Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
Ran by JH (administrator) on ЖИВКО-PC (02-07-2016 11:53:31)
Running from F:\1Downloads
Loaded Profiles: JH (Available Profiles: JH)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Bulgarian (Bulgaria)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
() C:\Windows\SysWOW64\ASGT.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Power Software Ltd) C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
() D:\Programs\Winamp\winampa.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Windows\USB Vibration\7906\USB Gamepad.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [357384 2009-09-12] (Acronis)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [5006536 2016-03-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-06] (Intel Corporation)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5048488 2009-09-12] (Acronis)
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [336992 2012-12-09] (Power Software Ltd)
HKLM-x32\...\Run: [WinampAgent] => D:\Programs\Winamp\winampa.exe [36352 2008-03-27] ()
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation)
HKLM-x32\...\Run: [USB Gamepad] => C:\Windows\USB Vibration\7906\USB Gamepad.exe -boot
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58640 2016-04-05] (Raptr, Inc)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2775757902-3594406490-645611471-1001\...\Run: [Sony PC Companion] => "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" /Background
HKU\S-1-5-21-2775757902-3594406490-645611471-1001\...\MountPoints2: G - G:\setup.exe
HKU\S-1-5-21-2775757902-3594406490-645611471-1001\...\MountPoints2: H - H:\setup.exe
HKU\S-1-5-21-2775757902-3594406490-645611471-1001\...\MountPoints2: {6dfaf1cc-a72f-11e2-8688-bc5ff462820f} - H:\Startme.exe
HKU\S-1-5-21-2775757902-3594406490-645611471-1001\...\MountPoints2: {8a457e20-0ab0-11e5-a35b-bc5ff462820f} - H:\LG_PC_Programs.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-20] (Microsoft Corporation)
BootExecute: autocheck autochk * auto_reactivate \\?\Volume{e9503849-8d68-11e2-9a17-806e6f6e6963}\bootwiz\asrm.bin

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{E061E311-1B32-461A-82DF-83376EA33577}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{F6B38898-51AF-4113-BC50-38125FC69D80}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2775757902-3594406490-645611471-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-2775757902-3594406490-645611471-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-04-23] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-23] (Oracle Corporation)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> E:\BitComet\tools\BitCometBHO_1.3.7.16.dll [2009-07-16] (BitComet)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-23] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-23] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\JH\AppData\Roaming\Mozilla\Firefox\Profiles\8hug8qdx.default-1465928481228
FF Homepage: www.gong.bg
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-17] ()
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-23] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-03-15] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-17] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-23] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-23] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-03-15] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Extension: uBlock Origin - C:\Users\JH\AppData\Roaming\Mozilla\Firefox\Profiles\8hug8qdx.default-1465928481228\Extensions\[email protected] [2016-06-23]
FF HKLM\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2013-04-18] [not signed]
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

Chrome:
=======
CHR StartupUrls: Profile 2 -> "hxxp://www.google.bg/"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.103\PepperFlash\pepflashplayer.dll ()
CHR Profile: C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Документи) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-07]
CHR Extension: (Google Диск) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-11]
CHR Extension: (Google Търсене) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-24]
CHR Extension: (Google Документи офлайн) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-05]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-23]
CHR Extension: (Gmail) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR Profile: C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (Google Презентации) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-27]
CHR Extension: (Google Документи) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-27]
CHR Extension: (Google Диск) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-27]
CHR Extension: (YouTube) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-27]
CHR Extension: (Google Търсене) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Електронни таблици от Google) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-10-27]
CHR Extension: (Google Документи офлайн) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Gmail) - C:\Users\JH\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-27]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2120712 2016-05-09] (Electronic Arts)
S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) [File not signed]
S3 WatAdminSvc; C:\Windows\system32\Wat\WatAdminSvc.exe [1255736 2013-03-15] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
S3 h647906; C:\Windows\System32\drivers\h647906.sys [62576 2008-12-01] (Your Corporation)
S3 hid7906; C:\Windows\SysWOW64\drivers\hid7906.sys [41096 2008-12-01] (Your Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-01] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-01] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-01] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-01] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-01] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-01] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-01] (MCCI Corporation)
R0 tdrpman251; C:\Windows\System32\DRIVERS\tdrpm251.sys [1455648 2013-03-15] (Acronis)
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-02 11:52 - 2016-07-02 11:53 - 00000000 ____D C:\FRST
2016-07-01 12:13 - 2016-07-02 08:57 - 00027612 _____ C:\IFRToolLog.txt
2016-07-01 11:43 - 2016-07-02 11:11 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-01 11:43 - 2016-07-01 11:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-07-01 11:43 - 2016-07-01 11:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-07-01 11:43 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-07-01 11:43 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-07-01 11:43 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-07-01 11:40 - 2016-07-01 11:40 - 00000000 ____D C:\AdwCleaner
2016-06-28 18:18 - 2016-06-28 18:18 - 00000082 _____ C:\Users\JH\Desktop\za bradavici  porychano dostavka do 48 chasa.txt
2016-06-14 21:26 - 2016-06-15 09:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-14 21:26 - 2016-06-14 21:40 - 00001159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-06-14 21:26 - 2016-06-14 21:26 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-06-12 12:19 - 2016-06-12 12:19 - 00000000 ____D C:\Windows\SysWOW64\directx

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-02 11:27 - 2013-06-20 08:54 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-02 11:17 - 2015-07-16 10:06 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d0bf95e2a25aa1.job
2016-07-02 11:11 - 2015-05-15 14:59 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d08f06a1b10f97.job
2016-07-02 11:10 - 2015-12-04 15:12 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d12e8d9a5d031.job
2016-07-02 11:09 - 2015-07-16 10:06 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0bf95e27137c9.job
2016-07-02 11:04 - 2014-06-23 22:40 - 00000998 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8f1aefdceab4.job
2016-07-02 10:44 - 2009-07-14 07:45 - 00023312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-02 10:44 - 2009-07-14 07:45 - 00023312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-02 10:11 - 2015-05-15 14:59 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d08f06a1878dfb.job
2016-07-02 09:10 - 2016-01-31 18:11 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d15c39b2c48f72.job
2016-07-02 08:41 - 2015-12-04 15:12 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d12e8d9338e24.job
2016-07-02 08:41 - 2015-08-30 11:04 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0e2fa8a8d2829.job
2016-07-02 08:41 - 2014-03-29 11:23 - 00000994 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf4b283a744eee.job
2016-07-02 08:41 - 2013-03-15 10:41 - 00000992 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-02 08:41 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-01 20:59 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\Registration
2016-07-01 11:57 - 2009-07-14 10:46 - 00000000 ____D C:\Windows\ShellNew
2016-06-30 14:12 - 2013-04-14 20:37 - 00000000 ____D C:\Users\JH\AppData\Roaming\Skype
2016-06-28 11:48 - 2015-08-04 16:07 - 00003350 _____ C:\Windows\System32\Tasks\ESET Windows 10 upgrade – Refresh settings
2016-06-27 15:31 - 2015-11-09 18:21 - 00000000 ____D C:\Users\JH\AppData\Local\CrashDumps
2016-06-23 17:00 - 2015-12-26 15:54 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-06-23 17:00 - 2013-03-15 10:43 - 00000000 ____D C:\ProgramData\Skype
2016-06-18 09:05 - 2013-03-15 10:42 - 00002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-18 09:05 - 2013-03-15 10:42 - 00002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-06-17 17:56 - 2015-09-03 18:04 - 00000000 ____D C:\Users\JH\AppData\Roaming\Milestone
2016-06-17 16:41 - 2016-04-03 10:34 - 00000000 ____D C:\Users\JH\AppData\Roaming\uTorrent
2016-06-17 14:27 - 2013-06-20 08:54 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-17 13:27 - 2013-06-20 08:54 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-17 13:27 - 2013-03-15 22:10 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-15 16:59 - 2014-12-22 17:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\THQ
2016-06-14 21:40 - 2015-09-23 19:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-06-13 21:21 - 2014-02-11 21:23 - 00000000 ____D C:\Users\JH\AppData\Local\ElevatedDiagnostics
2016-06-08 08:45 - 2016-04-05 11:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2016-06-04 12:47 - 2015-10-31 14:05 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-06-04 12:01 - 2016-04-18 16:50 - 00000644 _____ C:\Users\Public\Desktop\FIFA 16.lnk
2016-06-04 11:58 - 2014-09-12 16:49 - 00000000 ____D C:\ProgramData\Origin

==================== Files in the root of some directories =======

2016-01-04 13:31 - 2002-12-12 00:11 - 4085904 _____ (Microsoft Corporation) C:\Program Files (x86)\wmfdist.exe
2016-01-04 13:31 - 2003-04-15 21:27 - 0793536 _____ (Microsoft Corporation) C:\Program Files (x86)\wmpcdcs8.exe
2015-10-29 23:20 - 2015-11-06 10:39 - 1065984 _____ () C:\Users\JH\AppData\Local\file__0.localstorage
2013-12-13 21:10 - 2016-02-03 11:26 - 0007619 _____ () C:\Users\JH\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
C:\Users\JH\AppData\Local\Temp\amd-catalyst-15.7.1-without-dotnet45-win7-64bit.exe
C:\Users\JH\AppData\Local\Temp\ExPromo.exe
C:\Users\JH\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\JH\AppData\Local\Temp\jre-8u66-windows-au.exe
C:\Users\JH\AppData\Local\Temp\jre-8u71-windows-au.exe
C:\Users\JH\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\JH\AppData\Local\Temp\jre-8u91-windows-au.exe
C:\Users\JH\AppData\Local\Temp\MBSetup_uvd-loader.exe
C:\Users\JH\AppData\Local\Temp\NSISPromotionEx.dll
C:\Users\JH\AppData\Local\Temp\playstv_patch.exe
C:\Users\JH\AppData\Local\Temp\raptrpatch.exe
C:\Users\JH\AppData\Local\Temp\raptr_stub.exe
C:\Users\JH\AppData\Local\Temp\sfamcc00001.dll
C:\Users\JH\AppData\Local\Temp\sfamcc00002.dll
C:\Users\JH\AppData\Local\Temp\sfamcc00003.dll
C:\Users\JH\AppData\Local\Temp\sfextra.dll
C:\Users\JH\AppData\Local\Temp\SIntf16.dll
C:\Users\JH\AppData\Local\Temp\SIntf32.dll
C:\Users\JH\AppData\Local\Temp\SIntfNT.dll
C:\Users\JH\AppData\Local\Temp\tmp1313.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2013-03-16 11:40] - [2010-11-20 16:27] - 1008640 ____A (Microsoft Corporation) E573BD9AB55C8E333C202B9E255F972E

C:\Windows\SysWOW64\User32.dll
[2013-03-24 12:31] - [2013-03-24 12:32] - 0833024 ____A (Microsoft Corporation) 2C9CC9F492CA596B1B9FC1AE5E916356

C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-10-21 12:57

==================== End of FRST.txt ============================

Addition.txt

Здравейте,

Някакво описание на проблема ще предоставите ли, защото гадаенето не е от силните ми страни.

Поздрави!

Бях пуснал тема,тъй като имах голямо натоварване на svchost.exe,казаха че би могло да се дължи и на вирус,и след като направих сканиране антивирусната ми откри няколко вируса и ме посъветваха да пусна тема,ето какво откри антивирусната от днес

Може ли да видя лог файла от Eset. Ето как:

http://support.eset.com/kb3217/?viewlocale=en_US

Иначе в логовете не видях активни зарази, но ще се опитаме да проследим източника на проблема.

Поздрави!

проблема е че нещо не се получава както трябва

computer scan.txt

Добре. Направете нова снимка на намерените от ESET неща, но разпънете колонките за да се види пълния път на файловете и наименованието на засечените обекти (т.е. колонките ИМЕ и ЗАПЛАХА). Колонката Действие не ми е необходима.

Освен това направете следното:

Изтеглете Process Explorer.

Разархивирайте инструмента и стартирайте файла procexp.exe

От менюто View сложете отметки пред Show Lower Pane, а на Lower Pane View => сложете отметка пред DLLs.

От менюто View отидете до "Select Columns" и сложете отметки пред следните елементи:

Description, Company Name, Image Path, Command Line, Autostart Location и натиснете OK.

Намерете и посочете проблемния svchost.exe и натиснете минуса пред процеса за да се покажат всички процеси закачени за него и направете снимка на екрана.

След това кликнете с двукратен клик върху процеса. Отидете до секцията Services и направете снимка на екрана.

След това отидете до секцията Threads. Разпънете графата така че да се виждат по-възможност всички обекти/нишки.Направете снимка на прозореца.

Докато сте в менюто Threads, кликнете с двукратек клик на мишката върху даден обект и направете снимка на Stack прозореца. Вече можете да затворите Threads и Stack прозорците.

Сега докато сте на процеса, който товари най-много отидете в Process Explorer на File => Save as.

Запазете документа на десктопа с някакво име.

След това прикачете всички документи в следващия си коментар.Направените снимки (screenshots) ги качете тук (например или друг удобен за вас хостинг).

Публикувайте линкове към снимките за да ги разгледам в следващия си пост.

може би антивирусната ми е изтрила вирусите,тъй като преди малко като направих сканиране ми излизи това

въпреки че тук ми изписва че има изтрит само един обект 

 

за svchost.exe 

http://imgur.com/a/PwJJ8

svchost.exe.txt

Редактирано 4 юли 201610 г. от bussdee (преглед на промените)

Мисля, че нещо не се разбрахме. Аз исках да ми покажете отново снимката от този пост, а не да сканирате отново. Просто исках да разпънете колонките за да се виждат по-добре и да заснемете екрана отново.

Колкото до процеса svchost.exe => прекарах ви по-трудния път, защото не мислех, че проблема ще е отново в Windows Update. Но тъй като в предишната ви тема ви казаха да изключите Windows Update услугата и вие казахте, че сте го направили, но проблема продължава и затова заключих, че при вас случая е друг. Е да, ама не. Според информацията от Process Explorer проблема е точно в Windows Update.

Вижте следната тема за евентуални решения =>

Поздрави!