Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Вирус във Facebook ми изпрати известие

Tihomir Borislavov
в Премахване на зловреден софтуер

Featured Replies

Привет! Попаднах на вируса, който сте описали в статията Ви през вчерашния ден -  https://www.kaldata.com/IT-Новини/Вирус-във-Facebook-ви-изпраща-известие-че-прият-111494.html#comment147333

Щом съм цъкнал на това известие във Фейсбук, то би трябвало и тази лепка да се е скрила някъде в системата ми. Проблемът е, че не я намирам нито с антивирусната ми Avast, нито с предложените от Вас онлайн скенери, така че не знам какво да предприема. Не забелязвам промени, нарушаващи нормалната работа на компютъра ми, като си чудя как действа този вирус ? 
Сега използвах Farbar Recovery Scan Tool и следвах стъпките. Нямам компакт диск с ОС...

-------------------------------------------------------------
FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-06-2016 02
Ran by Home-13 (administrator) on HOME-13-PC (27-06-2016 13:33:11)
Running from C:\Users\Home-13\Downloads
Loaded Profiles: Home-13 (Available Profiles: Home-13)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Английски (Съединени щати)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Sonix) C:\Windows\vsnp2uvc.exe
() C:\Users\Home-13\AppData\Roaming\ACEStream\engine\ace_engine.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Home-13\AppData\Roaming\ACEStream\updater\ace_update.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16408320 2016-02-22] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe [662016 2016-02-21] (Sonix)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-23] (AVAST Software)
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [73216 2016-03-03] ()
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
HKU\S-1-5-21-1396057926-368353360-4222259932-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8591272 2015-11-16] (Piriform Ltd)
HKU\S-1-5-21-1396057926-368353360-4222259932-1000\...\Run: [AceStream] => C:\Users\Home-13\AppData\Roaming\ACEStream\engine\ace_engine.exe [27000 2016-05-19] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => D:\Programi\Microsoft Office 2013 NEW\Office15\GROOVEEX.DLL [2014-05-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => D:\Programi\Microsoft Office 2013 NEW\Office15\GROOVEEX.DLL [2014-05-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => D:\Programi\Microsoft Office 2013 NEW\Office15\GROOVEEX.DLL [2014-05-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-02-20] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1 clients2.google.com 
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{90F2D629-0A9C-4B17-AA71-259709AE6C25}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-1396057926-368353360-4222259932-1000 -> {9732372A-5954-411C-8B35-E10A471B0BE2} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> D:\Programi\Microsoft Office 2013 NEW\Office15\OCHelper.dll [2014-05-21] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-02-20] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Programi\Microsoft Office 2013 NEW\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> D:\Programi\Microsoft Office 2013 NEW\Office15\GROOVEEX.DLL [2014-05-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-05-12] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-20] (AVAST Software)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-01-12] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-12] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - D:\Programi\Microsoft Office 2013 NEW\Office15\MSOSB.DLL [2014-04-01] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Home-13\AppData\Roaming\Mozilla\Firefox\Profiles\euddk203.default-1463038057752
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-17] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> D:\Programi\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-17] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-12] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-18] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin HKU\S-1-5-21-1396057926-368353360-4222259932-1000: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\Home-13\AppData\Roaming\ACEStream\player\npace_plugin.dll [2015-08-06] (Innovative Digital Technologies)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np32dsw.dll [2007-04-30] (Adobe Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-11-18] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Extension: Bitdefender QuickScan - C:\Users\Home-13\AppData\Roaming\Mozilla\Firefox\Profiles\euddk203.default-1463038057752\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2016-06-26]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-20]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-02-20]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF HKU\S-1-5-21-1396057926-368353360-4222259932-1000\...\Firefox\Extensions: [[email protected]] - C:\Users\Home-13\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi
FF Extension: Ace Stream Web Extension - C:\Users\Home-13\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi [2015-12-18]

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/
CHR StartupUrls: Default -> "hxxps://www.google.bg/"
CHR Profile: C:\Users\Home-13\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Диск) - C:\Users\Home-13\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-13]
CHR Extension: (YouTube) - C:\Users\Home-13\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-13]
CHR Extension: (Gmail) - C:\Users\Home-13\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-13]
CHR Profile: C:\Users\Home-13\AppData\Local\Google\Chrome\User Data\Profile 1
CHR HKU\S-1-5-21-1396057926-368353360-4222259932-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [hegneaniplmfjcmohoclabblbahcbjoe] - hxxp://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1396057926-368353360-4222259932-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-20]
CHR HKLM-x32\...\Chrome\Extension: [hegneaniplmfjcmohoclabblbahcbjoe] - hxxp://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-09-11] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-20] (AVAST Software)
R2 PSI_SVC_2_x64; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-08-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-02-20] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-03-23] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-03-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-02-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-02-20] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-03-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-02-23] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-02-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-02-20] (AVAST Software)
R3 DFX11_1; C:\Windows\System32\drivers\dfx11_1x64.sys [28008 2012-08-29] (Windows (R) Win 7 DDK provider)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-02-21] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-02-21] (Disc Soft Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2016-02-22] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-03-07] (REALiX(tm))
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [3567488 2016-02-21] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-27 13:33 - 2016-06-27 13:33 - 00015355 _____ C:\Users\Home-13\Downloads\FRST.txt
2016-06-27 13:33 - 2016-06-27 13:33 - 00000000 ____D C:\FRST
2016-06-27 13:25 - 2016-06-27 13:25 - 02389504 _____ (Farbar) C:\Users\Home-13\Downloads\FRST64.exe
2016-06-26 21:48 - 2016-06-26 21:48 - 00000000 ____D C:\Users\Home-13\AppData\Roaming\QuickScan
2016-06-26 19:11 - 2016-06-26 19:11 - 02870984 _____ (ESET) C:\Users\Home-13\Downloads\esetsmartinstaller_bgr.exe
2016-06-23 00:19 - 2016-06-23 00:26 - 00000000 ____D C:\Users\Home-13\Downloads\Нова папка
2016-06-22 22:20 - 2016-06-22 22:20 - 00040302 _____ C:\Users\Home-13\Downloads\OPL-Plovdiv.xlsx
2016-06-22 21:07 - 2016-06-22 21:07 - 01561382 _____ C:\Users\Home-13\Downloads\Obiava_podbor_OZMH.pdf
2016-06-22 21:07 - 2016-06-22 21:07 - 01509301 _____ C:\Users\Home-13\Downloads\Obiava_podbor_OZ.pdf
2016-06-22 15:37 - 2016-06-22 15:38 - 00403984 _____ C:\Users\Home-13\Downloads\JJD - Halcyon [NCS Release].mp3.sfk
2016-06-21 19:41 - 2016-06-21 19:41 - 00277134 _____ C:\Users\Home-13\Downloads\06TO.xlsx
2016-06-21 18:52 - 2016-06-21 18:53 - 00000000 ____D C:\Users\Home-13\Downloads\D.Brown - R.Nadal
2016-06-21 12:56 - 2016-06-22 10:15 - 00000000 ____D C:\Users\Home-13\Downloads\Quick Text Logo reveal template
2016-06-21 12:06 - 2016-06-21 12:11 - 00000000 ____D C:\Users\Home-13\Documents\FIFA 08
2016-06-21 12:02 - 2016-06-21 12:02 - 00000000 __RHD C:\Users\Home-13\AppData\Roaming\SecuROM
2016-06-19 16:10 - 2016-06-22 10:15 - 00000000 ____D C:\Users\Home-13\Downloads\Dragon Intro RKMFX
2016-06-19 15:59 - 2016-06-19 16:10 - 00000000 ____D C:\Users\Home-13\Downloads\Footage
2016-06-17 11:31 - 2016-06-17 11:31 - 01028352 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2016-06-17 11:31 - 2016-06-17 11:31 - 00082544 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2016-06-17 11:27 - 2016-06-17 11:27 - 00103424 _____ (Advanced Micro Devices) C:\Windows\system32\DelayAPO.dll
2016-06-17 11:27 - 2016-06-17 11:27 - 00096256 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\AtihdW76.sys
2016-06-17 11:24 - 2016-06-17 11:24 - 48616960 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll
2016-06-17 11:24 - 2016-06-17 11:24 - 27433472 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl12cl64.dll
2016-06-17 11:24 - 2016-06-17 11:24 - 21600768 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl12cl.dll
2016-06-17 11:24 - 2016-06-17 11:24 - 00865280 _____ (AMD) C:\Windows\system32\coinst_16.20.dll
2016-06-17 11:24 - 2016-06-17 11:24 - 00096256 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2016-06-17 11:24 - 2016-06-17 11:24 - 00087040 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2016-06-17 11:23 - 2016-06-17 11:24 - 38098944 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 30188032 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 27012096 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2016-06-17 11:23 - 2016-06-17 11:23 - 24836096 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 15711744 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 14302720 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 09798560 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 08655360 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdvlk64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 08577456 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 06965248 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmantle64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 06914048 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdvlk32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 05643776 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmantle32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 03471376 _____ C:\Windows\SysWOW64\atiumdva.cap
2016-06-17 11:23 - 2016-06-17 11:23 - 03437632 _____ C:\Windows\system32\atiumd6a.cap
2016-06-17 11:23 - 2016-06-17 11:23 - 01304576 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00973824 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00973824 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00873154 _____ C:\Windows\system32\amdicdxx.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00730112 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\amdlvr64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00711464 _____ C:\Windows\SysWOW64\atiapfxx.blb
2016-06-17 11:23 - 2016-06-17 11:23 - 00711464 _____ C:\Windows\system32\atiapfxx.blb
2016-06-17 11:23 - 2016-06-17 11:23 - 00605696 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\amdlvr32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00497664 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2016-06-17 11:23 - 2016-06-17 11:23 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00385536 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2016-06-17 11:23 - 2016-06-17 11:23 - 00368320 _____ C:\Windows\system32\ativvaxy_el_nd.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00322996 _____ C:\Windows\system32\ativvaxy_vi.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00322736 _____ C:\Windows\system32\ativvaxy_vi_nd.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00296648 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdacpksd.sys
2016-06-17 11:23 - 2016-06-17 11:23 - 00274432 _____ C:\Windows\system32\dgtrayicon.exe
2016-06-17 11:23 - 2016-06-17 11:23 - 00270784 _____ C:\Windows\system32\ativvaxy_stn_nd.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00270336 _____ (AMD) C:\Windows\system32\atitmm64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00266688 _____ C:\Windows\system32\ativvaxy_cz_nd.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00260852 _____ C:\Windows\system32\ativvaxy_FJ.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00258560 _____ C:\Windows\system32\GameManager64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00257872 _____ C:\Windows\system32\ativvaxy_FJ_nd.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00252928 _____ C:\Windows\system32\clinfo.exe
2016-06-17 11:23 - 2016-06-17 11:23 - 00251392 _____ C:\Windows\system32\hsa-thunk64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00230912 _____ C:\Windows\system32\amdgfxinfo64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00223744 _____ C:\Windows\SysWOW64\GameManager32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00217088 _____ C:\Windows\SysWOW64\hsa-thunk.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00212480 _____ C:\Windows\system32\atieah64.exe
2016-06-17 11:23 - 2016-06-17 11:23 - 00202752 _____ C:\Windows\SysWOW64\amdgfxinfo32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00190464 _____ C:\Windows\SysWOW64\atieah32.exe
2016-06-17 11:23 - 2016-06-17 11:23 - 00185344 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00177280 _____ C:\Windows\system32\ativce03.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00175584 _____ C:\Windows\system32\amde31a.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00166624 _____ C:\Windows\system32\amde34b.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00166624 _____ C:\Windows\system32\amde34a.dat
2016-06-17 11:23 - 2016-06-17 11:23 - 00159232 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00150544 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00142336 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantle64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00141280 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\amdhcp64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00141280 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdave64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00125288 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\amdhcp32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00122704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdave32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00119808 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atisamu64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00117760 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantle32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00113152 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\mantleaxl64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00109856 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00109856 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00106496 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00101376 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atisamu32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00093696 _____ (AMD) C:\Windows\system32\atimuixx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00092328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00092328 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00092160 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\mantleaxl32.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00091136 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00091136 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00050688 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdmmcl6.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00038400 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdmmcl.dll
2016-06-17 11:23 - 2016-06-17 11:23 - 00012893 _____ C:\Windows\system32\AMDKernelEvents.man
2016-06-17 09:45 - 2016-06-17 09:45 - 00000000 ____D C:\Windows\IObit
2016-06-13 15:57 - 2016-06-13 16:14 - 3352410112 _____ C:\Users\Home-13\Downloads\RG16.2016.05.29-31.R4.WS.Pironkova.BUL-Radwanska.POL.rutracker.org.mpg
2016-06-10 17:04 - 2016-06-10 18:15 - 1765351305 _____ C:\Users\Home-13\Downloads\D.Thiem - S.Groth.Stuttgart 2016.R2.HDTV.720.RUS.ENG.mkv
2016-05-29 17:27 - 2016-05-29 17:29 - 00000000 ____D C:\Users\Home-13\Downloads\WTA.2014.Sydney.Final.Kerber.vs.Pironkova.1080i.ENG.H264

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-06-27 13:23 - 2016-02-20 22:03 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-06-27 13:01 - 2016-03-13 01:48 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-27 12:49 - 2009-07-14 07:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-27 12:49 - 2009-07-14 07:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-27 12:43 - 2016-03-07 18:09 - 00002886 _____ C:\Windows\System32\Tasks\Driver Booster SkipUAC (Home-13)
2016-06-27 12:41 - 2016-02-20 21:11 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-06-27 12:40 - 2016-03-13 01:48 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-27 12:40 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-26 23:59 - 2016-03-22 21:30 - 00000000 ____D C:\Users\Home-13\AppData\Roaming\uTorrent
2016-06-24 18:36 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\inf
2016-06-24 17:29 - 2016-02-22 20:42 - 00000000 ____D C:\Users\Home-13\AppData\Roaming\PhotoScape
2016-06-24 17:29 - 2016-02-22 19:52 - 00000000 ____D C:\Users\Home-13\AppData\Roaming\DAEMON Tools Lite
2016-06-24 16:35 - 2016-02-27 13:54 - 00000132 _____ C:\Users\Home-13\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-06-21 18:05 - 2016-03-13 00:18 - 00000000 ____D C:\Users\Home-13\AppData\Roaming\.ACEStream
2016-06-21 12:06 - 2016-02-23 20:25 - 00000000 ___RD C:\Users\Home-13\Desktop\Games
2016-06-21 11:34 - 2016-03-06 17:02 - 00002912 _____ C:\Windows\System32\Tasks\Uninstaller_SkipUac_Home-13
2016-06-20 15:33 - 2016-02-23 23:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA SPORTS
2016-06-19 19:58 - 2009-07-14 08:08 - 00032666 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-06-18 13:54 - 2016-02-22 23:03 - 00000000 ____D C:\Users\Home-13\AppData\Roaming\Skype
2016-06-18 10:04 - 2016-03-13 01:48 - 00002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-18 09:54 - 2016-02-22 23:03 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-06-18 09:54 - 2016-02-22 23:03 - 00000000 ____D C:\ProgramData\Skype
2016-06-17 16:23 - 2016-02-20 22:03 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-17 16:23 - 2016-02-20 22:03 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-17 16:23 - 2016-02-20 22:03 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-17 11:31 - 2016-02-20 19:45 - 00116304 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2016-06-17 11:23 - 2016-05-08 18:05 - 08873608 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2016-06-17 11:23 - 2016-05-08 18:05 - 00137136 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2016-06-17 11:23 - 2016-02-21 12:42 - 08865344 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2016-06-17 11:23 - 2016-02-21 12:42 - 06999496 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2016-06-17 11:23 - 2016-02-21 12:42 - 01241296 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2016-06-17 11:23 - 2016-02-21 12:42 - 00123776 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2016-06-17 11:23 - 2013-09-12 05:42 - 10689528 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2016-06-17 11:23 - 2013-09-12 05:42 - 01510144 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2016-06-17 11:23 - 2013-09-12 05:42 - 00166488 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2016-06-17 11:23 - 2013-09-12 04:47 - 00588288 _____ (AMD) C:\Windows\system32\atieclxx.exe
2016-06-17 11:23 - 2013-09-12 04:46 - 00306688 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2016-06-17 11:10 - 2016-03-06 16:40 - 00000000 ____D C:\ProgramData\ProductData
2016-06-17 09:49 - 2016-05-11 23:55 - 00003866 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1463000120
2016-06-17 09:49 - 2016-05-11 23:55 - 00000000 ____D C:\Program Files (x86)\Opera
2016-06-17 09:45 - 2016-03-07 18:09 - 00003254 _____ C:\Windows\System32\Tasks\Driver Booster Scheduler
2016-06-17 09:45 - 2016-02-22 21:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 3
2016-06-15 18:43 - 2009-07-14 08:13 - 00781790 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-12 23:28 - 2016-02-20 23:40 - 00000000 ____D C:\Users\Home-13\AppData\Local\ElevatedDiagnostics
2016-06-03 11:48 - 2016-02-20 22:09 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-30 15:26 - 2016-02-20 22:03 - 00000000 ____D C:\Windows\SysWOW64\Macromed

==================== Files in the root of some directories =======

2016-02-27 13:54 - 2016-06-24 16:35 - 0000132 _____ () C:\Users\Home-13\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-02-21 18:01 - 2016-02-21 18:01 - 0007609 _____ () C:\Users\Home-13\AppData\Local\Resmon.ResmonCfg
2016-02-20 19:53 - 2016-02-20 19:53 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
C:\Users\Home-13\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Home-13\AppData\Local\Temp\drm_dyndata_7330014.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-06-17 14:01

==================== End of FRST.txt ============================

Addition.txt

Здравейте,

Съдейки по логовете системата изглежда напълно чиста и не видях никакви нежелани промени по системните настройки. Все пак направете следните проверки, след това  изчистете кеш файловете с Disk Cleanup на Windows или CCleaner и променете паролите си за всеки случай.

 

СТЪПКА1

 

Моля изтеглете Malwarebytes Anti-Malware 2.2.1.1043 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-2.2.1.1043.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

DkgJ7Zr.png

  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.

65ZBqkR.jpg

  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

СТЪПКА 2

 

1.Изтеглете Hitman Pro.

За 32-битова система - dEMD6.gif.
За 64-битова система - Download-button3.gif

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата 5vo5F.jpg и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 
6-scanfin-choose.jpg
 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар. Пак повтарям, не трийте нищо с програмата, защото е доста мощна и може да бъде опасна!

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар. :)

 

СТЪПКА 3

 

emsisoft_emergency_kit.pnglogo.png

  • Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
  • Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
  • Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.
  • След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
  • Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
  • Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
  • Натиснете Next за да започне проверката.
  • Когато проверката приключи натиснете бутона View Report.
  • Копирайте съдържанието на лог файла в следващия си коментар.

 

СТЪПКА 4

 

 

Изтеглете Публикувано изображение Security Check от screen317 от този линк и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.

Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия ви коментар в тази тема.

 

Поздрави! :)

  • Автор

Може и да съм късметлия, тъй като и аз не виждам засечен проблем в системата ми. :) Благодаря за помощта Ви! 
Emsisoft откри риск при файл на SpyHunter, които премахнах. Бях деинсталирал тази програма, но явно не се е изчистила докрай. При Sony Vegas няма да предприемам нищо, а за третия файл не знам въобще към какво се отнася. 
Искам да попитам за проблем с Adblock и въобще невъзможността да инсталирам разширения при Chrome. Изписва ми " Download interrupted " и дотам(така е с всички). Имам някаква лепка, която се откриваше единствено с SpyHunter, но ми иска регистрация и няма как да я премахна... Някакви идеи ?  

Malwarebytes Anti-Malware
www.malwarebytes.org

Дата на сканиране: 28.6.2016 г.
Час на сканиране: 14:52 ч.
Дневник: 
Администратор: Да

Версия: 2.2.1.1043
База от данни за злонамерен софтуер: v2016.06.28.03
База от данни за рууткити: v2016.05.27.01
Лиценз: Пробен период
Защита от злонамерен софтуер: Разрешено
Защита от злонамерени страници: Разрешено
Самозащита: Забранено

ОС: Windows 7 Service Pack 1
Процесор: x64
Файлова система: NTFS
Потребител: Home-13

Тип сканиране: Сканиране за заплахи
Резултат: Завършено
Сканиране обекти: 355228
Изминало време: 20 мин. 30 сек.

Памет: Разрешено
Начално стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
Рууткити: Разрешено
Евристика: Разрешено
ПНП: Разрешено
ПНИ: Разрешено

Процеси: 0
(Не бяха открити злонамерени обекти)

Модули: 0
(Не бяха открити злонамерени обекти)

Ключове в системния регистър: 0
(Не бяха открити злонамерени обекти)

Стойности в системния регистър: 0
(Не бяха открити злонамерени обекти)

Данни в системния регистър: 0
(Не бяха открити злонамерени обекти)

Папки: 0
(Не бяха открити злонамерени обекти)

Файлове: 0
(Не бяха открити злонамерени обекти)

Физически сектори: 0
(Не бяха открити злонамерени обекти)


(end)

-----------------------------------------------------------
 

code]
HitmanPro 3.7.14.265
www.hitmanpro.com

   Computer name . . . . : HOME-13-PC
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Home-13-PC\Home-13
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (Expired)

   Scan date . . . . . . : 2016-06-28 19:13:01
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 34s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 2
   Traces  . . . . . . . : 5

   Objects scanned . . . : 1 456 806
   Files scanned . . . . : 21 908
   Remnants scanned  . . : 207 985 files / 1 226 913 keys

Malware _____________________________________________________________________

   C:\Program Files\Sony\Vegas Pro 13.0\vegas.pro.13.0.(64-bit)-patch.exe
      Size . . . . . . . : 899 072 bytes
      Age  . . . . . . . : 126.9 days (2016-02-22 20:44:00)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : E4B70283AC7BF50BC038F501FF19343C111BF1246B3E5E75744A736745ED22A5
    > Bitdefender  . . . : Gen:Variant.Kazy.365498
      Fuzzy  . . . . . . : 106.0
      References
         HKU\S-1-5-21-1396057926-368353360-4222259932-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Sony\Vegas Pro 13.0\vegas.pro.13.0.(64-bit)-patch.exe

   C:\Users\Home-13\AppData\Local\Temp\HYD990A.tmp.1463572434\HTA\3rdparty\OCSetupHlp.dll
      Size . . . . . . . : 1 037 312 bytes
      Age  . . . . . . . : 41.2 days (2016-05-18 14:53:57)
      Entropy  . . . . . : 6.5
      SHA-256  . . . . . : 1A8A8C6849F047E750906941CB5E50EC5266BE9FDE24261AE31B8156CC2E072F
      Product
      Publisher
      Description
      Version  . . . . . : 2.1.0.89
      Copyright
      LanguageID . . . . : 1033
    > Kaspersky  . . . . : not-a-virus:AdWare.Win32.OpenCandy.bv
    > HitmanPro  . . . . : App/OpenCndy-O
      Fuzzy  . . . . . . : 103.0


Suspicious files ____________________________________________________________

   C:\Users\Home-13\Downloads\FRST64.exe
      Size . . . . . . . : 2 389 504 bytes
      Age  . . . . . . . : 1.2 days (2016-06-27 13:25:15)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : 44FBA54F99DD0F3F3C091D466016312489CAC8D9D42E804724ABBD3BB02AB5FB
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.


Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-1396057926-368353360-4222259932-1000\Software\Conduit\ (Conduit)


[/code]


---------------------------------------------------------------------------------------------------


Emsisoft:

Emsisoft Emergency Kit - Version 11.0
Last update: 28.6.2016 г. 16:34:26
User account: Home-13-PC\Home-13

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off

Scan start:    28.6.2016 г. 16:35:58
Key: HKEY_USERS\S-1-5-21-1396057926-368353360-4222259932-1000\SOFTWARE\CONDUIT     detected: Application.InstallAd (A)
C:\Program Files (x86)\Enigma Software Group\SpyHunter\spyhunter.4.3.32-patch.exe     detected: Application.HackTool.DX (B)
C:\Program Files\Sony\Vegas Pro 13.0\vegas.pro.13.0.(64-bit)-patch.exe     detected: Riskware.Win32.HackTool (A)

Scanned    203267
Found    3

Scan end:    28.6.2016 г. 17:05:02
Scan time:    0:29:04

-----------------------------------------------------------
Security Check:

Results of screen317's Security Check version 1.014 --- 12/23/15  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 91  
 Java version 32-bit out of Date! 
 Adobe Flash Player 22.0.0.192  
 Mozilla Firefox (46.0.1) 
 Google Chrome (51.0.2704.103) 
 Google Chrome (51.0.2704.84) 
 Google Chrome (SetupMetrics.pma..) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malware Bite Malwarebytes Anti-Malware mbamscheduler.exe  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast avastui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C: 0% 
````````````````````End of Log`````````````````````` 

---------------------------------------------------------------------

 

Редактирано от Tihomir Borislavov (преглед на промените)

Не ползвам Google Chrome, но доколкото прочетох проблема не е заради зараза, а заради липсва на права на писане в папката, която е избрана за изтегляне на файловете. Пробвайте да смените папката и вижте дали проблема остава. Пишете и коя е била папката избрана в момента за да преценим дали липсата на права е нормално за нея. Вижте следните статии как да смените папката по подразбиране или да направите браузъра да ви пита всеки път къде да запазите файловете си (лично аз в Mozilla съм задал да ме пита всеки път къде да запазя файловете си).

https://support.google.com/chrome/answer/95759?co=GENIE.Platform%3DDesktop&hl=bg
http://www.wikihow.com/Change-Google-Chrome-Downloads-Settings
http://www.howtogeek.com/231002/how-to-change-the-chrome-download-folder-location/

А иначе логовете са чисти. Има само един tmp файл с OpenCandy в %temp% папката (с временно съдържание), но при пускането на Disk Cleanup на Windows или CCleaner папката ще бъде почистена. Има и един ключ в регистрите, който може да бъде изтрит.

В търсачката на Windows въведете CMD.exe => кликнете с десен бутон върху CMD.exe и изберете Run as administrator. С десен бутон Copy копирайте следната команда:

reg delete "HKU\S-1-5-21-1396057926-368353360-4222259932-1000\Software\Conduit" /f

и с десен бутон Paste я поставете в CMD.exe и натиснете Enter.

Пишете дали ключа е бил успешно изтрит.

Използвайте PatchMyPC за да обновите и старите си програми.

Поздрави!

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.