Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Постоянно ме пренасочва към поискMail.ru

Преслав Пламенов
в Премахване на зловреден софтуер

Featured Replies

Добър ден! Преди си бях изтеглил патч за една игра Rust. След това ми се бъгна браузърът, когато търся нещо винаги ме пренасочва към поискMail.ru. Постоянно има реклами и не знам как да го премахна тоя mail.ru. Браузърът се забавя много. Помогнете!

Здравейте..! Моля, прочетете още веднъж Системата ми е инфектирана - Какво да правя сега?  

Сканиране с Farbar Recovery Scan Tool

  • Моля изтеглете icon1337953436.pngFarbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете надесктопа.
  • Стартирайте файла FRST.exe (или FRST64.exe)
  • Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
  • Натиснете бутона YClYkft.jpg.
  • Изчакайте търпеливо проверката да приключи.
  • Ще се създадат два лог файла с името - FRST.txt и Addition.txt надесктопа.
  • Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение). 

Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FRST.txt (копирате цялото съдържание)
  • Addition.txt (прикачате..)
  • Автор
преди 26 минути, Богатир написа:

Системата ми е инфектирана - Какво да правя сега?

Какво да цитирам?

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-08-2016
Ran by User (administrator) on BEAST (28-08-2016 17:18:43)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTeK Computer Inc.) C:\ProgramData\ASUS\AsSysCtrlService\2.00.00\AsSysCtrlService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
() C:\Program Files (x86)\filter\2\CppWindowsService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
() C:\Program Files (x86)\filter\2\PFHttpContentFilter.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\User\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [5006536 2016-03-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Six Engine] => "C:\Program Files (x86)\ASUS\EPU\EPU.exe" -b
HKLM-x32\...\Run: [QFan Help] => C:\Program Files (x86)\ASUS\AI Suite\QFan4\FanHelp.exe [890496 2012-01-03] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe -autorun
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565960 2016-07-20] (LogMeIn Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\Run: [NVIDIA nTune] => "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-23] (Valve Corporation)
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\Run: [] => [X]
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [29502592 2016-07-14] (Skype Technologies S.A.)
HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\...\MountPoints2: {27f06b47-ea78-11e4-a703-3085a9453a79} - D:\setup.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KMSPico 11.0.1 Update.lnk [2016-08-26]
ShortcutTarget: KMSPico 11.0.1 Update.lnk -> C:\ProgramData\{e601363d-f087-c0ab-e601-1363df08d8f7}\KMSPico 11.0.1 Update.exe (No File)
GroupPolicyScripts: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: Hosts file not detected in the default directory
Tcpip\..\Interfaces\{4C640DA7-91C1-44DB-B1A2-FDB107DCB52E}: [DhcpNameServer] 192.168.1.1 0.0.0.0
ManualProxies: 

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
SearchScopes: HKU\S-1-5-21-2534921562-2048459725-1045574171-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-08-01] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-01] (Oracle Corporation)
BHO-x32: Searchgo Class -> {598AEFC6-DD3C-4A63-9AC3-53FCF6155931} -> C:\Users\User\AppData\LocalLow\SearchGo\searchgo.dll [2016-08-23] (Searchgo)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-01] (Oracle Corporation)
BHO-x32: Поиск@Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\User\AppData\Local\Mail.Ru\Sputnik\IESearchPlugin.dll [2016-08-23] (Mail.Ru)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-01] (Oracle Corporation)
Toolbar: HKLM-x32 - Searchgo - {2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC} - C:\Users\User\AppData\LocalLow\SearchGo\searchgo.dll [2016-08-23] (Searchgo)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-05-25] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-05-25] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default
FF Homepage: hxxp://granena.ru/?utm_content=31b5cebd524a9af6c7a772dca81815e9&utm_source=startpm&utm_term=A52242368F5BC000E14E6FE413CD6D3C&utm_d=20160823
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-11] ()
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-01] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-01] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-01] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default\user.js [2016-08-25]
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default\searchplugins\mailru.xml [2016-08-23]
FF Extension: (Визуальные закладки @Mail.Ru) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} [2016-08-23]
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default\Extensions\[email protected] [2016-08-23]
FF Extension: (AdBlock for Firefox) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default\Extensions\[email protected] [2015-03-06] [not signed]
FF Extension: (Поиск@Mail.Ru) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\xqw55z65.default\Extensions\[email protected] [2016-08-23]
FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-05-25]

Chrome: 
=======
CHR HomePage: Default -> mail.ru/cnt/11956636?rciguc__PARAM__
CHR StartupUrls: Default -> "hxxp://google.com/"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-06]
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-06]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-14]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-04]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-14]
CHR Extension: (Google Sheets) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-06]
CHR Extension: (Google Docs Offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19]
CHR Extension: (Arcane Legends) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibmlkgieigeddcedpbijnpojheoddido [2016-08-22]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-06]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-19]
CHR HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2534921562-2048459725-1045574171-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-05-25]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-07-15] (Advanced Micro Devices, Inc.) [File not signed]
S2 AODService; C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [137584 2014-09-19] ()
R2 AsSysCtrlService; C:\ProgramData\ASUS\AsSysCtrlService\2.00.00\AsSysCtrlService.exe [96896 2009-12-28] (ASUSTeK Computer Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation)
R2 CppWindowsService; C:\Program Files (x86)\filter\2\CppWindowsService.exe [23040 2016-02-04] () [File not signed]
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2554376 2016-07-20] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-07-20] (LogMeIn, Inc.)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3916368 2016-01-09] (INCA Internet Co., Ltd.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 nTuneService; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe /StartService [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 AODDriver4.3.0; C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [60104 2014-09-19] (Advanced Micro Devices)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30352 2015-04-24] (Disc Soft Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2015-04-24] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2016-08-26] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R1 netfilter2; C:\Windows\System32\drivers\netfilter2.sys [58360 2016-01-12] (Windows (R) Win 7 DDK provider)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
S3 NVR0Dev; C:\Windows\nvoclk64.sys [39968 2007-09-04] (NVidia Corp.)
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 ASFLTDrv.sys; \??\C:\Program Files (x86)\ASUS\Disk Unlocker\ASFLTDrv64.sys [X]
S3 atillk64; \??\C:\Users\User\AppData\Local\Temp\RarSFX0\atillk64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S1 VDiskBus; system32\DRIVERS\VDiskBus64.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys FA886682CFC5D36718D3E436AACF10B9
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 1890CDF2ECAE766E4A7185E4DBBF9EE1
C:\Windows\System32\DRIVERS\atikmpag.sys 1FE14B9C86B8C17F741BE4619CD2E421
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys ==> MD5 is legit
C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys C3D487827E48CC5EC17994FEC5BDFF87
C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys E21DECAFC572EEF6F63D9513BA8F8817
C:\Windows\system32\drivers\appid.sys 90C53BD47979FB8814F465A08B885102
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\AsIO.sys FEF9DD9EA587F8886ADE43C1BEFBDAFE
C:\Windows\System32\DRIVERS\asmthub3.sys 22842362DF890F5492F85AA60916A697
C:\Windows\System32\DRIVERS\asmtxhci.sys 08E2D77766CC05E75A0707207D9FC684
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\drivers\AtihdW76.sys E265A0DFE19E601D604D469CC53076EE
C:\Windows\System32\DRIVERS\AtiPcie.sys C07A040D6B5A42DD41EE386CF90974C8
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 404B7DF9CA4D1CB675045AF220FF3285
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 27667A788130A7F7A5858DE27572E6D7
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\system32\drivers\dmvsc.sys 5DB085A8A6600BE6401F2B24EECB5415
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtlitescsibus.sys 080598EFE474B7A28D7260C3AC389E36
C:\Windows\System32\DRIVERS\dtsoftbus01.sys 46571ED73AE84469DCA53081D33CF3C8
C:\Windows\System32\drivers\dxgkrnl.sys 87CE5C8965E101CCCED1F4675557E868
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hamachi.sys 1E6438D4EA6E1174A3B3B1EDC4DE660B
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys F61634BEC53F73702A10DE69F6DCAF57
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys ==> MD5 is legit
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys C93EB3A92540830168F2057ECA7DE49A
C:\Windows\System32\Drivers\ksecpkg.sys 43F45C59A472993E5063F2DB2D22C509
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mbam.sys A8D28D5B3E2A528D1EF0E338E44F2820
C:\Windows\system32\drivers\MBAMSwissArmy.sys 8F22037D3F5A6BB676525D825A1388B9
C:\Windows\system32\drivers\mwac.sys AE757332EA130E94E646621CC695B52A
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 87BCD1034CBF33537D4D4C251D39BA26
C:\Windows\System32\DRIVERS\MpFilter.sys 73150F67D20270FF95A021A22E64F28A
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys AE3334958D8F631FF14A0AEB3D7EFB3A
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ASACPI.sys 19B006B181E3875FD254F7B67ACF1E7C
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\drivers\netfilter2.sys 63FF3CCA681C03675E108922C1C95458
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys 4774AD83C650001B337B92E5E5DA337B
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\nvoclk64.sys 241A095631570A9CEF4F126C87605C60
C:\Windows\system32\drivers\nvraid.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ED6E75158D28D33A2E2A020AC5B2B59D
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RMCAST.sys CAF88D6573D21CD2AA27001DDBFDC74D
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt64win7.sys 8181B5E7BFC040E0B26349C73E719335
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\SysWOW64\speedfan.sys 0FFE35F0B0CD5A324BBE22F02569AE3B
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\System32\DRIVERS\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS ==> MD5 is legit
C:\Windows\system32\drivers\usbuhci.sys ==> MD5 is legit
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\system32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\System32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-28 17:18 - 2016-08-28 17:18 - 02396672 _____ (Farbar) C:\Users\User\Downloads\FRST64 (1).exe
2016-08-27 21:25 - 2016-08-27 21:25 - 00001417 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-08-27 00:27 - 2016-08-27 00:27 - 00003828 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1472246836
2016-08-27 00:27 - 2016-08-27 00:27 - 00001139 _____ C:\Users\Public\Desktop\Opera.lnk
2016-08-27 00:27 - 2016-08-27 00:27 - 00001139 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-08-27 00:26 - 2016-08-27 00:26 - 00963024 _____ (Opera Software) C:\Users\User\Downloads\OperaSetup (2).exe
2016-08-27 00:26 - 2016-08-27 00:26 - 00963024 _____ (Opera Software) C:\Users\User\Downloads\OperaSetup (1).exe
2016-08-27 00:23 - 2016-08-27 00:23 - 00963024 _____ (Opera Software) C:\Users\User\Downloads\OperaSetup.exe
2016-08-23 21:38 - 2016-08-28 17:18 - 00000000 ____D C:\Windows\filter
2016-08-23 16:58 - 2016-08-26 00:51 - 00000000 ____D C:\Users\User\AppData\Local\PowerMonitor
2016-08-23 16:58 - 2016-08-23 17:05 - 00000000 ____D C:\Users\User\AppData\LocalLow\Unity
2016-08-23 16:58 - 2016-08-23 17:05 - 00000000 ____D C:\Users\User\AppData\Local\Unity
2016-08-23 16:34 - 2016-08-23 16:34 - 00000000 ____D C:\Users\User\AppData\Local\Вoйти в Интeрнет
2016-08-23 16:33 - 2016-08-26 00:51 - 00000000 ____D C:\Users\User\AppData\Local\fupdate
2016-08-23 16:33 - 2016-08-23 16:33 - 00003428 _____ C:\Windows\System32\Tasks\fupdate
2016-08-23 16:33 - 2016-01-12 19:04 - 00058360 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\netfilter2.sys
2016-08-23 16:32 - 2016-08-23 16:32 - 00000000 ____D C:\Users\User\AppData\LocalLow\SearchGo
2016-08-23 16:32 - 2016-08-23 16:32 - 00000000 ____D C:\Program Files (x86)\filter
2016-08-23 16:31 - 2016-08-26 00:51 - 00000000 ____D C:\Users\User\AppData\Local\ScriptWriter
2016-08-23 16:31 - 2016-08-23 16:31 - 00003512 _____ C:\Windows\System32\Tasks\ScriptWriter
2016-08-23 16:30 - 2016-08-23 16:30 - 00000000 ____D C:\Users\User\AppData\Local\Поиcк в Интeрнете
2016-08-23 16:28 - 2016-08-23 17:04 - 00000000 ____D C:\Users\User\AppData\Local\Mail.Ru
2016-08-23 16:28 - 2016-08-23 16:58 - 00000000 ____D C:\Users\User\AppData\Roaming\MailProducts
2016-08-23 16:28 - 2016-08-23 16:28 - 00000000 ____D C:\ProgramData\Mail.Ru
2016-08-19 19:28 - 2016-08-19 19:32 - 62921731 _____ C:\Users\User\Downloads\lothaven.rar
2016-08-13 16:50 - 2016-08-13 16:50 - 00000000 ____D C:\Users\User\AppData\Roaming\PeerNetworking
2016-08-12 03:29 - 2016-08-26 01:05 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-08-12 00:48 - 2016-08-12 00:48 - 00003018 _____ C:\Windows\System32\Tasks\{490857DD-6D46-4548-AD00-78311021EC57}
2016-08-11 23:08 - 2016-08-11 23:08 - 00000000 ___SH C:\Users\User\AppData\Local\LumaEmu
2016-08-11 23:08 - 2016-08-11 23:08 - 00000000 ____D C:\Users\User\AppData\Local\DayZ
2016-08-10 21:05 - 2016-08-10 23:04 - 00000000 ____D C:\Users\User\AppData\Roaming\Mount&Blade Warband
2016-08-09 21:26 - 2016-08-09 21:26 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2016-08-09 21:25 - 2016-08-09 21:25 - 00003372 _____ C:\Windows\System32\Tasks\{FF78F70A-9FF5-4B05-959D-10ED6A20B639}
2016-08-09 21:25 - 2016-08-09 21:25 - 00003372 _____ C:\Windows\System32\Tasks\{C62CE883-0078-445C-B18D-25A3118D0A31}
2016-08-04 22:43 - 2016-08-04 22:43 - 00003156 _____ C:\Windows\System32\Tasks\{A4AFDC28-D7ED-4E0E-85B8-4B658C5FA5D3}
2016-08-04 01:57 - 2016-08-04 01:57 - 00000000 ____D C:\Users\User\AppData\Local\Star_Vault
2016-08-01 16:19 - 2016-08-01 16:19 - 00000000 _____ C:\Windows\SysWOW64\REN473D.tmp
2016-08-01 16:18 - 2016-08-01 16:18 - 00000000 ____D C:\Users\User\AppData\Roaming\Sun
2016-08-01 16:18 - 2016-08-01 16:18 - 00000000 ____D C:\Users\User\.oracle_jre_usage
2016-07-26 12:32 - 2016-07-26 12:32 - 00000000 ____D C:\Users\User\AppData\Roaming\.mono
2016-07-26 12:32 - 2016-07-26 12:32 - 00000000 ____D C:\ProgramData\.mono
2016-07-26 12:31 - 2016-07-26 12:31 - 00000000 ____D C:\Users\User\AppData\LocalLow\PlayfulCorp
2016-07-21 16:03 - 2016-07-21 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-07-21 16:03 - 2016-07-21 16:03 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2016-07-20 03:00 - 2016-07-20 03:00 - 00000000 ____D C:\Users\User\AppData\LocalLow\Bossa Studios
2016-07-19 12:14 - 2016-07-21 22:56 - 00000000 ____D C:\Users\Default\AppData\Local\LogMeIn Hamachi
2016-07-19 12:14 - 2016-07-21 22:56 - 00000000 ____D C:\Users\Default User\AppData\Local\LogMeIn Hamachi
2016-07-09 17:00 - 2016-07-09 17:00 - 00000000 ____D C:\Users\User\AppData\LocalLow\Smartly Dressed Games
2016-07-05 00:07 - 2016-07-05 00:07 - 00000000 _____ C:\Users\User\AppData\Local\{9BFCE9CB-E989-4213-9F2C-CA1B90E6B371}
2016-06-26 15:57 - 2016-06-26 15:58 - 00000000 ____D C:\Users\User\AppData\Roaming\Trove
2016-06-26 15:51 - 2015-06-07 02:13 - 00961192 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00062304 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:13 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00883712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00064352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2016-06-26 15:51 - 2015-06-07 02:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2016-06-26 13:44 - 2016-06-26 13:44 - 00290491 _____ C:\Users\User\Downloads\2016.rar
2016-06-26 13:42 - 2016-06-26 13:42 - 00290491 _____ C:\Users\User\Desktop\2016.rar
2016-06-26 13:33 - 2016-06-26 13:36 - 00000000 ____D C:\Users\User\Desktop\2016
2016-06-26 12:23 - 2016-06-26 12:23 - 02906237 _____ C:\Users\User\Downloads\Тестове-банков маркетинг.rar
2016-06-26 12:04 - 2016-06-26 12:04 - 00555914 _____ C:\Users\User\Downloads\Сканировать10009.PDF
2016-06-26 11:52 - 2016-06-26 11:52 - 00017351 _____ C:\Users\User\Downloads\SSNLF.xlsx
2016-06-25 01:25 - 2016-06-25 01:25 - 00000219 _____ C:\Users\User\Desktop\Dota 2.url
2016-06-24 15:08 - 2016-06-24 15:08 - 00000219 _____ C:\Users\User\Desktop\Team Fortress 2.url
2016-06-22 19:20 - 2016-06-22 19:20 - 00496757 _____ C:\Users\User\Desktop\Презентация1.pptx
2016-06-05 17:51 - 2016-06-05 17:51 - 00000068 _____ C:\Users\User\Downloads\aaa.txt

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-28 17:19 - 2015-06-12 01:01 - 00034603 _____ C:\Users\User\Downloads\FRST.txt
2016-08-28 17:18 - 2015-06-12 01:01 - 00000000 ____D C:\FRST
2016-08-28 17:18 - 2015-03-06 12:19 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2016-08-28 16:47 - 2009-07-14 07:45 - 00031088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-28 16:47 - 2009-07-14 07:45 - 00031088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-28 16:19 - 2015-03-07 20:37 - 00000000 ____D C:\Users\User\AppData\Local\LogMeIn Hamachi
2016-08-28 15:40 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\tracing
2016-08-28 14:49 - 2016-02-03 21:57 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-28 13:45 - 2015-06-28 22:22 - 00000000 ____D C:\Program Files (x86)\Steam
2016-08-28 12:25 - 2009-07-14 08:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-27 00:27 - 2015-04-24 18:15 - 00000000 ____D C:\Users\User\AppData\Roaming\Opera Software
2016-08-27 00:27 - 2015-04-24 18:15 - 00000000 ____D C:\Users\User\AppData\Local\Opera Software
2016-08-27 00:27 - 2015-04-24 18:14 - 00000000 ____D C:\Program Files (x86)\Opera
2016-08-26 01:04 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\Vss
2016-08-26 00:52 - 2016-05-14 10:20 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-08-26 00:52 - 2016-05-14 10:20 - 00002041 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-08-26 00:52 - 2016-04-02 00:55 - 00002061 _____ C:\Users\Public\Desktop\AMD OverDrive.lnk
2016-08-26 00:52 - 2015-06-28 22:22 - 00000961 _____ C:\Users\Public\Desktop\Steam.lnk
2016-08-26 00:52 - 2015-06-21 13:02 - 00002691 _____ C:\Users\Public\Desktop\Microsoft Word 2010.lnk
2016-08-26 00:52 - 2015-06-21 13:02 - 00002655 _____ C:\Users\Public\Desktop\Microsoft Excel 2010.lnk
2016-08-26 00:52 - 2015-06-21 13:02 - 00002655 _____ C:\Users\Public\Desktop\Microsoft Access 2010.lnk
2016-08-26 00:52 - 2015-06-21 13:02 - 00002631 _____ C:\Users\Public\Desktop\Microsoft PowerPoint 2010.lnk
2016-08-26 00:52 - 2015-06-08 21:17 - 00002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-26 00:52 - 2015-06-08 21:17 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-26 00:52 - 2015-04-24 18:42 - 00001311 _____ C:\Users\Public\Desktop\FIFA 15.lnk
2016-08-26 00:52 - 2015-04-24 18:21 - 00001948 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2016-08-26 00:52 - 2015-04-06 15:14 - 00001607 _____ C:\Users\Public\Desktop\League of Legends.lnk
2016-08-26 00:52 - 2015-03-08 18:11 - 00001005 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2016-08-26 00:52 - 2015-03-08 12:55 - 00000983 _____ C:\Users\Public\Desktop\WinRAR.lnk
2016-08-26 00:52 - 2015-03-06 21:13 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-08-26 00:52 - 2015-03-06 21:13 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-08-26 00:52 - 2015-03-06 16:11 - 00000968 _____ C:\Users\Public\Desktop\CPUID HWMonitor.lnk
2016-08-26 00:52 - 2015-03-06 13:55 - 00001100 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-08-26 00:52 - 2015-03-06 12:26 - 00001047 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2016-08-26 00:52 - 2015-03-06 12:26 - 00001029 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2016-08-26 00:52 - 2015-03-06 12:19 - 00002691 _____ C:\Users\Public\Desktop\Skype.lnk
2016-08-26 00:52 - 2015-03-06 12:16 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-08-26 00:52 - 2015-03-06 12:09 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-08-26 00:52 - 2015-03-06 12:09 - 00001145 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-08-26 00:52 - 2009-07-14 07:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-08-26 00:52 - 2009-07-14 07:57 - 00001352 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2016-08-26 00:52 - 2009-07-14 07:57 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-08-26 00:52 - 2009-07-14 07:57 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-08-26 00:52 - 2009-07-14 07:54 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-08-26 00:51 - 2015-08-09 00:50 - 00001078 _____ C:\Users\User\Desktop\Windows Doctor.lnk
2016-08-26 00:51 - 2015-06-16 21:42 - 00001268 _____ C:\Users\User\Desktop\Notepad.lnk
2016-08-26 00:51 - 2015-05-19 21:09 - 00002116 _____ C:\Users\User\Desktop\Minecraft.lnk
2016-08-26 00:51 - 2015-05-18 16:45 - 00000000 ____D C:\ProgramData\{ffc7098d-e1d4-dc07-ffc7-7098de1d2637}
2016-08-26 00:51 - 2015-03-15 15:38 - 00001011 _____ C:\Users\User\Desktop\SpeedFan.lnk
2016-08-26 00:51 - 2015-03-07 22:41 - 00001928 _____ C:\Users\User\Desktop\Counter-Strike WaRzOnE.lnk
2016-08-26 00:51 - 2015-03-07 22:41 - 00000982 _____ C:\Users\User\Desktop\Half-Life WaRzOnE.lnk
2016-08-26 00:51 - 2015-03-07 22:41 - 00000920 _____ C:\Users\User\Desktop\HLDS.lnk
2016-08-26 00:51 - 2015-03-07 22:17 - 00001746 _____ C:\Users\User\Desktop\Archeage.lnk
2016-08-26 00:51 - 2015-03-07 22:10 - 00000860 _____ C:\Users\User\Desktop\Glyph.lnk
2016-08-26 00:51 - 2015-03-07 19:45 - 00000355 _____ C:\Users\User\Desktop\My computer.lnk
2016-08-26 00:51 - 2015-03-06 17:49 - 00000000 ____D C:\Program Files (x86)\InstallShield
2016-08-26 00:51 - 2015-03-06 17:46 - 00000812 _____ C:\Users\User\Desktop\µTorrent.lnk
2016-08-26 00:51 - 2015-03-06 17:46 - 00000792 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2016-08-26 00:51 - 2015-03-06 13:56 - 00003075 _____ C:\Users\User\Desktop\Microsoft Word 2010.lnk
2016-08-26 00:51 - 2015-03-06 13:56 - 00003011 _____ C:\Users\User\Desktop\Microsoft Excel 2010.lnk
2016-08-26 00:51 - 2015-03-06 13:56 - 00003003 _____ C:\Users\User\Desktop\Microsoft Access 2010.lnk
2016-08-26 00:51 - 2015-03-06 13:56 - 00002967 _____ C:\Users\User\Desktop\Microsoft PowerPoint 2010.lnk
2016-08-26 00:51 - 2009-07-14 08:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-08-26 00:51 - 2009-07-14 07:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-08-26 00:49 - 2016-02-03 21:57 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-26 00:36 - 2015-03-06 13:55 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-26 00:33 - 2015-03-06 13:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-08-26 00:33 - 2015-03-06 13:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-08-24 19:35 - 2009-07-14 06:20 - 00000000 ____D C:\Windows\system32\NDF
2016-08-24 00:39 - 2015-03-28 21:27 - 00000000 ____D C:\ProgramData\Package Cache
2016-08-24 00:39 - 2009-07-14 06:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2016-08-23 17:15 - 2015-03-06 17:45 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2016-08-23 14:46 - 2015-03-07 22:12 - 00000000 ___HD C:\Windows\msdownld.tmp
2016-08-23 14:46 - 2015-03-07 22:12 - 00000000 ____D C:\Windows\SysWOW64\directx
2016-08-23 14:42 - 2015-06-29 23:15 - 00000000 ____D C:\The KMPlayer
2016-08-22 23:07 - 2015-07-22 02:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCWest
2016-08-22 23:07 - 2015-07-22 02:47 - 00000000 ____D C:\Program Files (x86)\NCWest
2016-08-20 19:09 - 2015-05-19 21:09 - 00000000 ____D C:\Users\User\AppData\Roaming\.minecraft
2016-08-20 18:58 - 2015-07-05 15:49 - 00000263 _____ C:\Users\User\Desktop\Aaa.txt
2016-08-13 16:49 - 2015-03-07 20:34 - 00000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
2016-08-12 03:09 - 2009-07-14 06:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-08-10 13:30 - 2015-03-06 12:19 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-08-10 13:30 - 2015-03-06 12:19 - 00000000 ____D C:\ProgramData\Skype
2016-08-04 17:09 - 2015-03-08 18:11 - 00000000 ____D C:\Users\User\AppData\Roaming\TS3Client
2016-08-01 21:27 - 2016-01-15 21:38 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-08-01 16:20 - 2015-03-06 12:43 - 00000000 ____D C:\ProgramData\Oracle
2016-08-01 16:19 - 2015-03-06 12:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-08-01 16:19 - 2015-03-06 12:43 - 00000000 ____D C:\Program Files\Java
2016-08-01 16:19 - 2015-03-06 12:43 - 00000000 ____D C:\Program Files (x86)\Java
2016-08-01 16:18 - 2015-03-06 12:43 - 00110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2016-07-29 14:44 - 2016-02-03 21:57 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-29 14:44 - 2016-02-03 21:57 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-06-02 16:10 - 2015-06-07 01:55 - 0000024 _____ () C:\Users\User\AppData\Roaming\appdataFr25.bin
2015-04-14 19:28 - 2015-04-14 19:28 - 0004387 _____ () C:\Users\User\AppData\Roaming\CwGvb82MBJ3ahvghCReQC0
2016-08-13 16:50 - 2016-08-13 16:51 - 0033193 _____ () C:\Users\User\AppData\Roaming\UserTile.png
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\User\AppData\Roaming\y0l0BnkDxRbkvSy8YkX
2016-08-11 23:08 - 2016-08-11 23:08 - 0000000 ___SH () C:\Users\User\AppData\Local\LumaEmu
2015-03-06 17:16 - 2015-03-06 17:16 - 0007618 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg
2015-03-06 17:46 - 2015-03-06 17:47 - 0000402 _____ () C:\Users\User\AppData\Local\Temp-log.txt
2015-05-18 16:49 - 2015-05-18 16:49 - 0000000 _____ () C:\Users\User\AppData\Local\Temp.dat
2015-03-15 15:26 - 2015-03-15 15:26 - 0000000 _____ () C:\Users\User\AppData\Local\{7401BEE2-4842-43CF-8ABC-978AFBD9FF12}
2016-07-05 00:07 - 2016-07-05 00:07 - 0000000 _____ () C:\Users\User\AppData\Local\{9BFCE9CB-E989-4213-9F2C-CA1B90E6B371}

Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\6OvxSyGEqo5P.exe
C:\Users\User\AppData\Local\Temp\8dX9aAghyKQn.exe
C:\Users\User\AppData\Local\Temp\AskSLib.dll
C:\Users\User\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\User\AppData\Local\Temp\ca6f206c12609fc77c05df95f61c41c3.dll
C:\Users\User\AppData\Local\Temp\d4f5d244a0909d75573750c06e9db24d.dll
C:\Users\User\AppData\Local\Temp\drm_dialogs.dll
C:\Users\User\AppData\Local\Temp\hcuninstaller_20150822_152427_704.exe
C:\Users\User\AppData\Local\Temp\jre-8u101-windows-au.exe
C:\Users\User\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\User\AppData\Local\Temp\K12R6tVO2g8F.exe
C:\Users\User\AppData\Local\Temp\KMPAddedCode_KMP_adpageopen_Step1.exe
C:\Users\User\AppData\Local\Temp\namebench.exe
C:\Users\User\AppData\Local\Temp\Nyia6FIAO5Qn.exe
C:\Users\User\AppData\Local\Temp\playstv_patch.exe
C:\Users\User\AppData\Local\Temp\python27.dll
C:\Users\User\AppData\Local\Temp\radeon-crimson-16.3.2-minimalsetup.exe
C:\Users\User\AppData\Local\Temp\raptrpatch.exe
C:\Users\User\AppData\Local\Temp\raptr_stub.exe
C:\Users\User\AppData\Local\Temp\sfamcc00001.dll
C:\Users\User\AppData\Local\Temp\sfareca00001.dll
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
C:\Users\User\AppData\Local\Temp\tcl85.dll
C:\Users\User\AppData\Local\Temp\tk85.dll
C:\Users\User\AppData\Local\Temp\tmp1DFB.exe
C:\Users\User\AppData\Local\Temp\tmp3DDA.exe
C:\Users\User\AppData\Local\Temp\tmpB894.exe
C:\Users\User\AppData\Local\Temp\vsredistsetup.exe
C:\Users\User\AppData\Local\Temp\wVx4rt.exe
C:\Users\User\AppData\Local\Temp\_is2C0F.exe
C:\Users\User\AppData\Local\Temp\_is2F2.exe
C:\Users\User\AppData\Local\Temp\_is57E.exe
C:\Users\User\AppData\Local\Temp\_is8A08.exe
C:\Users\User\AppData\Local\Temp\_is8C86.exe
C:\Users\User\AppData\Local\Temp\_isF95B.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume1
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {current}
resumeobject            {d4a2baec-c42b-11e4-8017-8dbfc1472d54}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {d4a2baee-c42b-11e4-8017-8dbfc1472d54}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {d4a2baec-c42b-11e4-8017-8dbfc1472d54}
nx                      OptIn

Windows Boot Loader
-------------------
identifier              {d4a2baee-c42b-11e4-8017-8dbfc1472d54}
device                  ramdisk=[C:]\Recovery\d4a2baee-c42b-11e4-8017-8dbfc1472d54\Winre.wim,{d4a2baef-c42b-11e4-8017-8dbfc1472d54}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\d4a2baee-c42b-11e4-8017-8dbfc1472d54\Winre.wim,{d4a2baef-c42b-11e4-8017-8dbfc1472d54}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {d4a2baec-c42b-11e4-8017-8dbfc1472d54}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume1
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  en-US
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 Yes

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {d4a2baef-c42b-11e4-8017-8dbfc1472d54}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\d4a2baee-c42b-11e4-8017-8dbfc1472d54\boot.sdi

LastRegBack: 2016-08-18 19:29

==================== End of FRST.txt ============================

 

 

 

 

 

Addition.txt

 

 

Редактирано от Преслав Пламенов (преглед на промените)

Фикс с Farbar Recovery Scan Tool

 
icon13.gif Изтеглете прикачения файл - fixlist.txt  и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.
Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.
 
ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

 

BY4dvz9.png Сканиране с AdwCleaner

 
Моля, изтеглете и стартирайте програмата AdwCleaner (by Xplode):

  • Затворете всички стартирани програми и браузъри
  • Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
  • Натиснете OK, за да потвърдите, че всички стартирани програми ще бъдат затворени.
  • Маркирайте Clean
  • Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.
  • Моля, да публикувате съдържанието на този лог в отговора си

 

E3feWj5.png  Сканиране с Junkware Removal Tool
 
Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

122.jpg?1414578932  Моля, изтеглете  Check Browsers' LNK by Dragokas & regist

  • Запомнете архива на вашия декстоп,разархивирате.
  • Временно спрете вашия  антивирусен софтуер.
  • Стартирайте файла Check Browsers LNK.exe от името на администратор.
  • Изчакайте програмата да завърши работата си.Това може да отнеме до 5 минути. Моля бъдете търпеливи. След сканирането, отворете генерираната папка LOG и публикувайте отчета Check_Browsers_LNK.log, в следвашия си пост.

 

25.jpg?1426074241   Сканиране с SecurityCheck by glax24

  • Изтеглете SecurityCheck by glax24 от тук и запомнете инструмента на десктопа .
  • Стартирате програмата (ако използвате Windows XP) или стартирате с десен бутон на мишката от името на администратор (ако използватеWindows Vista/7/8/10)
  • Изчакайте да приключи сканирането.Ще се отвори в текстов файл с имеSecurityCheck.txt. Копирайте съдържанието на  този файл  следващия си пост
  • Можете да намерите този файл в основната директория на системния диск в папка с име SecurityCheck, напр. C:\SecurityCheck\SecurityCheck.txt

 

pfNZP4A.png  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FixLog.txt
  • AdwCleaner.txt
  • JRT.txt
  • Check_Browsers_LNK.log
  • SecurityCheck.txt

Какво е положението след сканиранията до тук..? Има ли промяна..?

 

Направете ново  сканиране с Farbar Recovery Scan Tool като предварително изтриете вашето копие и карантинната папка на инструмента разположена вC:FRSТ\Quarantine. Изтеглете последна свежа версия и сканирайте..!

 

Сканиране с Farbar Recovery Scan Tool

  • Моля изтеглете icon1337953436.pngFarbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете надесктопа.
  • Стартирайте файла FRST.exe (или FRST64.exe)
  • Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
  • Натиснете бутона YClYkft.jpg.
  • Изчакайте търпеливо проверката да приключи.
  • Ще се създадат два лог файла с името - FRST.txt и Addition.txt надесктопа.
  • Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение). 

Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FRST.txt (копирате цялото съдържание)
  • Addition.txt (прикачате..)

 

 

 

  • Автор
преди 55 минути, icotonev написа:

..нали те предупредих да не ми цитираш постовете...!! Третия път ще затворя темата ...!

Да ти кажа, че е същото. Ето пиша нещо в гугъл търсачката и след като натисна ентър ме изпраща във http://go.mail.ru/search?q=cs&gp=809001&frc=809001.

преди 3 минути, Преслав Пламенов написа:

Да ти кажа, че е същото. Ето пиша нещо в гугъл търсачката и след като натисна ентър ме изпраща

Очаквам резултати от сканирането...То ако беше много лесно....!!!

на 28.08.2016 г. в 21:31, icotonev написа:

Какво е положението след сканиранията до тук..? Има ли промяна..?

 

Направете ново  сканиране с Farbar Recovery Scan Tool като предварително изтриете вашето копие и карантинната папка на инструмента разположена вC:FRSТ\Quarantine. Изтеглете последна свежа версия и сканирайте..!

 

Сканиране с Farbar Recovery Scan Tool

  • Моля изтеглете icon1337953436.pngFarbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете надесктопа.
  • Стартирайте файла FRST.exe (или FRST64.exe)
  • Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
  • Натиснете бутона YClYkft.jpg.
  • Изчакайте търпеливо проверката да приключи.
  • Ще се създадат два лог файла с името - FRST.txt и Addition.txt надесктопа.
  • Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение). 

Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FRST.txt (копирате цялото съдържание)
  • Addition.txt (прикачате..)

 

 

 

Сканирането от този пост ..! :)

  • Автор
на 8/28/2016 в 19:09, Преслав Пламенов написа:

 

JRT.txt

SecurityCheck.txt

Check_Browsers_LNK.log

Fixlog.txt

AdwCleaner[C0].txt

 

 

на 8/28/2016 в 21:31, icotonev написа:

Какво е положението след сканиранията до тук..? Има ли промяна..?

 

Направете ново  сканиране с Farbar Recovery Scan Tool като предварително изтриете вашето копие и карантинната папка на инструмента разположена вC:FRSТ\Quarantine. Изтеглете последна свежа версия и сканирайте..!

 

Сканиране с Farbar Recovery Scan Tool

  • Моля изтеглете icon1337953436.pngFarbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете надесктопа.
  • Стартирайте файла FRST.exe (или FRST64.exe)
  • Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
  • Натиснете бутона YClYkft.jpg.
  • Изчакайте търпеливо проверката да приключи.
  • Ще се създадат два лог файла с името - FRST.txt и Addition.txt надесктопа.
  • Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение). 

Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FRST.txt (копирате цялото съдържание)
  • Addition.txt (прикачате..)

 

 

 

Ето заповядай :D

FRST.txt

 

Редактирано от Преслав Пламенов (преглед на промените)

  • Автор

Това са последните текстови документи, които са от сканирането. :)

Addition.txt

FRST.txt

Редактирано от Преслав Пламенов (преглед на промените)

102.jpg?1414583023 Моля, изтеглете ClearLNK by Dragokas & regist.

  • Запомнете архива на вашия декстоп,разархивирате програмата ClearLNK
  • Влачите и пускате файла Check_Browsers_LNK.log (логът генериран от програмата Check Browsers LNK в предния ми инструкция) на иконката на програмата ClearLNK.


[IMG]

  • Ще се генерира отчет ClearLNK-<Дата>.log, който ще бъде създаден в папката LOG. Публикувайте дневника в следващия си пост.

 

GfiJrQ9.png Malwarebytes Anti-Malware (MBAM)

Моля, изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-bc.1878-2.2.0.1024.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

DkgJ7Zr.png

  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категорията Detection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.

65ZBqkR.jpg

  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

 

 

  • Автор

Виж там където пише High risk. Точно това търся, Start menu за да изтрия войти в интернет.

Check_Browsers_LNK.log

Да отбележа, скоростта на браузърът ми се подобри. :)

Не се мъчи сам ....а следвай инструкцията :

Цитат

102.jpg?1414583023 Моля, изтеглете ClearLNK by Dragokas & regist.

  • Запомнете архива на вашия декстоп,разархивирате програмата ClearLNK
  • Влачите и пускате файла Check_Browsers_LNK.log (логът генериран от програмата Check Browsers LNK в предния ми инструкция) на иконката на програмата ClearLNK.


[IMG]

  • Ще се генерира отчет ClearLNK-<Дата>.log, който ще бъде създаден в папкатаLOG. Публикувайте дневника в следващия си пост.

...и програмата ще си свърши работата... Вие сте се объркали и сте направили повторно сканиране с  Check Browsers LNK ....С тази програма само сканираме ..а с програмата от карето трием и поправяме...Две програми са....!

преди 19 часа, Преслав Пламенов написа:

Да отбележа, скоростта на браузърът ми се подобри

Това е чудесно..! А с основния проблем редиректа към Mail.ru какво се случва..?

Очаквам резултата и от сканирането с Malwarebytes Anti-Malware ..!

  • Автор

Да, продължава да ме пренасочва в mail.ru при всяко търсене в Google.

Аз имам Malwarebytes и съм сканирал всичко.

Malwarebytes Anti-Malware
www.malwarebytes.org

Дата на сканиране: 01.09.2016
Час на сканиране: 20:33
Дневник: 
Администратор: Да

Версия: 2.2.1.1043
База от данни за злонамерен софтуер: v2016.09.01.09
База от данни за рууткити: v2016.08.15.01
Лиценз: Пробен период
Защита от злонамерен софтуер: Разрешено
Защита от злонамерени страници: Разрешено
Самозащита: Забранено

ОС: Windows 7 Service Pack 1
Процесор: x64
Файлова система: NTFS
Потребител: User

Тип сканиране: Хипер сканиране
Резултат: Завършено
Сканиране обекти: 241344
Изминало време: 0 мин. 58 сек.

Памет: Разрешено
Начално стартиране: Разрешено
Файлова система: Забранено
Архиви: Разрешено
Рууткити: Забранено
Евристика: Разрешено
ПНП: Разрешено
ПНИ: Разрешено

Процеси: 0
(Не бяха открити злонамерени обекти)

Модули: 0
(Не бяха открити злонамерени обекти)

Ключове в системния регистър: 0
(Не бяха открити злонамерени обекти)

Стойности в системния регистър: 0
(Не бяха открити злонамерени обекти)

Данни в системния регистър: 0
(Не бяха открити злонамерени обекти)

Папки: 0
(Не бяха открити злонамерени обекти)

Файлове: 0
(Не бяха открити злонамерени обекти)

Физически сектори: 0
(Не бяха открити злонамерени обекти)


(end)

 

Фикс с Farbar Recovery Scan Tool

 

 
icon13.gif Изтеглете прикачения файл - fixlist.txt     и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.
Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.
 
ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

 

  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FixLog.txt

 

  • Автор

Като търся нещо ме праща 1во тък http://searchtds.ru/?sclient=psy-ab&site=&source=hp&btnG=Търсене&q=a&oq=&gs_l=&pbx=1&ref=aoy67&ref=aoy67 и след това http://go.mail.ru/search?q=a&gp=809001&frc=809001.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.