Накратко нищо не мога да отворя без да дам ''изпълни като администратор'' в противен случай ме пита ''с какво да бъде отворен даденият .exe файл''....  

Уж имам malware пък нищо не хвана...  

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016
Ran by Ali (09-09-2016 21:13:18)
Running from C:\Users\Ali\Desktop
Windows 8.1 Pro (Update) (X64) (2016-08-27 10:19:32)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1930933297-513042792-53178134-500 - Administrator - Disabled)
Ali (S-1-5-21-1930933297-513042792-53178134-1001 - Administrator - Enabled) => C:\Users\Ali
Guest (S-1-5-21-1930933297-513042792-53178134-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1930933297-513042792-53178134-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1930933297-513042792-53178134-1001\...\uTorrent) (Version: 3.4.8.42576 - BitTorrent Inc.)
Ansel (Version: 372.54 - NVIDIA Corporation) Hidden
Audacity 2.1.2 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
Camtasia Studio 8 (HKLM-x32\...\{5303CFB5-D635-44F0-A94B-9611E81F07C4}) (Version: 8.3.0.1471 - TechSmith Corporation)
City Car Driving 1.2.2 (HKLM-x32\...\{CC457F3D-5CDE-4CE8-9685-90A4EDE81374}_is1) (Version:  - Forward Development)
Counter Strike Clean version 1.6 (HKLM-x32\...\{DDABCD2D-BDE4-4233-BD41-4620415C00DC}_is1) (Version: 1.6 - Fullserver)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version:  - Valve)
DiRT Rally ver. 1.22 (HKLM-x32\...\{FCF47C8B-8965-4843-86A3-9BF4070A105F}_is1) (Version: 1.22 - *LetsPlay*)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Intel(R) USB 3.0 Host Controller Adaptation Driver (HKLM\...\{9472AEE5-5D4D-4329-8BD8-B282FD33B8E0}) (Version: 1.0.1.45 - Intel Corporation)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
KMSpico v9.0.6.20131120 (HKLM\...\KMSpico_is1) (Version: 9.0.6.20131120 - )
Malwarebytes Anti-Malware, версия 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Minecraft1.8 (HKLM-x32\...\Minecraft1.8) (Version:  - )
NVIDIA 3D Vision Controller Driver 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 372.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 372.54 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.11.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.0 - NVIDIA Corporation)
NVIDIA Graphics Driver 372.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 372.54 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.15 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.15 - NVIDIA Corporation)
NVIDIA Miracast Virtual Audio 372.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 372.54 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7727 - Realtek Semiconductor Corp.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.9.6 - Rockstar Games)
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Skype™ 7.26 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.26.101 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
TP-LINK TL-WN721N_TL-WN722N Driver (HKLM-x32\...\{86A7EED0-02D0-4D91-8183-8D2F23F5E6AE}) (Version: 1.3.1 - TP-LINK)
TruckersMP 0.2.1.0.2 Alpha (HKLM\...\{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 0.2.1.0.2 Alpha - ETS2MP Team)
Vegas Pro 13.0 (64-bit) (HKLM\...\{CDA02BF0-BFBC-11E3-AFA0-F04DA23A5C58}) (Version: 13.0.290 - Sony)
Viber (HKU\S-1-5-21-1930933297-513042792-53178134-1001\...\{d96d3a07-b1fd-4625-b739-627196eb9aac}) (Version: 6.2.0.1306 - Viber Media Inc.)
Viber (x32 Version: 6.2.0.1306 - Viber Media Inc.) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.11.1 (HKLM\...\VulkanRT1.0.11.1) (Version: 1.0.11.1 - LunarG, Inc.)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinRAR 5.40 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {73C25BE8-E49C-4DAA-A89F-94D309BB9337} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-09] ()
Task: {E84AD0F8-2264-4A3D-98C6-898331D5B381} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-11-20] ()
Task: {F7F91A9F-5C1E-4CB5-8920-C5A499E0EE97} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-09-09] ()

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft\Minecraft Debugger.lnk -> C:\Users\Ali\AppData\Roaming\.minecraft\minecraft launcher\Debug.bat ()

==================== Loaded Modules (Whitelisted) ==============

2016-08-27 13:38 - 2016-08-11 14:49 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

HKLM\...\exefile\shell\open\command: C:\Windows\svchost.com "%1" %* <===== ATTENTION

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 16:25 - 2013-08-22 16:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1930933297-513042792-53178134-1001\Control Panel\Desktop\\Wallpaper -> D:\Мойте снимки и видеа\Cars\12622340_912563178821970_4364277598375854273_o.jpg
DNS Servers: 77.71.75.1 - 77.71.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1930933297-513042792-53178134-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-1930933297-513042792-53178134-1001\...\StartupApproved\Run: => "Viber"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{8220C60D-7E52-47C3-B196-C83D8F8E044E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{BCB938E2-A4BB-4F12-BDE9-68064DC07694}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{51776408-164B-4DAA-8455-679D3FB85663}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{3DDF320C-2E44-4109-9C75-BDDC7A4D8298}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{8A7FFDD0-FF1A-4A4B-9719-33526C1936AE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{E3D6DA93-76A4-4D7E-A54E-269D0F0F6F9B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{E5476EA1-BE4B-453B-AAC9-F4BDFADC1CC8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4C7020C1-EAF0-416C-A908-1896AFD65C69}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{61BBC61A-F9F4-47BB-9CDA-20305BC782D8}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{260F4D79-7F97-466F-B3B5-87A4D5042198}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{E283C19E-04B7-4765-B732-ED5D9405DA1C}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{CDBAF3DC-5BF6-4617-96AA-B27D885FBEE2}] => (Allow) C:\Users\Ali\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{7C404ED5-30DC-4A40-8BC1-E6D311E4A76A}] => (Allow) C:\Users\Ali\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{1F8F3A75-E435-4E19-9005-E04E8ED2D8B2}] => (Allow) C:\Users\Ali\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{7EFE3728-E433-478A-B36E-1243A5305FED}] => (Allow) C:\Users\Ali\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{AE134241-2128-4948-A07F-3D2442A94543}] => (Allow) C:\Users\Ali\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{87E699C8-31DF-4EB0-A168-D4D40CE7D897}] => (Allow) C:\Users\Ali\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{7E9F9553-2B6B-478E-8D62-4D63171C0B85}] => (Allow) E:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{AE4265EC-B930-4186-A0D1-E478CAA0EC6A}] => (Allow) E:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{9F9CF0E3-04B9-4BD4-BB93-590E1945854D}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{C4BE1988-7D9A-494C-B728-611D6F60EC4D}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{44FB7863-D107-4D69-BE8B-A2059698AC62}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{D844BCC2-A343-4D13-ACA6-FEDDE48960A8}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{CDCD643F-D2F9-4F00-A511-00E695F2DE72}] => (Allow) E:\SteamLibrary\steamapps\common\The Forest\TheForest.exe
FirewallRules: [{B8E2367C-82EE-4F79-A8B5-CCDA194E6692}] => (Allow) E:\SteamLibrary\steamapps\common\The Forest\TheForest.exe
FirewallRules: [TCP Query User{5C191C76-670F-430B-9C1F-65CFC30E4F68}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [UDP Query User{2A9A6E4C-B363-4905-ABC8-B3BA9FAE0849}C:\program files (x86)\winamp\winamp.exe] => (Allow) C:\program files (x86)\winamp\winamp.exe
FirewallRules: [{2C7C7BC8-3BC9-465D-A1F9-130122D5FAA1}] => (Allow) E:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{52786F62-DE73-4037-A87C-ED87E33DCBF8}] => (Allow) E:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{93C8F178-4378-427D-9FBE-3A9007E1ABA4}] => (Allow) E:\SteamLibrary\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{EF8F0323-0EFF-4889-B8BB-9CFF155890FC}] => (Allow) E:\SteamLibrary\steamapps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{FF134922-0A6C-4ED9-981C-12947C868A7C}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{1248B73D-2CE8-46D0-9B10-D15712A8FA95}] => (Allow) LPort=8317
FirewallRules: [{375BE32F-099B-45B1-B5AF-A238DB114D16}] => (Allow) E:\SteamLibrary\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [{364D80F9-1F6F-43B8-8EB1-F487C82AD76B}] => (Allow) E:\SteamLibrary\steamapps\common\Team Fortress 2\hl2.exe
FirewallRules: [TCP Query User{ACD2CBF0-E29F-42A0-9E64-A5CCB3976E9D}C:\program files (x86)\java\jre1.8.0_101\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_101\bin\javaw.exe
FirewallRules: [UDP Query User{52709FF1-F10C-4E8F-B0F4-B0165D80A7F8}C:\program files (x86)\java\jre1.8.0_101\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_101\bin\javaw.exe
FirewallRules: [{F1458935-F44A-4E3E-87DE-EDD2A42252FB}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{60F05E04-80C9-46B6-AA41-DB4848CA7A08}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{67993F5A-3508-4CFE-949E-9C04C9D36C18}] => (Allow) C:\Program Files\KMSpico\KMSServer.exe
FirewallRules: [{6B938D83-7B4C-4E7B-8FD3-465FE28E976B}] => (Allow) C:\Program Files\KMSpico\KMSServer.exe
FirewallRules: [{7820059D-B8AA-4B8D-9CCD-2092F80C6777}] => (Allow) LPort=1688
FirewallRules: [{3692864C-E15C-4E8F-BFE6-5E0FECB8711C}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{074199D4-F71B-4CDC-9762-4334411E7DA0}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{95D20565-67AA-477E-A227-23D1E636B804}] => (Allow) C:\Windows\System32\KMSServer.exe
FirewallRules: [{A38ECA2B-49CF-4893-926B-982968002DF8}] => (Allow) C:\Windows\System32\KMSServer.exe
FirewallRules: [{75B3F83B-2A4B-4254-BCE6-733C2434E94E}] => (Allow) E:\SteamLibrary\steamapps\common\Farming Simulator 15\x64\FarmingSimulator2015Game.exe
FirewallRules: [{B6029EA3-E343-4D86-BB17-AC9965C69814}] => (Allow) E:\SteamLibrary\steamapps\common\Farming Simulator 15\x64\FarmingSimulator2015Game.exe
FirewallRules: [{EE968E9D-B69A-4360-84AA-787F5667DCCF}] => (Allow) E:\SteamLibrary\steamapps\common\Farming Simulator 15\x86\FarmingSimulator2015Game.exe
FirewallRules: [{49DB47B4-99AE-4B52-8C4C-543F561E6ECF}] => (Allow) E:\SteamLibrary\steamapps\common\Farming Simulator 15\x86\FarmingSimulator2015Game.exe
FirewallRules: [{E9EEC084-7D94-4BD6-9C89-D49D745B9DFF}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{9009D8E3-12C7-4F03-B1F9-54097D7562F6}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe
FirewallRules: [{FE6E39E5-2DF6-4906-B9CB-3C69E0435E63}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{7E291931-69E2-4B64-9742-90A00309823E}] => (Allow) E:\SteamLibrary\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe
FirewallRules: [{3A416DD3-6DDE-408E-A36D-4AA3E5432671}] => (Allow) E:\SteamLibrary\steamapps\common\EvolveGame\bin64_SteamRetail\Evolve.exe
FirewallRules: [{6BE04F38-DBDB-4376-95CE-BEF246F29A6A}] => (Allow) E:\SteamLibrary\steamapps\common\EvolveGame\bin64_SteamRetail\Evolve.exe
FirewallRules: [{9CB4C81B-B26D-4E01-B6CD-4DB35CB11675}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{46E73C92-12A6-4866-B3A2-0709702B37A4}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{B719A2B7-E54F-4F2B-971F-695242057438}] => (Allow) C:\Program Files\KMSpico\AutoPico.exe
FirewallRules: [{C4C51265-32A8-44F3-B835-183D9186E4D0}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{1316B354-8E88-4C0E-B3E5-B252DA0CEC7F}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{FAAC284B-738C-409D-AF8C-D076149E0979}] => (Allow) C:\Windows\System32\KMSServer.exe
FirewallRules: [{7B3FFAFC-D194-4882-B279-003936903653}] => (Allow) C:\Windows\System32\KMSServer.exe

==================== Restore Points =========================

04-09-2016 14:18:07 Installed DirectX
05-09-2016 14:26:29 Microsoft Visual C++ 2005 Redistributable е инсталиран

==================== Faulty Device Manager Devices =============

Name: SM Bus Controller
Description: SM Bus Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Data Acquisition and Signal Processing Controller
Description: PCI Data Acquisition and Signal Processing Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: PCI Memory Controller
Description: PCI Memory Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (09/09/2016 09:07:56 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT AUTHORITY)
Description: There was an error with the Windows Location Provider database

Error: (09/09/2016 09:05:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: Service_KMS.exe, версия: 10.4.2.0, времево клеймо: 0x528cf0d7
Име на модул с грешки: unknown, версия: 0.0.0.0, времево клеймо: 0x00000000
Код на изключение: 0x00000000
Отместване на грешка: 0x00007ffbf84d25ac
ИД на процес на грешка: 0x7cc
Начален час на приложението с грешки: 0x01d20ac4b2c200a4
Път на приложението с грешки: C:\Program Files\KMSpico\Service_KMS.exe
Път на модула с грешки: unknown
ИД на доклад: 0c0e91c8-76b8-11e6-825e-408d5c1ede54
Пълно име на пакета с грешка:
ИД на свързаното с пакета с грешка приложение:

Error: (09/09/2016 08:29:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: GTA5.exe, версия: 1.0.791.2, времево клеймо: 0x577cc8ce
Име на модул с грешки: nvwgf2umx.dll, версия: 21.21.13.7254, времево клеймо: 0x57ac5ab4
Код на изключение: 0xc0000005
Отместване на грешка: 0x00000000006cf5f9
ИД на процес на грешка: 0x17c8
Начален час на приложението с грешки: 0x01d20abcde52e51c
Път на приложението с грешки: E:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTA5.exe
Път на модула с грешки: C:\Windows\SYSTEM32\nvwgf2umx.dll
ИД на доклад: fa0980be-76b2-11e6-825d-408d5c1ede54
Пълно име на пакета с грешка:
ИД на свързаното с пакета с грешка приложение:

Error: (09/09/2016 08:20:45 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALI-PC)
Description: Активирането на приложението Microsoft.BingWeather_8wekyb3d8bbwe!App е неуспешно с грешка: -2144927148 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

Error: (09/09/2016 08:08:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Име на приложение с грешки: GTA5.exe, версия: 1.0.791.2, времево клеймо: 0x577cc8ce
Име на модул с грешки: nvwgf2umx.dll, версия: 21.21.13.7254, времево клеймо: 0x57ac5ab4
Код на изключение: 0xc0000005
Отместване на грешка: 0x00000000006cf5f9
ИД на процес на грешка: 0x14f4
Начален час на приложението с грешки: 0x01d20ab59a374ce4
Път на приложението с грешки: E:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTA5.exe
Път на модула с грешки: C:\Windows\SYSTEM32\nvwgf2umx.dll
ИД на доклад: 03415e05-76b0-11e6-825d-408d5c1ede54
Пълно име на пакета с грешка:
ИД на свързаното с пакета с грешка приложение:

Error: (09/09/2016 06:20:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALI-PC)
Description: Активирането на приложението Microsoft.BingWeather_8wekyb3d8bbwe!App е неуспешно с грешка: -2144927148 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

Error: (09/09/2016 04:20:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALI-PC)
Description: Активирането на приложението Microsoft.BingWeather_8wekyb3d8bbwe!App е неуспешно с грешка: -2144927148 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

Error: (09/09/2016 02:20:42 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALI-PC)
Description: Активирането на приложението Microsoft.BingWeather_8wekyb3d8bbwe!App е неуспешно с грешка: -2144927148 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

Error: (09/09/2016 12:20:40 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALI-PC)
Description: Активирането на приложението Microsoft.BingWeather_8wekyb3d8bbwe!App е неуспешно с грешка: -2144927148 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

Error: (09/09/2016 12:05:41 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ALI-PC)
Description: Активирането на приложението Microsoft.BingWeather_8wekyb3d8bbwe!App е неуспешно с грешка: -2144927148 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

System errors:
=============
Error: (09/09/2016 09:08:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга Услуга на Google Актуализация (gupdate) не може да бъде стартирана поради следната грешка:
Услугата не отговори навреме на искане за стартиране или управление.

Error: (09/09/2016 09:08:10 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Изтекъл период на изчакване (30000 милисекунди) при изчакване на услуга Услуга на Google Актуализация (gupdate) да се свърже.

Error: (09/09/2016 09:06:05 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Услуга Service KMSELDI беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

Error: (09/09/2016 09:06:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Услуга KMS Server Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

Error: (09/09/2016 09:05:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Изтекъл период на изчакване (30000 милисекунди) при изчакване на услуга Skype Updater да се свърже.

Error: (09/09/2016 09:04:38 PM) (Source: Application Popup) (EventID: 56) (User: )
Description: ACPI5

Error: (09/09/2016 09:03:57 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Услуга Услуга за мрежово споделяне на Windows Media Player зависи от услуга Windows Search, която не може да бъде стартирана поради следната грешка:
Услугата не стартира поради неуспешно влизане.

Error: (09/09/2016 09:03:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга Windows Search не може да бъде стартирана поради следната грешка:
Услугата не стартира поради неуспешно влизане.

Error: (09/09/2016 09:03:57 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Услуга WSearch не може да влезе като NT AUTHORITY\SYSTEM с текущо конфигурираната парола, поради следната грешка:
Заявката не се поддържа.

За да осигурите правилното конфигуриране на услугата, използвайте конзолната добавка за услуги в конзолата на Microsoft за управление (MMC).

Error: (09/09/2016 09:03:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга Windows Search не може да бъде стартирана поради следната грешка:
Услугата не стартира поради неуспешно влизане.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-6500 CPU @ 3.20GHz
Percentage of memory in use: 33%
Total physical RAM: 8072.6 MB
Available physical RAM: 5388.12 MB
Total Virtual: 13192.6 MB
Available Virtual: 10135.56 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:97.56 GB) (Free:30.54 GB) NTFS
Drive d: () (Fixed) (Total:195.31 GB) (Free:76.94 GB) NTFS
Drive e: () (Fixed) (Total:638.54 GB) (Free:462.37 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: CE1AE8C5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=638.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 

Това е FRST файла, нещо не успях да го кача..

http://www.mediafire.com/download/5na3d5i4tut3nh1/FRST.txt

И тази тема ли смяташ да оставиш, не довършена като тази: ???

 

току-що, Stoyannnov написа:

И тази тема ли смяташ да оставиш, не довършена като тази: ???

 

Не съм я оставил, просто я приключих.. Проблемът беше решен там

Можеше да върнеш някакъв отговор не да стоя и да чакам в неведение. 

Опиши по-подробно проблема? Това само с .exe разширения ли се получава? При двукратен клик те пита с какво да отвориш файла, а като го стартираш като администратор се отваря така ли? Или пак не се отваря?

преди 22 минути, Stoyannnov написа:

Можеше да върнеш някакъв отговор не да стоя и да чакам в неведение. 

Опиши по-подробно проблема? Това само с .exe разширения ли се получава? При двукратен клик те пита с какво да отвориш файла, а като го стартираш като администратор се отваря така ли? Или пак не се отваря?

Ясно, извинявам се

Проблемът е само при .exe файлове при кликване два пъти не се отваря и ме пита с какво да я стартира, а когато дам да отварям като администартор се отваря. Windows 8.1 64 bits.

П.П Сега забелязах, че и Control Panel не се отваря пише че control.exe в system32 липсва, това може би се дължи на факта, че е .ехе файл, не че липсва

Редактирано 9 септември 201610 г. от Djani_Varna (преглед на промените)

Изтегли файла exe.reg

• Запази го на десктопа.
• Стартирай го като администратор.
• Потвърди с YES.
• Рестартирай машината и кажи дали има промяна.

 

преди 7 минути, Stoyannnov написа:

Изтегли файла exe.reg

• Запази го на десктопа.
• Стартирай го като администратор.
• Потвърди с YES.
• Рестартирай машината и кажи дали има промяна.

 

Cannot import .... exe.reg: Not all data was successfully written to the registry. Some keys are open by the system or other processes ro you have insufficient privileges to perform this operation.

Мисля, че вирус се казва HijackExeFile

Изтегли FixExec.

• Стартирай инструмента.
• Потвърдете лиценза на програмата с ОК.

Пишете дали има промяна.

преди 3 минути, Stoyannnov написа:

Изтегли FixExec.

• Стартирай инструмента.
• Потвърдете лиценза на програмата с ОК.

Пишете дали има промяна.

За момент да, но след като реших да си инсталирам google chrome след като дадох да я отворя отново ме попита дали да отворя с какво да отвори .exe файла..

Изтеглете файла fixlist и го запазете на вашия десктоп.

• Стартирайте FRST.exe и натиснете бутона FIX веднъж!
• Почистването ще започне, не използвайте системата!
• След като приключи, ако ви поиска рестартиране, съгласете се.
• След като зареди системата публикувайте лог файла с име fixlog.txt, който се намира на десктопа Ви.

Забележка: Текущия фикс да не се използва на други системи!

Отново няма промяна.. Много упорит излезе този вирус..

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016
Ran by Ali (09-09-2016 22:32:57) Run:1
Running from C:\Users\Ali\Desktop
Loaded Profiles: Ali (Available Profiles: Ali)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
HKLM\...\exefile\shell\open\command: C:\Windows\svchost.com "%1" %* <===== ATTENTION
EmptyTemp:
end
*****************

HKLM\Software\Classes\exefile\shell\open\command\\Default => value restored successfully

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 25392116 B
Java, Flash, Steam htmlcache => 160517628 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 433750134 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 4671 B
NetworkService => 13574 B
Ali => 1118539224 B

RecycleBin => 398606438 B
EmptyTemp: => 2 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 22:33:17 ====

Стартирай отново Fixexec и виж дали ще има промяна.

преди 1 минута, Stoyannnov написа:

Стартирай отново Fixexec и виж дали ще има промяна.

 

Program started at: 09/09/2016 10:41:44 PM in x64 mode.
Windows Version: Windows 8

Checking for processes to terminate before fixing executable associations.
 * No processes found to kill.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

  * HKLM\Software\Classes\exefile\shell\open\command\\@ was changed. It was reset to "%1" %*!

Program finished at: 09/09/2016 10:41:47 PM
Execution time: 0 hours(s), 0 minute(s), and 3 seconds(s)

но няма промяна отново...

Изтеглете Windows Repair All in One.

• Разархивирайте архива.
• Стартирайте програмата.
• Кликнете на прозорец Repair.
• Натисни върху бутона Open Repairs.
• Махни всички отметки.
• От списъка маркирай САМО отметка с име: Repair File Associations.
• В дясно марикрай Restart/Shutdown System и избери отметка Restart System.
• Натисни Start Repairs.
• Програмата ще започне да фиксва, след като приключи, системата ще се рестартира.
• След като стартира системата пишете дали има промяна.

Log:
Tweaking.com - Windows Repair v3.9.10
────────────────────────────────────────────────────────────────────────────────

System Variables
────────────────────────────────────────────────────────────────────────────────
OS: Windows 8.1 Pro
OS Architecture: 64-bit
OS Version: 6.3.9600
OS Service Pack:
Computer Name: ALI-PC
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Program Files (x86): C:\Program Files (x86)
Current Profile: C:\Users\Ali
Current Profile SID: S-1-5-21-1930933297-513042792-53178134-1001
Current Profile Classes: S-1-5-21-1930933297-513042792-53178134-1001_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\Ali\AppData\Local
────────────────────────────────────────────────────────────────────────────────

System Information
────────────────────────────────────────────────────────────────────────────────
System Up Time: 0 Days 00:19:59

Process Count: 55
Commit Total: 2,39 GB
Commit Limit: 12,88 GB
Commit Peak: 2,82 GB
Handle Count: 26420
Kernel Total: 354,61 MB
Kernel Paged: 263,04 MB
Kernel Non Paged: 91,57 MB
System Cache: 5,79 GB
Thread Count: 950
────────────────────────────────────────────────────────────────────────────────

Memory Before Cleaning with CleanMem
────────────────────────────────────────────────────────────────────────────────
Memory Total: 7,88 GB
Memory Used: 2,86 GB(36,2383%)
Memory Avail.: 5,03 GB
────────────────────────────────────────────────────────────────────────────────

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
────────────────────────────────────────────────────────────────────────────────
Memory Total: 7,88 GB
Memory Used: 2,85 GB(36,2139%)
Memory Avail.: 5,03 GB
────────────────────────────────────────────────────────────────────────────────

Starting Repairs...
   Started at (9.9.2016 г. 22:53:47)

The current repair has failed to start for over 30 sec.
Trying Again....

The current repair has failed to start for over 30 sec.
Trying Again....

The current repair has failed to start for over 30 sec.
Trying Again....

   Done, but failed, at (9.9.2016 г. 22:55:48)
   Total Repair Time: 00:02:03

The current repair has failed to start 4 times.
Something is keeping the repair from running.

Try running the repairs in Windows Safe Mode. (This will keep 3rd party programs from getting in the way of the repairs)
If the repairs still fail then please post in the Tweaking.com forums for support.

Стартирай системата в Safe Mode и пробвай същите стъпки отново.

Отново не се стартира

Прикачи нови логове от FRST. Утре ще ги прегледам, че ми се доспа и вече не знам и аз к'во прая

на 9.09.2016 г. в 23:52, Stoyannnov написа:

Прикачи нови логове от FRST. Утре ще ги прегледам, че ми се доспа и вече не знам и аз к'во прая

Здравей! От доста време нямах досег до компютъра днес седнах, но доста сложен излезе този вирус, засягащ регистрите и според мен най-доброто, което можеше да се направи беше преинсталация. Темата може да бъде приключена, а вече ще си дръпна една антивирусна...