menu\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\Microsoft\Internet Explorer\
	         14.7s C:\FRST\Quarantine\C\Users\Hellioob\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\
	         15.4s C:\FRST\Quarantine\C\Windows\System32\Drivers\etc\
	         15.4s C:\FRST\Quarantine\C\Windows\System32\
	         15.4s C:\FRST\Quarantine\C\Windows\System32\Drivers\
	         17.3s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000159.db
	         25.4s C:\Windows\Prefetch\BITSADMIN.EXE-71339457.pf
	         31.8s C:\Windows\Prefetch\NETSH.EXE-F1B6DA12.pf
	         31.8s C:\Windows\Prefetch\IPCONFIG.EXE-912F3D5B.pf
	         31.8s C:\Windows\Prefetch\DLLHOST.EXE-A8DE6D5B.pf
	         32.6s C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winsock-WS2HELP%4Operational.evtx
	         34.9s C:\Users\Hellioob\Documents\Outlook Files\~Outlook.pst.tmp
	         38.8s C:\FRST\Logs\Fixlog_11-05-2016_21-24-37.txt
	         38.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000068.db
	         56.9s C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl
	         58.7s C:\ProgramData\NVIDIA\Resource.dat
	         58.7s C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
	         58.7s C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
	         58.7s C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-WorkFolders-WHC.etl
	         58.7s C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
	         59.0s C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTWFP-IPsec Diagnostics.etl
	         59.6s C:\ProgramData\Microsoft\Windows Defender\Support\MpWppTracing-05112016-212458-00000003-ffffffff.bin
	         60.5s C:\ProgramData\Microsoft\Windows Defender\IMpService77BDAF73-B396-481F-9042-AD358843EC24.lock
	         69.2s C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagtrack-Listener.etl
	         70.1s C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc\
	         71.7s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\INetCache\IE\
	         71.7s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\
	         71.8s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
	         71.8s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
	         71.8s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
	         71.8s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1600.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
	         71.9s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
	         72.0s C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
	         72.0s C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
	         72.3s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Notifications\fb883c80dce411e5824f50465d754618\BBmYVNe[2].jpg
	         72.3s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Notifications\fb883c80dce411e5824f50465d754618\BBsVQQ9[1].jpg
	         72.4s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\INetCache\IE\container.dat
	         73.5s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\80\6BB8A6DDF695E3B4.dat
	         73.6s C:\Windows\Temp\MpCmdRun.log
	         73.6s C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun.log
	         74.0s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\FDC47674F5C5F886B916B86C37FB89EC
	         74.0s C:\Windows\Temp\MPInstrumentation\
	         76.4s C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{361465F3-70F3-4AC3-BB2B-8BD8517AEF5C}
	         76.9s C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\Data\6325f8f33d33c68027e7b6d156bcfe7600f14f87
	         77.0s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\History\History.IE5\container.dat
	         80.7s C:\Users\Hellioob\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000015a.db
	         84.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\History
	         84.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\History-journal
	         84.7s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
	         84.7s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cookies
	         84.7s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
	         84.7s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\index
	         84.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Visited Links
	         84.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0
	         84.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1
	         84.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2
	         84.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3
	         85.0s C:\Users\Hellioob\AppData\Local\Temp\jusched.log
	         85.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index
	         85.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
	         85.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
	         85.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
	         85.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3
	         85.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Network Action Predictor-journal
	         86.4s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\83\DA05D50629A7B61F.dat
	         86.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\QuotaManager-journal
	         86.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Sync Data\SyncData.sqlite3-journal
	         86.7s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Top Sites-journal
	         86.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
	         86.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
	         87.0s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Last Session
	         87.0s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Current Session
	         87.0s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000004
	         87.3s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000005
	         87.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000006
	         87.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000007
	         87.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000008
	         89.5s C:\Users\Hellioob\AppData\Local\Steam\htmlcache\Visited Links
	         90.1s C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSteam Event Tracing.etl
	         90.3s C:\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\
	         90.3s C:\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
	         91.3s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gfenjblodoldnbiddmggcbkcapiolbig_0.localstorage
	         91.3s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gfenjblodoldnbiddmggcbkcapiolbig_0.localstorage-journal
	         91.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mihcahmgecmbnbcchbopgniflfhgnkff_0.localstorage
	         91.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mihcahmgecmbnbcchbopgniflfhgnkff_0.localstorage-journal
	         91.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cpbekonjicgkldkmopnamgglbfaiojje_0.localstorage
	         91.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cpbekonjicgkldkmopnamgglbfaiojje_0.localstorage-journal
	         91.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bfegaehidkkcfaikpaijcdahnpikhobf_0.localstorage
	         91.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bfegaehidkkcfaikpaijcdahnpikhobf_0.localstorage-journal
	         91.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gmbgaklkmjakoegficnlkhebmhkjfich_0.localstorage
	         91.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gmbgaklkmjakoegficnlkhebmhkjfich_0.localstorage-journal
	         93.0s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Last Tabs
	         93.0s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Current Tabs
	         93.3s C:\Users\Hellioob\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ec3e36af0cdcb3e1.customDestinations-ms
	         95.0s C:\Users\Hellioob\AppData\Local\Steam\htmlcache\Cookies
	         95.0s C:\Users\Hellioob\AppData\Local\Steam\htmlcache\Cookies-journal
	         96.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000009
	         96.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\24f804365b7b82b4e5172f8521d8eae0449eaf9b\AF6EEE43-F779-4594-8A33-504A42091773\ea3673de69e721fd_0
	         97.3s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000a
	         97.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000b
	         97.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000c
	         97.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000d
	         97.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000e
	         97.5s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00000f
	         97.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000010
	         97.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000011
	         97.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000012
	         97.7s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000013
	         97.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000014
	         97.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000015
	         98.1s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000016
	         98.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000017
	         98.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gighmmpiobklfepjocnamgkkbiglidom_0.localstorage
	         98.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gighmmpiobklfepjocnamgkkbiglidom_0.localstorage-journal
	         116.4s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
	         119.6s C:\Users\Hellioob\AppData\Local\Steam\htmlcache\ChromeDWriteFontCache
	         120.7s C:\Windows\Prefetch\STEAMWEBHELPER.EXE-9361376C.pf
	         122.3s C:\Windows\System32\spp\store\2.0\data.dat
	         140.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage
	         140.6s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage-journal
	         140.8s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000018
	         140.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000019
	         140.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001a
	         140.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001b
	         140.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001c
	         141.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Favicons-journal
	         146.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001d
	         146.9s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001e
	         147.0s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00001f
	         147.1s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000020
	         147.2s C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000021
	
	Potential Unwanted Programs _________________________________________________
	   C:\Program Files (x86)\Baidu\BaiduAn\ (Baidu)
	   HKLM\SOFTWARE\Classes\s\ (Softonic)
	   HKLM\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\ (Baidu)
	   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}\ (Baidu)
	Cookies _____________________________________________________________________
	   C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cookies:addthis.com
	   C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
	   C:\Users\Hellioob\AppData\Local\Google\Chrome\User Data\Default\Cookies:krxd.net

Emsisoft Emergency Kit - Version 11.0
Last update: 11-May-16 23:57:39
User account: STEFAN\Hellioob

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:   11-May-16 23:58:30
C:\Program Files (x86)\baidu    detected: Application.AppInstall (A)
C:\Users\Hellioob\AppData\Roaming\baidu    detected: Application.AppInstall (A)
C:\Users\Hellioob\Documents\RèÐ ĎEVΊĹ\Android\Apps\Framaroot-1.9.2.apk -> META-INF/CERT.RSA    detected: Android.Riskware.Rooter.L (B)
C:\Users\Hellioob\Documents\RèÐ ĎEVΊĹ\Android\Apps\Framaroot-1.9.3.apk -> META-INF/CERT.RSA    detected: Android.Riskware.Rooter.L (B)

Scanned 310950
Found 4

Scan end: 12-May-16 00:10:10
Scan time: 0:11:40

Results of screen317's Security Check version 1.014 --- 12/23/15
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 91
Java version 32-bit out of Date!
Adobe Flash Player    21.0.0.213
Google Chrome (49.0.2623.112)
Google Chrome (50.0.2661.94)
Google Chrome (SetupMetrics.pma..)
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
Windows Defender MpCmdRun.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

13 май 201610 г.

Здравейте,

Готови сме. Логовете са чисти. Има само няколко безобидни остатъци:

,

СТЪПКА 1

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

СТЪПКА 2

Обновете остарелите програми с помощта на PatchMyPC

Поздрави!

14 май 201610 г.

Автор

Поправи линка към PatchMyPC и ми обясни за какви остарели програми става въпрос, задължително ли е това ?

Fix result of Farbar Recovery Scan Tool (x64) Version:09-05-2016
Ran by Hellioob (2016-05-14 12:35:56) Run:2
Running from C:\Users\Hellioob\Desktop
Loaded Profiles: Hellioob (Available Profiles: Hellioob)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
C:\Program Files (x86)\Baidu
C:\Users\Hellioob\AppData\Roaming\baidu
DeleteKey: HKLM\SOFTWARE\Classes\s
DeleteKey: HKLM\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}
DeleteKey: HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81}
end

*****************

Restore point was successfully created.
Processes closed successfully.
C:\Program Files (x86)\Baidu => moved successfully
C:\Users\Hellioob\AppData\Roaming\baidu => moved successfully
HKLM\SOFTWARE\Classes\s => key removed successfully
HKLM\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81} => could not remove at first attempt (ErrorCode: C0000121), see next line.
HKLM\SOFTWARE\Classes\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81} => key removed successfully
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{DA624F8F-98BF-4B03-AD11-A12D07119E81} => key not found.

The system needed a reboot.

==== End of Fixlog 12:36:03 ====

DarkEdge

Потребител

Пол:Мъж
Град:127.0.0.1:65535
Интереси:Няма начин да няма начин! Професия - каруцарин. Моля, колеги!

14 май 201610 г.

PatchMyPC

14 май 201610 г.

Ами линка си бе наред, но може би форума се е бъгнал докато съм поствал. Ето го линка:

https://patchmypc.net/freeupdater/PatchMyPC.exe

И да, задължително е да се обновят старите програми - особено Java и Adobe Flash Player:

Java 8 Update 91 => последната версия е Java 8 Update 92

http://www.oracle.com/technetwork/java/javase/downloads/jre8-downloads-2133155.html

Adobe Flash Player 21.0.0.213 => последната версия е 21.0.0.242

https://www.kaldata.com/comments.php?catid=1&id=47908

А защо трябва да се обновят може да се прочете тук:

https://www.kaldata.com/IT-%D0%9D%D0%BE%D0%B2%D0%B8%D0%BD%D0%B8/%D0%A5%D0%B0%D0%BA%D0%B5%D1%80%D0%B8-%D0%B5%D0%BA%D1%81%D0%BF%D0%BB%D0%BE%D0%B0%D1%82%D0%B8%D1%80%D0%B0%D1%82-%D0%BD%D0%B5%D0%BF%D0%BE%D0%BA%D1%80%D0%B8%D1%82%D0%B0-%D1%83%D1%8F%D0%B7%D0%B2%D0%B8%D0%BC%D0%BE-110481.html

14 май 201610 г.

Автор

Благодаря много! Относно програмите Hitman Pro, FRST, EmsisoftEmergencyKit и т.н просто да ги изтрия от десктопа ?

14 май 201610 г.

Ето малко финални препоръки: (Не е задължително да ги прилагате всичките, а само тези, които сметнете за необходими. Направете обаче една нова точка за възстановяване докато всичко работи преди да започнете да прилагате съветите):

http://windows.microsoft.com/bg-bg/windows7/create-a-restore-point

1. За да почистим използваните от нас инструменти направете следното:

Изтеглете Delfix.exe и го стартирайте. Сложете отметка пред Remove disinfection tools и Purge system restore (трябва да има такава по-подразбиране, но все пак да си кажа) => натиснете бутона Run. Инструмента ще се самоизтрие след като приключи своята задача!

HitmanPro има папка и в C:\Programdata\HitmanPro. EmsisoftEmergencyKit има папка в C:\EEK, FRST освен изпълнимия файл има папка в C:\FRST. Тези папки могат да се изтрият ръчно ако Delfix не ги премахне.

Ако има папки, които не са се изтрили след гореспоменатите процедури пишете и ще ги премахнем ръчно.

2. Инсталирайте Unchecky за да се предпазите от адуер по време на инсталацията на даден софтуер.

3. За защита от криптовирусите, освен обновяване на ОС и антивирусната програма е добре да имунизирате системата си с CryptoPrevent и профила Maximum Protection: (Не използвайте последната опция, защото още е бъгава и не работи коректно).

Ако имате проблеми с инсталацията на програми след използването на CryptoPrevent вижте следните съвети както и тези.

Не забравяйте да изключите и Autorun в Windows, защото криптовирусите могат да се настанят и на външните дискове и флашки и да заразят информацията на тези носители при свързването им с инфектирана система и след това да заразят и други системи при свързването на външните дискове към други компютри (и така да го предадете и на тях). Microsoft са създали автоматичен инструмент за целта => MSFixIt. Добре е също така след като вкарате външния диск дори и при спрян Autorun просто да сканирате буквата на устройството с обновена антивирусна програма преди да започнете да прехвърляте данни от и към външния диск.

Има и други програми, но са главно за напреднали потребители и няма да се спирам много задълбочено на тях, защото са сравнително по-сложни за употреба на средностатистическите потребители.. Затова ще ги пропусна. Добре е да не се спира System Restore (и File History в Windows 8), да не се спира UAC - User Account Control (даже да се направи на максималното ниво на защита), да не се спира SmartScreen (наличен само в Windows 8), да се внимава с прикачените файлове към електронната поща. Добра идея е и да забраните скриптовете, ако не използвате такива с помощта на инструмента - Noscript.exe. Стартирайте го и изберете Disable. Ако ви потрябва да стартирате някога (js или vbs файлове, просто стартирайте инструмента и го направете на Enable). Добре е да се внимава и с PDF файловете (повечето програми позволяват да се изключи java script в PDF четците, да се забрани на PDF файловете да стартират външни програми и да комуникират с интернет и прочие), да се внимава с офис файловете за макрос вируси и експлоити (пак може да се затегне сигурността от настройките на офис пакетите), добре е да се внимава за файлове с двойни разширения (например ако в My Computer => Tools => Folder Options => не е премахната отметката пред "Hide extensions for known file types" ако свалите даден файл от интернет с името image.exe.jpg, вие ще го видите като image.jpg, но всъщност файла ще е image.exe и щом го стартирате това ще задейства и вируса).

4. Добра идея е да инсталирате Malwarebytes Anti-Exploit и Malwarebytes Anti-Ransomware за да си осигурите спокойствие при сърфиране. Трудничко е, но просто няма как. Потребителите трябва да се научат да проявяват бдителност и хигиена при сърфиране.

5. За подобряване на производителността (ако системата ви се вижда мудна) вижте следните няколко теми:

Оптимизиране на Windows с цел по-добра производителност

Ръководство за поддръжка на Windows (XP, Vista и 7) [Revision 2.0]

Какво да направя, ако компютърът ми работи бавно

6. Проверете системата си актуални драйвери от сайтовете на производителите на компонентите ако ви се занимава (не използвайте програми за автоматично обновяване на драйверите за да си спестите главоболията после) и направете пълна проверка за гадини с наличната ви антивирусна програма за всеки случай.

7. Винаги правете бекъп на важните си документи на външни носители и за не толкова ценните неща на cloud услуги. Научете се да не инсталирате програми от съмнителни източници. Добра идея е да се научите да си създавате огледални образи на текущото работещо състояние на дяла на който се намира Операционната Система. Възстановяването на такъв образ при нужда в пъти по-лесен и бърз начин за връщане на работещото състояние на системата от преинсталация или опит за ръчно премахване на даден проблем. Такъв образ може да се създаде с външна програма като Macrium Reflect Free. Можете да видите и тази тема

Поздрави!

Добре дошли!

Лаг по време на филм или видео

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)