Здравейте имам  доста тежък проблем .
Вируси ...непрестанно ми се инсталират програми (незнайно от къде се появяват ) които ми стоят като Adds на монитора и минимизират игри програми и т.н.
опитах с adw cleaner и премахна голяма част от тях но има остатъчни с които немога да се справя и са доста (немога да дам повече информация за вирусите поради невежество -_- )

Благодаря ви предварително .

Addition.txt

FRST.txt

 

преди 14 минути, дръндю написа:

докато се появи специалист направете това

 

Thumbs up .Готово.

Здравейте,

Системата е сериозно заразена:

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете как е положението.

Поздрави!

Здравей B-Boy  при първото стартиране ми даде грешка по средата на почистването  "програмата спря да работи" ,пуснах повторно при което успя да завърши процедурата .Засега няма прояви на вируси но след като системата ми е сериозно повредена и има неща които не са предизвикани от вируси немога да кажа дали всичко е 6.Ето и фикс лога който програмата направи .
Благодаря и поздрави.

Fixlog.txt

Искам да видя и първия лог файл. Отворете папката C:\FRST\Logs и го потърсете.

 

Ето го и него

Fixlog_09-06-2016_02-45-35.txt

Не е този. Този отново е от второто пускане:

Ran by Toucher (2016-06-09 02:44:34) Run:2

На мен ми трябва там където е Run:1

Моля потърсете отново.

всичко което имам

Addition_08-06-2016_12-46-20.txt

FRST_08-06-2016_12-46-20.txt

Явно сте го презаписали като сте избързали и сте пуснали процедурата за втори път. Жалко! Както и да е, направете нова проверка с FRST като сложите отметка пред Addition.txt преди да натиснете бутона SCAN и след това прикачете новите резултати.

Поздрави!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:16-06-2016 01
Ran by Toucher (administrator) on YOUCANTOUCHTHIS (17-06-2016 18:05:29)
Running from E:\Downloads
Loaded Profiles: Toucher (Available Profiles: Toucher)
Platform: Windows 10 Pro Version 1511 (X64) Language: Български (България)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Razer Inc.) E:\Programs\Razer Cortex\RzKLService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) E:\Programs\Steam\Steam.exe
(Valve Corporation) E:\Programs\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) E:\Programs\Steam\bin\steamwebhelper.exe
(PandoraTV) E:\Programs\KMPlayer\KMPlayer.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16404224 2015-09-17] (Realtek Semiconductor)
HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-05-02] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [UMonit] => C:\WINDOWS\SysWOW64\UMonit64.exe [55352 2015-09-21] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595992 2016-05-20] (Oracle Corporation)
HKLM-x32\...\Run: [PlaysTV] => C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe [71440 2016-06-07] (Plays.tv, LLC)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58640 2016-05-23] (Raptr, Inc)
HKU\S-1-5-21-1786193651-3707420613-66249313-1000\...\Run: [MyComGames] => C:\Users\Toucher\AppData\Local\MyComGames\MyComGames.exe [4912016 2016-06-01] (MY.COM B.V.)
HKU\S-1-5-21-1786193651-3707420613-66249313-1000\...\Run: [THPanel] => C:\Program Files (x86)\Thunder Master\THPanel.exe [2197472 2015-07-22] (Palit Microsystems Ltd.)
HKU\S-1-5-21-1786193651-3707420613-66249313-1000\...\Run: [Viber] => C:\Users\Toucher\AppData\Local\Viber\Viber.exe [69528656 2016-05-16] (Viber Media S.à r.l.)
HKU\S-1-5-21-1786193651-3707420613-66249313-1000\...\RunOnce: [Uninstall C:\Users\Toucher\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Toucher\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64"
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} =>  No File
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} =>  No File
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} =>  No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Server.lnk [2016-06-14]
ShortcutTarget: TotalMedia Server.lnk -> E:\Programs\Arcso0ft 6\TotalMedia Server\TM Server.exe (ArcSoft Inc.)
Startup: C:\Users\Toucher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2015-10-08]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Toucher\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
Startup: C:\Users\Toucher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk [2016-06-14]
ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe ()
BootExecute: autocheck autochk * Partizan

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{24391657-300c-4ff5-a09a-ac71143f522b}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6a438c3b-2aff-49a4-8215-0a213af9f262}: [DhcpNameServer] 8.8.8.8
Tcpip\..\Interfaces\{9553afc9-c9f4-4bf0-95a7-30041f1930a3}: [DhcpNameServer] 7.254.254.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-05-29] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-29] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-05-29] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-29] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Toucher\AppData\Roaming\Mozilla\Firefox\Profiles\4z1t2xlr.default
FF Homepage: hxxps://www.google.bg
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-17] ()
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-29] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-29] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-17] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-29] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll [2009-08-17] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-04-27] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-04-27] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> E:\Programs\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin HKU\S-1-5-21-1786193651-3707420613-66249313-1000: @my.com/Games -> C:\Users\Toucher\AppData\Local\MyComGames\NPMyComDetector.dll [2016-06-01] (MY.COM B.V.)
FF Extension: Adblock Plus - C:\Users\Toucher\AppData\Roaming\Mozilla\Firefox\Profiles\4z1t2xlr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [44736 2014-03-11] (ArcSoft, Inc.)
S2 AODService; C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [137584 2014-09-19] ()
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1362464 2016-06-04] ()
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-05-02] (NVIDIA Corporation)
S2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-05-02] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-05-02] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-05-02] (NVIDIA Corporation)
S2 PlaysService; C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe [32528 2016-06-07] (Plays.tv, LLC)
S2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-08-15] ()
R2 RzKLService; E:\Programs\Razer Cortex\RzKLService.exe [129168 2015-08-31] (Razer Inc.)
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7032080 2016-05-12] (TeamViewer GmbH)
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [818672 2016-05-11] (Tunngle.net GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
S2 WSServiceCrk; C:\WINDOWS\system32\wsservice_crk.dll [118272 2013-03-13] (DeadPihto) [File not signed]
S2 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdide64; C:\Windows\System32\drivers\amdide64.sys [11944 2013-03-08] (Advanced Micro Devices Inc.)
S3 AndNetDiag; C:\Windows\system32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
R2 AODDriver4.3.0; C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [60104 2014-09-19] (Advanced Micro Devices)
R1 ArcCtrl; C:\Windows\System32\drivers\ArcCtrl.sys [3315392 2013-11-20] ()
S1 archlp; C:\Windows\SysWow64\drivers\archlp.sys [161792 2009-02-06] ()
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2015-10-04] (Disc Soft Ltd)
S3 FIXUSTOR; C:\Windows\System32\DRIVERS\fixustor.sys [13696 2009-08-05] (GenesysLogic)
S3 GeneStor; C:\Windows\system32\DRIVERS\GeneStor.sys [117224 2015-09-21] (GenesysLogic)
S3 monectdevices; C:\Windows\System32\drivers\monectdevices.sys [15768 2013-12-03] ()
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
U0 Partizan; C:\Windows\SysWOW64\drivers\Partizan.sys [40304 2016-06-16] (Greatis Software)
S3 PGRUSB; C:\Windows\System32\DRIVERS\PGRXHCI.sys [119296 2015-03-04] (Point Grey Research) [File not signed]
R3 pikbd; C:\Windows\System32\drivers\pikbd.sys [22880 2013-11-30] (Christian Gulden)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [886528 2015-05-29] (Realtek                                            )
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-06-12] (Razer, Inc.)
R3 ScpVBus; C:\Windows\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
R3 tap0901t; C:\Windows\System32\drivers\tap0901t.sys [48824 2016-04-26] (Tunngle.net GmbH)
S3 USBET; C:\Windows\system32\DRIVERS\ETdrv.sys [6423168 2012-11-26] (Etron)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
U3 idsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-17 18:05 - 2016-06-17 18:05 - 00000000 ____D C:\FRST
2016-06-16 17:48 - 2016-06-16 17:48 - 00006802 _____ C:\WINDOWS\SysWOW64\PARTIZAN.TXT
2016-06-16 17:38 - 2016-06-16 17:38 - 00002092 _____ C:\Users\Public\Desktop\Raptr.lnk
2016-06-16 17:38 - 2016-06-16 17:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Raptr
2016-06-16 17:38 - 2016-06-16 17:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2016-06-16 17:37 - 2016-06-16 20:36 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\PlaysTV
2016-06-16 17:36 - 2016-06-17 10:44 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Raptr
2016-06-16 17:36 - 2016-06-16 17:37 - 00000000 ____D C:\Program Files (x86)\Raptr Inc
2016-06-16 17:36 - 2016-06-16 17:36 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\library_dir
2016-06-16 17:31 - 2016-06-16 17:31 - 00000000 ____D C:\Users\Toucher\AppData\Local\Deployment
2016-06-16 17:31 - 2016-06-16 17:31 - 00000000 ____D C:\Users\Toucher\AppData\Local\Apps\2.0
2016-06-16 13:36 - 2016-06-16 13:36 - 00000000 ____D C:\@RestoreQuarantine
2016-06-16 13:27 - 2016-06-16 13:27 - 00000000 ____D C:\ProgramData\RegRun
2016-06-16 13:26 - 2016-06-16 13:26 - 00040304 _____ (Greatis Software) C:\WINDOWS\SysWOW64\Drivers\Partizan.sys
2016-06-16 13:26 - 2016-06-16 13:26 - 00000002 RSHOT C:\WINDOWS\winstart.bat
2016-06-16 13:26 - 2016-06-16 13:26 - 00000002 RSHOT C:\WINDOWS\SysWOW64\CONFIG.NT
2016-06-16 13:26 - 2016-06-16 13:26 - 00000002 RSHOT C:\WINDOWS\SysWOW64\AUTOEXEC.NT
2016-06-16 13:25 - 2016-06-16 13:36 - 00000000 ____D C:\Users\Toucher\Documents\RegRun2
2016-06-16 13:25 - 2016-06-16 13:32 - 00000000 ____D C:\Users\Public\Documents\regruninfo
2016-06-16 13:25 - 2016-06-16 13:27 - 00000000 ____D C:\Program Files (x86)\UnHackMe
2016-06-16 13:25 - 2016-06-16 13:25 - 00003424 _____ C:\WINDOWS\System32\Tasks\UnHackMe Task Scheduler
2016-06-16 13:25 - 2016-06-16 13:25 - 00001076 _____ C:\Users\Toucher\Desktop\UnHackMe.lnk
2016-06-16 13:25 - 2016-06-16 13:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UnHackMe
2016-06-16 13:25 - 2016-04-05 15:17 - 00012808 _____ (Greatis Software, LLC.) C:\WINDOWS\SysWOW64\Drivers\UnHackMeDrv.sys
2016-06-16 13:25 - 2015-12-28 11:32 - 00049968 _____ (Greatis Software) C:\WINDOWS\system32\partizan.exe
2016-06-16 11:27 - 2016-06-16 11:27 - 00000918 _____ C:\Users\Toucher\Desktop\AIDA64 Extreme Edition.lnk
2016-06-16 11:19 - 2016-06-16 11:20 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\PortForward.com
2016-06-16 11:19 - 2016-06-16 11:19 - 00002421 _____ C:\Users\Public\Desktop\Port Forward Network Utilities.lnk
2016-06-16 11:19 - 2016-06-16 11:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PortForward.com
2016-06-16 11:19 - 2016-06-16 11:19 - 00000000 ____D C:\Program Files (x86)\Portforward
2016-06-14 13:56 - 2016-06-14 13:56 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_WinUSB_01007.Wdf
2016-06-14 13:54 - 2016-06-14 13:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PdaNet for Android
2016-06-14 13:54 - 2016-06-14 13:54 - 00000000 ____D C:\Program Files (x86)\PdaNet for Android
2016-06-14 13:54 - 2011-11-25 01:25 - 00015360 _____ (June Fabrics Technology Inc.) C:\WINDOWS\system32\Drivers\pneteth.sys
2016-06-14 13:39 - 2016-06-14 13:39 - 00000729 _____ C:\Users\Public\Desktop\TotalMedia Theatre 3.lnk
2016-06-14 13:39 - 2016-06-14 13:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft TotalMedia Theatre 3
2016-06-14 13:36 - 2016-06-14 13:36 - 00000000 ____D C:\WINDOWS\Downloaded Installations
2016-06-14 13:33 - 2016-06-14 13:33 - 00001124 _____ C:\Users\Toucher\Desktop\uLaunchTMT6 - Пряк път.lnk
2016-06-14 11:33 - 2016-05-24 12:35 - 00073948 _____ C:\Users\Toucher\Desktop\Gods.of.Egypt.2016.1080p.3D.BluRay.Half-OU.x264.DTS-JYK.srt
2016-06-14 11:28 - 2016-06-14 14:55 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\ArcSoft
2016-06-14 11:28 - 2016-06-14 11:28 - 00000000 ____D C:\Users\Toucher\Documents\ArcSoft
2016-06-14 11:12 - 2016-06-14 11:28 - 00000000 ____D C:\Users\Public\ArcSoft
2016-06-14 11:12 - 2016-06-14 11:12 - 00000873 _____ C:\Users\Public\Desktop\TotalMedia Theatre 6.lnk
2016-06-14 11:12 - 2016-06-14 11:12 - 00000000 ____D C:\Users\Toucher\AppData\Local\ArcSoft
2016-06-14 11:12 - 2016-06-14 11:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft TotalMedia Theatre 6
2016-06-14 11:12 - 2016-06-14 11:12 - 00000000 ____D C:\ProgramData\ArcSoft
2016-06-14 11:12 - 2013-11-20 09:57 - 03315392 _____ C:\WINDOWS\system32\Drivers\ArcCtrl.sys
2016-06-14 11:12 - 2013-09-14 14:54 - 00009883 _____ C:\WINDOWS\system32\Drivers\win81_64logo.cat
2016-06-14 11:12 - 2012-06-11 18:42 - 00080488 _____ (ArcSoft Inc.) C:\WINDOWS\system32\MMCEDT6.exe
2016-06-14 10:33 - 2016-06-16 08:49 - 00000000 ____D C:\Users\Toucher\AppData\LocalLow\uTorrent
2016-06-13 13:14 - 2016-06-13 13:30 - 00000000 ____D C:\Users\Toucher\Documents\The Witcher 3
2016-06-13 09:15 - 2016-06-13 09:15 - 00000000 ____D C:\WINDOWS\SysWOW64\directx
2016-06-12 22:21 - 2016-06-12 22:21 - 00001032 _____ C:\Users\Toucher\Desktop\TechPowerUp GPU-Z.lnk
2016-06-12 22:21 - 2016-06-12 22:21 - 00000000 ____D C:\Program Files (x86)\GPU-Z
2016-06-12 12:01 - 2016-06-12 12:09 - 00000000 ____D C:\Users\Toucher\Documents\StarCraft II
2016-06-12 07:51 - 2016-06-16 11:19 - 00000000 ____D C:\Users\Toucher\AppData\Local\Downloaded Installations
2016-06-12 07:51 - 2016-06-12 07:51 - 00002140 _____ C:\Users\Public\Desktop\AMD OverDrive.lnk
2016-06-12 07:51 - 2016-06-12 07:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD
2016-06-12 07:51 - 2016-06-12 07:51 - 00000000 ____D C:\Program Files (x86)\AMD
2016-06-11 17:08 - 2016-06-11 17:08 - 00000000 ____D C:\ProgramData\Synetic
2016-06-11 17:01 - 2016-06-11 17:01 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Crash Time 5 - Undercover
2016-06-10 11:02 - 2016-06-10 11:02 - 00000837 _____ C:\Users\Public\Desktop\Heroes of the Storm.lnk
2016-06-10 11:02 - 2016-06-10 11:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heroes of the Storm
2016-06-10 02:39 - 2016-06-10 02:39 - 00003370 _____ C:\WINDOWS\System32\Tasks\{7491E7FF-7528-472A-8CC9-F4E0E146865E}
2016-06-09 03:59 - 2016-04-27 14:31 - 00110528 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2016-06-09 03:59 - 2016-04-16 01:53 - 00130328 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2016-06-09 03:59 - 2016-04-16 01:53 - 00040216 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2016-06-09 03:59 - 2016-04-16 01:52 - 00130840 _____ C:\WINDOWS\system32\vulkan-1.dll
2016-06-09 03:59 - 2016-04-16 01:52 - 00045336 _____ C:\WINDOWS\system32\vulkaninfo.exe
2016-06-09 03:55 - 2016-04-27 17:33 - 42921920 _____ C:\WINDOWS\system32\nvcompiler.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 37567424 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 31598136 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 25350712 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 21365048 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 20906872 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 17756440 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 17369768 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 17350288 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 10550736 _____ C:\WINDOWS\system32\nvptxJitCompiler.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 08659472 _____ C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 02614208 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 02258368 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 01922496 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6436510.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 01573432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6436510.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00960056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00887744 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00753208 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00694208 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00678704 _____ C:\WINDOWS\system32\nvfatbinaryLoader.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00571912 _____ C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00546328 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00448824 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00175880 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00153392 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00151368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00129024 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00039240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll
2016-06-09 03:55 - 2016-04-27 17:33 - 00000139 _____ C:\WINDOWS\SysWOW64\nv-vk32.json
2016-06-09 03:55 - 2016-04-27 17:33 - 00000139 _____ C:\WINDOWS\system32\nv-vk64.json
2016-06-09 02:05 - 2016-06-09 02:06 - 00404268 _____ C:\WINDOWS\Minidump\060916-17406-01.dmp
2016-06-09 01:17 - 2016-06-09 02:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-06-08 14:29 - 2016-06-08 14:30 - 00396236 _____ C:\WINDOWS\Minidump\060816-16781-01.dmp
2016-06-08 13:30 - 2016-06-06 11:27 - 00081792 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\ucguard.sys
2016-06-08 08:42 - 2016-06-09 03:59 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2016-06-08 08:32 - 2016-06-03 10:22 - 01920960 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6436839.dll
2016-06-08 08:32 - 2016-06-03 10:22 - 01571776 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6436839.dll
2016-06-08 08:32 - 2016-04-27 17:33 - 17333344 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2016-06-08 07:03 - 2016-06-08 07:03 - 00000698 _____ C:\Users\Toucher\Desktop\KMPlayer.lnk
2016-06-08 07:03 - 2016-06-08 07:03 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
2016-06-07 11:06 - 2016-06-07 11:06 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\MPC-HC
2016-06-07 09:00 - 2016-06-07 09:00 - 00000000 ____D C:\Users\Toucher\AppData\Local\Sony Corporation
2016-06-07 08:59 - 2016-06-07 08:59 - 00002150 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PS4 Remote Play.lnk
2016-06-07 08:59 - 2016-06-07 08:59 - 00002138 _____ C:\Users\Public\Desktop\PS4 Remote Play.lnk
2016-06-07 08:59 - 2016-06-07 08:59 - 00000000 ____D C:\Program Files (x86)\Sony
2016-06-07 02:19 - 2016-06-07 02:19 - 00391148 _____ C:\WINDOWS\Minidump\060716-15734-01.dmp
2016-06-06 13:42 - 2016-06-06 13:42 - 00409044 _____ C:\WINDOWS\Minidump\060616-16859-01.dmp
2016-06-06 09:44 - 2016-06-06 09:45 - 08372118 _____ C:\Users\Toucher\Desktop\crashreport.nfo
2016-06-04 05:24 - 2016-06-04 05:24 - 00000211 _____ C:\Users\Toucher\Desktop\ARK Survival Of The Fittest.url
2016-06-03 23:57 - 2016-06-03 23:57 - 00001180 _____ C:\Users\Toucher\Desktop\DS4Windows - Пряк път.lnk
2016-06-03 02:03 - 2016-06-03 02:03 - 00081468 ____H C:\WINDOWS\SysWOW64\mlfcache.dat
2016-06-03 01:24 - 2016-06-03 01:24 - 00358236 _____ C:\WINDOWS\Minidump\060316-23296-01.dmp
2016-06-03 01:02 - 2016-06-03 01:49 - 00000000 ____D C:\ProgramData\2DBoy
2016-06-03 00:52 - 2016-06-03 00:52 - 00669696 _____ C:\Users\Toucher\Downloads\Setup.iso
2016-06-02 01:11 - 2016-06-02 01:12 - 00391084 _____ C:\WINDOWS\Minidump\060216-17218-01.dmp
2016-06-01 18:34 - 2016-06-01 18:34 - 00410660 _____ C:\WINDOWS\Minidump\060116-16515-01.dmp
2016-05-31 06:37 - 2016-06-09 02:05 - 00000000 ____D C:\WINDOWS\Minidump
2016-05-31 06:37 - 2016-05-31 06:37 - 00410692 _____ C:\WINDOWS\Minidump\053116-20609-01.dmp
2016-05-30 20:55 - 2016-05-30 20:55 - 00001109 _____ C:\Users\Toucher\Desktop\Counter-Strike 1.6 CSS Edition.lnk
2016-05-30 04:19 - 2016-05-30 04:19 - 00000000 ____D C:\Users\Toucher\Documents\TrialsFusion
2016-05-30 04:19 - 2016-05-30 04:19 - 00000000 ____D C:\ProgramData\SkidRow
2016-05-30 01:03 - 2016-05-30 01:03 - 00001168 _____ C:\Users\Public\Desktop\Trials Fusion - Awesome Level Max Edition.lnk
2016-05-29 23:14 - 2016-05-29 23:13 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2016-05-29 23:12 - 2016-05-29 23:12 - 00097344 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-05-29 22:18 - 2016-05-29 22:18 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\SmartSteamEmu
2016-05-29 21:46 - 2016-05-29 21:46 - 00000000 ____D C:\Users\Toucher\AppData\LocalLow\OldBlood Productions
2016-05-29 19:18 - 2016-05-29 19:18 - 00001040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-05-29 19:18 - 2016-05-29 19:18 - 00001028 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-05-27 00:13 - 2016-05-22 00:09 - 01581624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco64.dll
2016-05-27 00:13 - 2016-05-20 11:03 - 01922496 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6436822.dll
2016-05-27 00:13 - 2016-05-20 11:03 - 01573432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6436822.dll
2016-05-26 20:09 - 2016-05-26 20:37 - 00001311 _____ C:\Users\Toucher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Messenger.lnk
2016-05-26 20:09 - 2016-05-26 20:11 - 00000000 ____D C:\Users\Toucher\AppData\Local\Messenger
2016-05-26 20:09 - 2016-05-26 20:09 - 00001312 _____ C:\Users\Toucher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uninstall Messenger for Desktop.lnk
2016-05-26 20:09 - 2016-05-26 20:09 - 00001172 _____ C:\Users\Toucher\Desktop\Messenger.lnk
2016-05-26 20:09 - 2016-05-26 20:09 - 00000000 ____D C:\Program Files (x86)\Messenger for Desktop
2016-05-24 18:01 - 2016-05-30 22:00 - 00001127 _____ C:\Users\Toucher\Desktop\portal2 - Пряк път.lnk
2016-05-24 15:54 - 2016-05-24 15:54 - 00000000 ____D C:\Users\Toucher\AppData\Local\Viber

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-17 18:03 - 2015-10-04 13:55 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Skype
2016-06-17 17:43 - 2015-10-04 14:41 - 00000000 ____D C:\Users\Toucher\AppData\Local\Glyph
2016-06-17 17:35 - 2015-11-28 22:30 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-06-17 16:55 - 2015-10-21 06:09 - 00004208 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{257A3A5E-24E4-4DAC-8B93-2ECB998FFB9A}
2016-06-17 11:46 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-06-17 10:53 - 2015-10-30 10:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-06-16 21:01 - 2015-11-22 16:28 - 00000000 ____D C:\Users\Toucher\AppData\Local\CrashDumps
2016-06-16 18:21 - 2015-10-30 10:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-06-16 18:19 - 2015-10-21 03:27 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-06-16 18:06 - 2015-10-03 23:11 - 142482544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-06-16 17:53 - 2015-12-23 03:42 - 00000000 ____D C:\Users\Toucher
2016-06-16 17:48 - 2015-12-23 03:57 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-06-16 17:48 - 2015-12-23 03:39 - 00000000 ____D C:\ProgramData\NVIDIA
2016-06-16 17:44 - 2015-10-05 17:21 - 00000000 ____D C:\Users\Toucher\AppData\Local\Battle.net
2016-06-16 17:44 - 2015-10-05 17:20 - 00000000 ____D C:\Program Files (x86)\Battle.net
2016-06-16 13:39 - 2015-10-15 23:00 - 00000000 ____D C:\Program Files (x86)\SKILLBRAINS.del
2016-06-16 13:35 - 2015-10-15 23:00 - 00000059 _____ C:\Users\Toucher\AppData\Local\UserProducts.xml
2016-06-16 11:26 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-06-16 08:49 - 2015-10-04 00:12 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\uTorrent
2016-06-16 03:59 - 2015-10-30 10:21 - 00000000 ____D C:\WINDOWS\INF
2016-06-15 23:40 - 2010-11-21 06:27 - 00484008 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-06-15 10:21 - 2015-10-10 17:16 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\vlc
2016-06-14 20:31 - 2016-02-11 16:24 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\ViberPC
2016-06-14 19:53 - 2016-02-11 16:25 - 00000000 ____D C:\Users\Toucher\Documents\ViberDownloads
2016-06-14 13:58 - 2015-10-30 09:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-06-14 13:55 - 2015-10-03 23:34 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-06-12 12:02 - 2015-10-05 17:21 - 00000000 ____D C:\ProgramData\Blizzard Entertainment
2016-06-11 10:56 - 2015-10-04 13:54 - 00000000 ____D C:\ProgramData\Skype
2016-06-11 06:36 - 2016-05-10 19:33 - 00000000 ____D C:\Users\Toucher\Desktop\Нова папка
2016-06-11 05:36 - 2016-02-07 20:36 - 00000000 ____D C:\Users\Toucher\AppData\Local\ElevatedDiagnostics
2016-06-11 04:09 - 2015-10-07 22:02 - 00000000 ____D C:\Users\Toucher\AppData\Local\MyComGames
2016-06-11 04:05 - 2015-10-08 11:45 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My.com
2016-06-10 11:22 - 2015-10-05 17:22 - 00000000 ____D C:\Users\Toucher\Documents\Heroes of the Storm
2016-06-10 10:22 - 2015-10-05 17:21 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Battle.net
2016-06-09 04:00 - 2015-12-23 03:38 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-06-09 02:46 - 2015-10-19 21:48 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-06-09 02:43 - 2009-07-14 06:20 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2016-06-09 02:36 - 2015-10-03 23:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-08 09:15 - 2015-10-09 15:03 - 00000000 ____D C:\AdwCleaner
2016-06-06 10:41 - 2015-10-03 23:39 - 00001130 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-06-06 04:35 - 2016-05-17 23:24 - 00000000 ____D C:\Users\Toucher\AppData\Local\Ethash
2016-06-04 22:42 - 2015-10-05 03:10 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Tunngle
2016-06-04 22:37 - 2016-05-14 15:28 - 00000000 ____D C:\ProgramData\Tunngle
2016-06-04 19:36 - 2015-10-20 22:46 - 00000000 ____D C:\Users\Toucher\Documents\Assassin's Creed Unity
2016-06-03 02:00 - 2015-10-17 00:45 - 00000000 ____D C:\Users\Toucher\AppData\Local\Google
2016-06-03 02:00 - 2015-10-13 21:16 - 00000000 ____D C:\WINDOWS\system32\appmgmt
2016-06-03 02:00 - 2015-10-03 23:39 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\Mozilla
2016-06-03 01:16 - 2015-10-16 22:42 - 00000000 ____D C:\Program Files (x86)\PC Remote Receiver
2016-06-03 01:11 - 2015-10-20 03:18 - 00000000 ____D C:\Users\Toucher\AppData\Local\MicrosoftEdge
2016-05-31 06:37 - 2015-12-23 03:35 - 00197728 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-05-30 01:03 - 2015-10-20 22:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
2016-05-29 23:44 - 2015-10-12 06:23 - 00000000 ____D C:\ProgramData\Oracle
2016-05-29 23:14 - 2015-11-10 01:12 - 00000000 ____D C:\Program Files (x86)\Java
2016-05-29 23:14 - 2015-10-12 06:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-05-29 23:14 - 2015-10-12 06:23 - 00000000 ____D C:\Program Files\Java
2016-05-29 23:13 - 2015-10-12 06:23 - 00110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2016-05-29 23:13 - 2015-10-12 06:23 - 00000000 ____D C:\Users\Toucher\.oracle_jre_usage
2016-05-29 19:18 - 2015-11-08 22:44 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-05-28 23:51 - 2015-10-04 13:54 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-05-27 23:01 - 2015-10-20 03:08 - 00000000 ____D C:\Users\Toucher\AppData\Local\Packages
2016-05-27 00:14 - 2015-10-03 23:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2016-05-26 15:51 - 2015-10-10 16:58 - 00000000 ____D C:\Users\Toucher\AppData\Roaming\TeamViewer
2016-05-25 22:35 - 2015-12-23 03:41 - 01008216 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-25 21:52 - 2015-10-05 17:20 - 00000000 ____D C:\ProgramData\Battle.net
2016-05-18 00:32 - 2015-10-30 10:24 - 00000000 ____D C:\WINDOWS\rescache

==================== Files in the root of some directories =======

2015-10-11 21:08 - 2015-10-11 21:08 - 0000000 ___SH () C:\Users\Toucher\AppData\Local\LumaEmu
2015-10-11 22:06 - 2015-10-11 22:06 - 0007601 _____ () C:\Users\Toucher\AppData\Local\Resmon.ResmonCfg
2015-10-15 23:00 - 2015-10-15 23:00 - 0000003 _____ () C:\Users\Toucher\AppData\Local\updater.log
2015-10-15 23:00 - 2016-06-16 13:35 - 0000059 _____ () C:\Users\Toucher\AppData\Local\UserProducts.xml
2015-12-23 03:38 - 2015-12-23 03:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Toucher\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Toucher\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Toucher\AppData\Local\Temp\nvStInst.exe
C:\Users\Toucher\AppData\Local\Temp\playstv_patch.exe
C:\Users\Toucher\AppData\Local\Temp\raptrpatch.exe
C:\Users\Toucher\AppData\Local\Temp\rldfw32_s37k.dll
C:\Users\Toucher\AppData\Local\Temp\rldfw64_s76o.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-06-16 05:20

==================== End of FRST.txt ============================

Addition_17-06-2016_18-08-55.txt

Почти сме готови.

Включете System Restore, защото в момента е изключен:

http://windows.microsoft.com/bg-bg/windows/turn-system-restore-on-off#1TC=windows-7

 

След това:

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

И да проверим за остатъци:

 

СТЪПКА 1

 

• Изтеглете и стартирайте AdwCleaner.exe.
• Натиснете бутона Scan.
• AdwCleaner ще започне да проверява компютъра.
• След като проверката приключи натиснете бутона Clean.
• Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
• Ще се появи автоматично лог файл с името (AdwCleaner[S1].txt и  AdwCleaner[С1].txt) в C:\Adwcleaner
• Публикувайте съдържанието на  AdwCleaner[С1].txt в следващия си коментар.

 

СТЪПКА 2

 

Моля изтеглете Junkware Removal Tool на вашия десктоп.

• Спрете временно работата на защитните програми. Вижте тук ако се затруднявате как.
• Стартирайте инструмента JRT.exe
• Ще се отвори ДОС прозорец. Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
• Натиснете което и да е копче от клавиатурата.
• Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
• Моля копирайте съдържанието на лог файла в следващия си пост.

 

СТЪПКА 3

 

Моля изтеглете ZHPcleaner и я запазете на вашия десктоп.

• Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
• Кликнете върху за да се съгласите с лицензионното споразумение.
• Изберете бутона .
• Браузърите ще бъдат затворени автоматично.
• След края на проверката натиснете бутона Report
• Ще се създаде лог файл на десктопа. Публикувайте лог файла в следващия си коментар.

 

Поздрави!