изчезване на google chrome

17 август 201610 г.

При изтегляне на ел.книги се прикачи .ехе- файл. Не е стартиран от мен, но веднага се промени браузера и се замени с друга търсачка. В последствие Google Chrome се блокира и изчезна. Проверих и InternetExplorer и той дава съобщение за инфекция и е променен.

17 август 201610 г.

Здравейте,

Следвайте инструкциите от следната тема => Системата ми е инфектирана - Какво да правя сега?

17 август 201610 г.

Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by Vision (administrator) on VISION-PC (17-08-2016 19:55:27)
Running from C:\Users\Vision\Downloads
Loaded Profiles: Vision (Available Profiles: Vision)
Platform: Windows 8.1 Pro (Update) (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
() C:\Program Files (x86)\LuckyBrowse\app\LuckyBrowse.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDGesture.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spotify Ltd) C:\Users\Vision\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2893576 2013-08-02] (ELAN Microelectronics Corp.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2463552 2014-10-04] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Ad Muncher] => "C:\Program Files (x86)\Ad Muncher\AdMunch.exe" /bt
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.jse <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION
HKLM Group Policy restriction on software: *:\$Recycle.Bin <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.js <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.js <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.bat <====== ATTENTION
HKLM Group Policy restriction on software: ** <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.jse <====== ATTENTION
HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.js <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.js <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: C:\Users\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.js <====== ATTENTION
HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\utorrent\utorrent.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\utorrent\utorrent.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\utorrent\utorrent.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\spotify\spotify_new.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\spotify\wow_helper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\spotify\wow_helper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\spotify\spotify.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\spotify\spotifylauncher.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\spotify\spotifywebhelper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\spotify\wow_helper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\spotify\spotify_new.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\spotify\spotifywebhelper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\spotify\spotify_new.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\spotify\wow_helper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\spotify\spotifywebhelper.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\spotify\spotifylauncher.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\spotify\spotify_new.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\spotify\spotify.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\spotify\spotify.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\spotify\spotifylauncher.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\utorrent\utorrent.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Local\spotify\spotifycrashservice.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\spotify\spotifylauncher.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\spotify\spotifycrashservice.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\spotify\spotifycrashservice.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\spotify\spotify.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\spotify\spotifycrashservice.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\spotify\spotifywebhelper.exe <====== ATTENTION
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [Mobile Partner] => C:\Program Files (x86)\MobileWiFi\MobileWiFi
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [Spotify Web Helper] => C:\Users\Vision\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1553520 2016-08-14] (Spotify Ltd)
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [Flvto YouTube Downloader] => "C:\Users\Vision\AppData\Local\Flvto YouTube Downloader\FlvtoYoutubeDownloader.exe" /minimize
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [26424960 2016-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [Chromium] => "c:\users\vision\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\...\Run: [GoogleDriveSync] => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11776 2014-10-29] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2014-08-28]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

AutoConfigURL: [S-1-5-21-397514922-2584020372-3024867149-1001] => hxxp://stoppblock.org/wpad.dat?b14c4b92feacc5d814cd7497d971af3a14604895
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 212.50.2.202 192.168.10.10
Tcpip\..\Interfaces\{49E0855E-A0B8-4A7F-BFD2-B0CC17A0C002}: [DhcpNameServer] 212.50.2.202 192.168.10.10
Tcpip\..\Interfaces\{9B5BB117-4709-4F53-8AC7-90BACF5A162C}: [DhcpNameServer] 192.168.178.1
ManualProxies: 0hxxp://stoppblock.org/wpad.dat?b14c4b92feacc5d814cd7497d971af3a14604895

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://it.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://it.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro
HKU\S-1-5-21-397514922-2584020372-3024867149-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://bing.com/
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-397514922-2584020372-3024867149-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKU\S-1-5-21-397514922-2584020372-3024867149-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-15] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-10-23] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-10-23] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-11-12] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-11-12] (Microsoft Corporation)

Chrome:
=======
CHR HomePage: ghiqerghtquqoleatuzuch -> hxxp://www.trotux.com/?z=6ca48ef27bb52934ad35c36gez5m4g5zdz0bco9qaw&from=epf1&uid=HGSTXHTS721010A9E630_JR10006PHBTULEHBTULEX&type=hp
CHR StartupUrls: ghiqerghtquqoleatuzuch -> "hxxp://www.trotux.com/?z=6ca48ef27bb52934ad35c36gez5m4g5zdz0bco9qaw&from=epf1&uid=HGSTXHTS721010A9E630_JR10006PHBTULEHBTULEX&type=hp"
CHR DefaultSearchURL: ghiqerghtquqoleatuzuch -> hxxp://www.trotux.com/search/?q={searchTerms}&z=6ca48ef27bb52934ad35c36gez5m4g5zdz0bco9qaw&from=epf1&uid=HGSTXHTS721010A9E630_JR10006PHBTULEHBTULEX&type=sp
CHR DefaultSearchKeyword: ghiqerghtquqoleatuzuch -> trotux
CHR Profile: C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Презентации) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-04-24]
CHR Extension: (Google Документи) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-24]
CHR Extension: (Google Диск) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-24]
CHR Extension: (BeFunky Photo Editor) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\apfkepiiddolifkgjmfdgpnipgnfejab [2016-04-24]
CHR Extension: (YouTube) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-24]
CHR Extension: (Photovisi - Photo Collage Maker) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\emkkfkcbnpdnhgeolpbggbdogfngiadf [2016-04-24]
CHR Extension: (Електронни таблици от Google) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-04-24]
CHR Extension: (EBook Offline Reader) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkidldjfpemdgkehdhkoehplkbkcadfa [2016-04-24]
CHR Extension: (Google Документи офлайн) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-24]
CHR Extension: (AdBlock) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-07-29]
CHR Extension: (FB2 Reader) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\imcncdfdhemlpcblfkilloceahbhddnj [2016-04-24]
CHR Extension: (Pixeffect - Photo Effects) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\koekplodmdaalggcclajcecoomipnpca [2016-04-24]
CHR Extension: (Facebook Cover Maker) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfbpohdhflnokmclkbieabhmhbnamcnk [2016-04-24]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-24]
CHR Extension: (Gmail) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-24]
CHR Extension: (Chrome Media Router) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-17]
CHR Extension: (FB Translate) - C:\Users\Vision\AppData\Local\Google\Chrome\User Data\Default\Extensions\plofenifjagmdikfcobngnfmmnfmphin [2016-08-17]
CHR HKLM\...\Chrome\Extension: [fcimjkehglmijlhnpbmjbpoiamjiegod] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-397514922-2584020372-3024867149-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-397514922-2584020372-3024867149-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-08] (Broadcom Corporation.)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100104 2013-08-02] (ELAN Microelectronics Corp.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-10-04] (NVIDIA Corporation)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-02-06] ()
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [827392 2013-09-02] (Intel(R) Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-10-23] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-10-04] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-10-04] (NVIDIA Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [685568 2013-11-11] () [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7183632 2016-07-18] (TeamViewer GmbH)
S2 tekuingModulersd.exe; C:\Program Files (x86)\Qickqerkige\tekuingModulersd.exe [370264 2016-08-17] ()
R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe [254904 2016-03-19] (RaMMicHaeL)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-08-08] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [100072 2013-08-02] (GenesysLogic)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-10-23] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-10-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [14136 2014-02-11] (Windows (R) Win 7 DDK provider)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [35320 2014-09-22] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [258368 2014-09-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 19:55 - 2016-08-17 19:55 - 00053630 _____ C:\Users\Vision\Downloads\FRST.txt
2016-08-17 19:55 - 2016-08-17 19:55 - 00000000 ____D C:\FRST
2016-08-17 19:54 - 2016-08-17 19:54 - 02394624 _____ (Farbar) C:\Users\Vision\Downloads\FRST64.exe
2016-08-17 19:14 - 2016-08-17 19:14 - 02945016 _____ (Google) C:\Users\Vision\Downloads\chrome_cleanup_tool.exe
2016-08-17 18:38 - 2016-08-17 18:39 - 00002274 _____ C:\Users\Vision\Desktop\Ｇooｇle Ｃhroｍe.lnk
2016-08-17 18:38 - 2016-08-17 18:39 - 00001631 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ｇooｇle Ｃhroｍe.lnk
2016-08-17 18:38 - 2016-08-17 18:38 - 00008968 _____ C:\Windows\System32\Tasks\Tekuing Module
2016-08-17 18:38 - 2016-08-17 18:38 - 00000205 _____ C:\ProgramData\Ｇooｇle Ｃhroｍe.lnk.bat
2016-08-17 18:38 - 2016-08-17 18:38 - 00000000 ___HD C:\Program Files (x86)\z76E292
2016-08-17 18:38 - 2016-08-17 18:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\LuckyBrowse
2016-08-17 18:37 - 2016-08-17 18:39 - 00000000 ____D C:\Program Files (x86)\Qickqerkige
2016-08-17 18:37 - 2016-08-17 18:38 - 00003066 _____ C:\Windows\System32\Tasks\LuckyBrowse
2016-08-17 18:37 - 2016-08-17 18:38 - 00000000 ____D C:\Users\Vision\AppData\Local\pfercultckariwardgrzeward
2016-08-17 18:37 - 2016-08-17 18:37 - 00000000 ____D C:\ProgramData\LuckyBrowse
2016-08-17 18:37 - 2016-08-17 18:37 - 00000000 ____D C:\Program Files (x86)\LuckyBrowse
2016-08-17 18:36 - 2016-08-17 18:36 - 04784128 _____ C:\Users\Vision\Desktop\descargar-libro-radiologia-meschan.iso
2016-08-17 18:20 - 2016-08-17 18:20 - 03020752 _____ C:\Users\Vision\Desktop\Guida minima alla sopravvivenza dello Specializzando in Radiologia.pdf
2016-08-17 18:01 - 2016-08-17 18:01 - 04034168 _____ C:\Users\Vision\Desktop\tdi_bizzarri_1lz5.pdf
2016-08-17 17:45 - 2016-08-17 17:45 - 03810926 _____ C:\Users\Vision\Desktop\231-002-03_Rx_cranio.pdf
2016-08-17 17:45 - 2016-08-17 17:45 - 01124866 _____ C:\Users\Vision\Desktop\Tecniche radiografiche in Radiologia Osteo-articolare.pdf
2016-08-17 14:05 - 2016-08-17 14:05 - 02527367 _____ C:\Users\Vision\Desktop\punti_di_repere_del_cranio_e_proiezioni.pdf
2016-08-07 20:12 - 2016-08-07 20:12 - 00057899 _____ C:\Users\Vision\Desktop\proiezioni programma tirocinio PDF.pdf
2016-08-03 23:52 - 2016-08-03 23:52 - 00000000 ____D C:\Users\Vision\Downloads\The.Way.2010.BRRip.XviD.BGAUDiO-SiSO
2016-07-28 09:55 - 2016-07-28 09:55 - 21162735 _____ C:\Users\Vision\Downloads\Теория на възпитанието I част.pdf
2016-07-28 09:39 - 2016-07-28 09:39 - 02091233 _____ C:\Users\Vision\Downloads\За възпитанието на детето от три до шест години.pdf
2016-07-25 21:44 - 2016-07-25 21:44 - 00096676 _____ C:\Users\Vision\Downloads\010371774Z.pdf
2016-07-22 00:35 - 2016-08-04 02:30 - 00000000 ____D C:\Users\Vision\AppData\Roaming\uTorrent
2016-07-22 00:35 - 2016-07-22 00:35 - 00000860 _____ C:\Users\Vision\Desktop\µTorrent.lnk
2016-07-22 00:35 - 2016-07-22 00:35 - 00000840 _____ C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2016-07-22 00:34 - 2016-07-22 00:34 - 00000965 _____ C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\Viber.lnk
2016-07-22 00:34 - 2016-07-22 00:34 - 00000963 _____ C:\Users\Vision\Desktop\Viber.lnk
2016-07-22 00:34 - 2016-07-22 00:34 - 00000000 ____D C:\Users\Vision\AppData\Roaming\TeamViewer
2016-07-22 00:34 - 2016-07-22 00:34 - 00000000 ____D C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Viber
2016-07-19 15:40 - 2016-07-20 13:21 - 00000000 ___RD C:\Users\Vision\Google Drive
2016-07-19 15:36 - 2016-07-19 15:36 - 00987728 _____ (Google Inc.) C:\Users\Vision\Desktop\googledrivesync.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-17 19:55 - 2014-08-28 11:45 - 00001026 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-17 18:56 - 2014-08-28 11:28 - 00000000 ____D C:\Users\Vision\AppData\Roaming\Skype
2016-08-17 18:55 - 2014-08-28 09:03 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-397514922-2584020372-3024867149-1001
2016-08-17 18:45 - 2014-08-28 11:45 - 00001022 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-17 18:37 - 2014-08-28 08:58 - 00001201 _____ C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-08-17 14:32 - 2014-08-28 08:58 - 00000000 ____D C:\Users\Vision\AppData\Local\Packages
2016-08-17 09:39 - 2013-08-22 17:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-14 23:53 - 2013-08-22 16:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-08-14 23:31 - 2014-11-15 00:20 - 00000000 ____D C:\Users\Vision\AppData\Local\Spotify
2016-08-14 23:04 - 2014-11-15 00:20 - 00000000 ____D C:\Users\Vision\AppData\Roaming\Spotify
2016-08-14 22:59 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\Inf
2016-08-12 15:21 - 2015-11-20 02:49 - 00000000 ____D C:\Users\Vision\AppData\Roaming\ViberPC
2016-08-10 20:23 - 2013-08-22 18:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-10 20:23 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\AppReadiness
2016-08-07 13:26 - 2015-06-02 08:00 - 00000344 __RSH C:\ProgramData\ntuser.pol
2016-08-04 14:41 - 2015-09-20 01:36 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-08-03 15:28 - 2014-08-28 08:57 - 00000000 ____D C:\Users\Vision
2016-07-29 10:50 - 2014-08-28 11:45 - 00003998 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-29 10:50 - 2014-08-28 11:45 - 00003762 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-27 23:40 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\system32\NDF
2016-07-27 17:03 - 2013-08-22 18:36 - 00000000 ____D C:\Windows\tracing
2016-07-27 01:08 - 2014-08-28 11:27 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-07-22 00:34 - 2016-07-03 11:12 - 00000000 ____D C:\Users\Vision\AppData\Local\Viber
2016-07-22 00:34 - 2015-12-16 13:21 - 00001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-07-22 00:34 - 2015-12-16 13:21 - 00001043 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-07-22 00:34 - 2015-12-16 13:20 - 00000000 ____D C:\Users\Vision\AppData\Local\Package Cache
2016-07-22 00:03 - 2015-12-16 13:25 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-07-22 00:02 - 2014-08-28 11:28 - 00000000 ____D C:\ProgramData\Skype
2016-07-21 23:58 - 2015-04-08 21:56 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-07-21 23:58 - 2014-08-28 11:30 - 00001193 _____ C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\GOM Player.lnk
2016-07-21 23:58 - 2014-08-28 09:14 - 00000000 ____D C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-07-21 23:58 - 2014-08-28 09:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-07-21 23:58 - 2014-08-28 09:14 - 00000000 ____D C:\Program Files\WinRAR
2016-07-21 23:48 - 2015-07-08 11:58 - 00599720 _____ (www.patchmypc.net) C:\Users\Vision\Desktop\PatchMyPC.exe
2016-07-20 23:56 - 2015-03-23 08:28 - 00000000 ____D C:\Users\Vision\Desktop\New folder
2016-07-20 19:46 - 2015-07-08 16:37 - 00000000 ____D C:\Users\Vision\Downloads\бланки, документи, материали
2016-07-20 19:39 - 2014-08-28 09:01 - 00863592 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-20 13:30 - 2014-08-28 11:45 - 00000000 ____D C:\Users\Vision\AppData\Local\Google
2016-07-20 13:30 - 2014-08-28 11:45 - 00000000 ____D C:\Program Files (x86)\Google

==================== Files in the root of some directories =======

2015-07-08 14:39 - 2015-07-08 14:39 - 0000017 _____ () C:\Users\Vision\AppData\Local\resmon.resmoncfg
2014-08-28 09:35 - 2014-08-28 09:35 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2016-08-17 18:38 - 2016-08-17 18:38 - 0000205 _____ () C:\ProgramData\Ｇooｇle Ｃhroｍe.lnk.bat

Files to move or delete:
====================
C:\ProgramData\Ｇooｇle Ｃhroｍe.lnk.bat
C:\Users\Vision\amtlib (1).dll
C:\Users\Vision\amtlib.dll

Some files in TEMP:
====================
C:\Users\Vision\AppData\Local\Temp\4MRJxSuNi6.exe
C:\Users\Vision\AppData\Local\Temp\IUhe4wYdFT.exe
C:\Users\Vision\AppData\Local\Temp\sdf5B8F.exe
C:\Users\Vision\AppData\Local\Temp\wd7VtVCV9F.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-12 01:24

==================== End of FRST.txt ============================

Addition.txt

17 август 201610 г.

Здравейте,

Видях проблема и нека да се опитаме да го оправим:

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

След това пишете дали има подобрение.

Поздрави!

17 август 201610 г.

Автор

Проблем ли е, ако програмите не са на десктопа ....? Натиснах да изтеглям последната и автоматично ми излезе това ......

start
CreateRestorePoint:
CloseProcesses:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
AutoConfigURL: [S-1-5-21-397514922-2584020372-3024867149-1001] => hxxp://stoppblock.org/wpad.dat?b14c4b92feacc5d814cd7497d971af3a14604895
ManualProxies: 0hxxp://stoppblock.org/wpad.dat?b14c4b92feacc5d814cd7497d971af3a14604895
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://it.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://it.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKU\S-1-5-21-397514922-2584020372-3024867149-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
SearchScopes: HKU\S-1-5-21-397514922-2584020372-3024867149-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://it.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_strmioupdins_16_23&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dit%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyDyCtByBtC0E0F0BtD0A0C0F0BtA0F0EtN0D0Tzu0StCyCtBtCtN1L2XzutAtFtBtCtFtCtFtCtAtN1L1Czu1BtBtN1L1G1B1V1N2Y1L1Qzu2SyDtAzyyEyByBtAyBtGyCzz0A0BtG0A0B0FyDtGyC0D0EyCtGyEtB0CtBtCtBtDzztC0B0DtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0CyCyE0FtC0D0FtGtA0BtAtAtGyEyEyB0CtGzyyEyEtDtGtAtByDyByE0BtA0C0CtCzztC2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtDzzyE%26cr%3D133760206%26a%3Dwncy_strmioupdins_16_23%26os_ver%3D6.3%26os%3DWindows%2B8.1%2BPro&p={searchTerms}
CHR HomePage: ghiqerghtquqoleatuzuch -> hxxp://www.trotux.com/?z=6ca48ef27bb52934ad35c36gez5m4g5zdz0bco9qaw&from=epf1&uid=HGSTXHTS721010A9E630_JR10006PHBTULEHBTULEX&type=hp
CHR StartupUrls: ghiqerghtquqoleatuzuch -> "hxxp://www.trotux.com/?z=6ca48ef27bb52934ad35c36gez5m4g5zdz0bco9qaw&from=epf1&uid=HGSTXHTS721010A9E630_JR10006PHBTULEHBTULEX&type=hp"
CHR DefaultSearchURL: ghiqerghtquqoleatuzuch -> hxxp://www.trotux.com/search/?q={searchTerms}&z=6ca48ef27bb52934ad35c36gez5m4g5zdz0bco9qaw&from=epf1&uid=HGSTXHTS721010A9E630_JR10006PHBTULEHBTULEX&type=sp
CHR DefaultSearchKeyword: ghiqerghtquqoleatuzuch -> trotux
S2 tekuingModulersd.exe; C:\Program Files (x86)\Qickqerkige\tekuingModulersd.exe [370264 2016-08-17] ()
C:\Program Files (x86)\Qickqerkige
2016-08-17 18:38 - 2016-08-17 18:39 - 00002274 _____ C:\Users\Vision\Desktop\Ｇooｇle Ｃhroｍe.lnk
2016-08-17 18:38 - 2016-08-17 18:39 - 00001631 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ｇooｇle Ｃhroｍe.lnk
2016-08-17 18:38 - 2016-08-17 18:38 - 00008968 _____ C:\Windows\System32\Tasks\Tekuing Module
2016-08-17 18:38 - 2016-08-17 18:38 - 00000205 _____ C:\ProgramData\Ｇooｇle Ｃhroｍe.lnk.bat
2016-08-17 18:38 - 2016-08-17 18:38 - 00000000 ___HD C:\Program Files (x86)\z76E292
2016-08-17 18:38 - 2016-08-17 18:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\LuckyBrowse
2016-08-17 18:37 - 2016-08-17 18:39 - 00000000 ____D C:\Program Files (x86)\Qickqerkige
2016-08-17 18:37 - 2016-08-17 18:38 - 00003066 _____ C:\Windows\System32\Tasks\LuckyBrowse
2016-08-17 18:37 - 2016-08-17 18:38 - 00000000 ____D C:\Users\Vision\AppData\Local\pfercultckariwardgrzeward
2016-08-17 18:37 - 2016-08-17 18:37 - 00000000 ____D C:\ProgramData\LuckyBrowse
2016-08-17 18:37 - 2016-08-17 18:37 - 00000000 ____D C:\Program Files (x86)\LuckyBrowse
C:\Users\Vision\AppData\Local\Temp\4MRJxSuNi6.exe
C:\Users\Vision\AppData\Local\Temp\IUhe4wYdFT.exe
C:\Users\Vision\AppData\Local\Temp\sdf5B8F.exe
C:\Users\Vision\AppData\Local\Temp\wd7VtVCV9F.exe
File: C:\Windows\SysWOW64\UMonit64.exe
Task: {67ABFCB9-B4B0-421E-9BD2-6B76B2B60850} - System32\Tasks\LuckyBrowse => C:\Program Files (x86)\LuckyBrowse\app\luckybrowse.exe [2016-08-17] () <==== ATTENTION
Task: {AAF17F2A-686F-4D62-94CF-FF0D4A3EC5BF} - System32\Tasks\Tekuing Module => C:\Program Files (x86)\Qickqerkige\tekuingModulefcp.exe [2016-08-17] ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ｇooｇle Ｃhroｍe.lnk -> C:\ProgramData\Ｇooｇle Ｃhroｍe.lnk.bat ()
ShortcutWithArgument: C:\Users\Vision\Desktop\Ｇooｇle Ｃhroｍe.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
ShortcutWithArgument: C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
ShortcutWithArgument: C:\Users\Vision\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения в Chrome\EBook Offline Reader.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
ShortcutWithArgument: C:\Users\Vision\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
ShortcutWithArgument: C:\Users\Vision\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ｇooｇle Ｃhroｍe.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
ShortcutWithArgument: C:\Users\Vision\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
ShortcutWithArgument: C:\Users\Vision\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Ｇooｇle Ｃhroｍe.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://safesurfs.net/?ssid=1471448222&a=1051321&src=sh&uuid=d3ea4ae8-13b1-44ab-a601-4a298341a563"
FirewallRules: [{837E52B7-F844-4D3A-8F51-22FC8049265F}] => (Allow) C:\Program Files (x86)\LuckyBrowse\app\LuckyBrowse.exe
FirewallRules: [{26455C1D-309F-4BE2-B5F8-C65D0C205F70}] => (Allow) C:\Program Files (x86)\LuckyBrowse\app\LuckyBrowse.exe
cmd: del %temp%\*.* /f /s /q
cmd: rd /s /q %temp%
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
EmptyTemp:
End

17 август 201610 г.

Това, което сте публикували е моя скрипт, а не лог файла, който трябва да се е получил след работата на скрипта. И FRST.exe и fixlist.txt трябва да се намират в една папка!

Тъй като FRST.exe при вас се намира в папката C:\Users\Vision\Downloads, тогава свалете и fixlist.txt в тази папка и след това стартирайте FRST.exe и натиснете бутона Fix веднъж и изчакайте да приключи. Ако ви поиска рестарт се съгласете и след него публикувайте съдържанието на лог файла.

Поздрави!

17 август 201610 г.

Автор

Гугъл Хром го няма ...явно трябва отново да го преинсталирам... Сега ползвам Explorer. Не виждам предишните проблеми

Fixlog.txt

17 август 201610 г.

Не сме трили Google Chrome, а само някои фалшиви похитени икони, които използваха странен символ в името си.Обърнете вниманието на символа "ｍ" и изобщо на целия шрифт на името.

2016-08-17 18:38 - 2016-08-17 18:39 - 00002274 _____ C:\Users\Vision\Desktop\Ｇooｇle Ｃhroｍe.lnk
2016-08-17 18:38 - 2016-08-17 18:39 - 00001631 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ｇooｇle Ｃhroｍe.lnk
2016-08-17 18:38 - 2016-08-17 18:38 - 00000205 _____ C:\ProgramData\Ｇooｇle Ｃhroｍe.lnk.bat

Просто си направете нови шорткъти от изпълнимия файл

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

17 август 201610 г.

Автор

Възстанових всичко. Няма проблеми. Благодаря ви!

Редактирано 17 август 201610 г. от izipop (преглед на промените)

17 август 201610 г.

Ааа, не сме приключили. Системата бе сериозно заразена. Липсата на симптоми вече, не означава, че всичко е почистено. Нека да проверим за остатъци:

СТЪПКА 1

Изтеглете и стартирайте AdwCleaner.exe.
Натиснете бутона Scan.
AdwCleaner ще започне да проверява компютъра.
След като проверката приключи натиснете бутона Clean.
Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
Ще се появи автоматично лог файл с името (AdwCleaner[S1].txt и AdwCleaner[С1].txt) в C:\Adwcleaner
Публикувайте съдържанието на AdwCleaner[С1].txt в следващия си коментар.

СТЪПКА 2

Моля изтеглете Junkware Removal Tool на вашия десктоп.

Спрете временно работата на защитните програми. Вижте тук ако се затруднявате как.
Стартирайте инструмента JRT.exe
Ще се отвори ДОС прозорец. Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
Натиснете което и да е копче от клавиатурата.
Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 3

Моля изтеглете ZHPcleaner и я запазете на вашия десктоп.

Стартирайте ZHPCleaner с десен клик върху файла и изберете от контекстното меню "Run as administrator"
Кликнете върху за да се съгласите с лицензионното споразумение.
Изберете бутона .
Браузърите ще бъдат затворени автоматично.
След края на проверката натиснете бутона Report
Ще се създаде лог файл на десктопа. Публикувайте лог файла в следващия си коментар.

Поздрави!

17 август 201610 г.

Автор

Аааа ..добре! Аз не бързам, но не искам да ви притеснявам Сега се впускам в действие..

17 август 201610 г.

Автор

Ето

AdwCleaner[C0].txt

Редактирано 17 август 201610 г. от izipop (преглед на промените)

17 август 201610 г.

Автор

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 8.1 Pro x64
Ran by Vision (Administrator) on 17/08/2016 at 23:20:48,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 3

Successfully deleted: C:\Users\Vision\AppData\Local\flvto youtube downloader (Folder)
Successfully deleted: C:\Users\Vision\Start Menu\Programs\flvto youtube downloader.lnk (Shortcut)
Successfully deleted: C:\Users\Vision\Start Menu\Programs\uninstall flvto youtube downloader.lnk (Shortcut)

Registry: 1

Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Flvto YouTube Downloader (Registry Value)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17/08/2016 at 23:22:00,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

17 август 201610 г.

Автор

Третата стъпка не мога да я извърша, поради някаква грешка в сървъра.

Редактирано 17 август 201610 г. от izipop (преглед на промените)

17 август 201610 г.

Дотук добре. Явно сме почистили повечето неща и не е имало много за почистване от страна на инструментите. Ще се наложи да преинсталирате програмата flvto youtube downloader, защото бе изтрита погрешка от JRT. Но пък ако предпочитате можете да инсталирате добавката Video Download Helper за Google Chrome => https://chrome.google.com/webstore/detail/video-downloadhelper/lmjnegcaeklhafolokijcfjliaokphfk

Може ли да снимате грешката, която ви дава последната програма?

Поздрави!

18 август 201610 г.

Автор

Добро утро!

18 август 201610 г.

Здравейте,

Нещо снимките не работят. Качете снимката на адрес => https://imgur.com/

и след това paste-нете линковете към снимкате/ите.

Поздрави!

18 август 201610 г.

Автор

http://imgur.com/INX5scJ

18 август 201610 г.

Искате да кажете, че не можете да изтеглите програмата, защото сайта не ви се отваря?

Ето качил съм ви я тук => http://dox.bg/files/dw?a=450da5a38b

Поздрави!

18 август 201610 г.

Автор

Ами да, пробвах многократно. Сега се получи, ето :

ZHPCleaner.txt

Редактирано 18 август 201610 г. от izipop (преглед на промените)

18 август 201610 г.

Автор

Дава ми в дясно и индикация за 48 adw

19 август 201610 г.

Намерените неща от ZHPCleaner са файлове и записи в регистрите използвани от активатора, който използвате. Има и 2 фалшиви тревоги и само 2 реални остатъци за изтриване:

Изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

За финал следват финалните проверки и след това приключваме:

СТЪПКА1

Моля изтеглете Malwarebytes Anti-Malware 2.2.1.1043 Final и я запазете на вашия десктоп.

Стартирайте файла mbam-setup-2.2.1.1043.exe и следвайте указанията за да инсталирате програмата.
След като инсталацията приключи се уверете че сте сложили отметка пред:
Launch Malwarebytes Anti-Malware
Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

Натиснете бутона Finish.
Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
Ще започне проверка за зловреден софтуер.
При някои инфекции можете да видите съобщението:
"Could not load DDA driver"
Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
След като проверката приключи натиснете бутона Apply Actions.
Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
Отидете то табът History > Application Logs.

Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

СТЪПКА 2

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.

Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:

Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар. Пак повтарям, не трийте нищо с програмата, защото е доста мощна и може да бъде опасна!

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

СТЪПКА 3

Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.
След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
Натиснете Next за да започне проверката.
Когато проверката приключи натиснете бутона View Report.
Копирайте съдържанието на лог файла в следващия си коментар.

СТЪПКА 4

Изтеглете Security Check от screen317 от този линк и го запаметете на вашия десктоп.

Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.

Накрая, автоматично ще се отвори текстов документ, наречен checkup.txt, моля поставете съдържанието му в следващия ви коментар в тази тема.

Поздрави!

19 август 201610 г.

Автор

Здравейте

Fixlog.txt

19 август 201610 г.

Автор

anti-malware.txt

19 август 201610 г.

Не сте предприели действия за намерените обекти от Malwarebytes Anti-Malware. Моля премахнете намерените обекти и публикувайте новите резултати от проверката с програмата и след това продължете с останалите стъпки.

Прочетох и личното ви съобщение. Щом сте инсталирали програмата на български и ви е трудно да следвате инструкциите ми за нея, които са на английски, тогава вижте следната тема, която е написана от колегата ни tigertron и която е на български!

http://tigertron.free.bg/mbam.htm

Поздрави!

Добре дошли!

изчезване на google chrome

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)