Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

AmuleC се добавя постоянно, Amistes

Bbt_sm
в Премахване на зловреден софтуер

Featured Replies

Здравейте! Имам проблем Постоянно ми се добавя една програма AmuleC,  а след нея във всички форуми ми  се добавя и Amistes като начален браузер. Започвам да деинсталирам, да трия и на следващия ден пак същото. Някой знае ли как да се преборя с този проблем завинаги?

преди 4 минути, Bbt_sm написа:

Здравейте! Имам проблем Постоянно ми се добавя една програма AmuleC,  а след нея във всички форуми ми  се добавя и Amistes като начален браузер. Започвам да деинсталирам, да трия и на следващия ден пак същото. Някой знае ли как да се преборя с този проблем завинаги?

Четете тази тема и изпълнявате инструкциите:

 

  • 4 седмици по-късно...
  • Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-02-2017
Ran by Administrator (administrator) on COMP (06-02-2017 11:24:59)
Running from C:\Documents and Settings\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: "C:\Program Files\Firefox\Firefox.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\WINDOWS\Datecs\Flex2K.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
(hxxp://www.amule.org/) C:\Program Files\amuleC1\ed2k.exe
() C:\Program Files\Gubed_WMI\Gubed_WMI.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\Setup\instup.exe
(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\Setup\instup.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\Setup\instup.exe
() C:\Program Files\Explorer\iedvutils.exe
(TODO: <Company name>) C:\Documents and Settings\Administrator\Application Data\dhadg\UvConverter.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Elex do Brasil Participações Ltda) C:\Program Files\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files\Elex-tech\YAC\iSafeSvc2.exe
(Elex do Brasil Participações Ltda) C:\Program Files\Elex-tech\YAC\iSafeTray.exe
(Mozilla Corporation) C:\Program Files\Firefox\Firefox.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
(Mozilla Corporation) C:\Program Files\Firefox\plugin-container.exe
() C:\Program Files\Smart Professional Surveillance System\SmartPSS\SmartPSS.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\Setup\instup.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [19972712 2010-12-30] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-11] (AVAST Software)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2015-04-10] (Oracle Corporation)
HKU\S-1-5-21-1229272821-179605362-1801674531-500\...\RunOnce: [FlashPlayerUpdate] => C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_23_0_0_207_Plugin.exe [1224896 2016-11-08] (Adobe Systems Incorporated)
HKLM\...\Providers\jioebdhr: C:\Program Files\NetMeeting\\local32spl.dll [145408 2016-12-16] ()
IFEO\MRT.exe: [Debugger] C:\WINDOWS\TEMP\wea151.tmp\Gubed.exe -Yrrehs
ShellExecuteHooks: No Name - {90C7A9C8-AA39-11E6-AAE8-64006A5CFC23} - C:\Documents and Settings\Administrator\Application Data\Kuziseclajotain\Arudsh.dll -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2014-05-15] (AVAST Software)
Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk [2016-12-06]
ShortcutTarget: OpenOffice.org 2.3.lnk -> C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe ()
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\FlexType 2K.lnk [2013-07-15]
ShortcutTarget: FlexType 2K.lnk -> C:\WINDOWS\Datecs\Flex2K.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{5EB301DC-0BCF-4A2D-9F46-CAA1C56C23B6}: [NameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX&q={searchTerms}
HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX&q={searchTerms}
HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX
HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX
HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX&q={searchTerms}
HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxps://www.google.bg/?gfe_rd=cr&ei=OYFzWKrnFIjY8AeEsbfYDA&gws_rd=ssl
SearchScopes: HKU\S-1-5-21-1229272821-179605362-1801674531-500 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2017-01-05] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-05-15] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2017-01-05] (Oracle Corporation)
DPF: {D639FA00-CB11-4F67-82F2-C0A87EAECDF3} hxxp://192.168.0.201:81/IVSWeb.cab
StartMenuInternet: IEXPLORE.EXE - c:\program files\internet explorer\iexplore.exe hxxp://www.amisites.com/?type=sc&ts=1486189666&z=99d16965fb4d35f067e97bbg6z3b2q2g8b4t7m5q3c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default [2017-01-23]
FF NewTab: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default -> hxxp://www.luckysearch123.com?type=hp&ts=1484926092&from=92ac0116&uid=hitachixhds721010dle630_mse523rp11bmwj11bmwjx&z=bb10a6e3862cfe98300bcdfgbzebazct0o8q7g1m3o
FF SelectedSearchEngine: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default -> Google
FF Homepage: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default -> hxxp://www.amisites.com/?type=hp&ts=1485159910&z=c29d7993d4a275f02343387gbzebfw6gdwftdt5t6z&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX
FF Extension: (xRocket Toolbar) - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default\Extensions\[email protected] [2017-01-20] [not signed]
FF SearchPlugin: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default\searchplugins\amisites.xml [2017-01-23]
FF SearchPlugin: C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default\searchplugins\luck.xml [2017-01-20]
FF ProfilePath: C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default [2017-02-06]
FF SelectedSearchEngine: C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default -> Google
FF Homepage: C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default -> hxxps://www.google.bg/?gfe_rd=cr&ei=owduWJS5E4nd8AfLuLTQAw&gws_rd=ssl
FF Extension: (SimilarWeb) - C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2016-12-12] [not signed]
FF Extension: (FF Adr) - C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2016-12-12] [not signed]
FF Extension: (English (US) Language Pack) - C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default\Extensions\[email protected] [2017-01-05] [not signed]
FF SearchPlugin: C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default\searchplugins\9w4jhvy5.xml [2016-12-06]
FF SearchPlugin: C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default\searchplugins\amisites.xml [2016-12-08]
FF SearchPlugin: C:\Documents and Settings\Administrator\Application Data\Firefox\Firefox\Profiles\endm08uq.default\searchplugins\searchinme.xml [2016-12-12]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (avast! Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-06] [not signed]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\endm08uq.default\extensions\[email protected]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-08] ()
FF Plugin: @DVR/npmedia,version=3.1.0.4 -> C:\Program Files\webrec\WEB30\DVR32\3.1.0.4\npmedia.dll [2014-04-18] ()
FF Plugin: @DVR/npTimeGrid,version=3.1.0.4 -> C:\Program Files\webrec\WEB30\DVR32\3.1.0.4\npTimeGrid.dll [2014-04-18] (Unauthorized copy)
FF Plugin: @java.com/DTPlugin,version=10.79.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2017-01-05] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.79.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2017-01-05] (Oracle Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
StartMenuInternet: FIREFOX.EXE - c:\program files\firefox\firefox.exe hxxp://www.amisites.com/?type=sc&ts=1486189666&z=99d16965fb4d35f067e97bbg6z3b2q2g8b4t7m5q3c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX

Chrome:
=======
CHR HomePage: Default -> hxxp://www.amisites.com/?type=hp&ts=1485159910&z=c29d7993d4a275f02343387gbzebfw6gdwftdt5t6z&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX
CHR StartupUrls: Default -> "hxxp://www.amisites.com/?type=hp&ts=1485159910&z=c29d7993d4a275f02343387gbzebfw6gdwftdt5t6z&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX"
CHR DefaultSearchURL: Default -> hxxp://www.amisites.com/search/?type=ds&ts=1485159910&z=c29d7993d4a275f02343387gbzebfw6gdwftdt5t6z&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX&q={searchTerms}
CHR DefaultSearchKeyword: Default -> amisites
CHR Profile: C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default [2017-01-23]
CHR Extension: (uTorrentControl_v2) - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda [2016-12-16] [UpdateUrl: hxxp://autoupdate.chromewebtb.conduit-services.com/sb/?productId=CT3220468&extensionData=\u003Cextension_data>] <==== ATTENTION
CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-12-16]
CHR HKLM\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Documents and Settings\Administrator\Local Settings\Application Data\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-11-19]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-15]
CHR HKU\S-1-5-21-1229272821-179605362-1801674531-500\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Documents and Settings\Administrator\Local Settings\Application Data\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-11-19]
StartMenuInternet: Google Chrome - c:\program files\google\chrome\application\chrome.exe hxxp://www.amisites.com/?type=sc&ts=1486189666&z=99d16965fb4d35f067e97bbg6z3b2q2g8b4t7m5q3c&from=archer1028&uid=HitachiXHDS721010DLE630_MSE523RP11BMWJ11BMWJX

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Archer; C:\Program Files\WinArcher\Archer.dll [438272 2017-02-04] () [File not signed]
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-15] (AVAST Software)
R2 Convxxxx; C:\Documents and Settings\Administrator\Application Data\dhadg\UvConverter.exe [377856 2017-01-20] (TODO: <Company name>) [File not signed]
R2 ed2kidle; C:\Program Files\amuleC1\ed2k.exe [237568 2016-12-19] (hxxp://www.amule.org/) [File not signed]
R2 GubedZL; C:\Program Files\Gubed\GubedZL.dll [118272 2017-02-04] () [File not signed]
R2 Gubed_WMI; C:\Program Files\Gubed_WMI\Gubed_WMI.exe [110080 2016-12-26] () [File not signed] <==== ATTENTION
R2 iedvutils; C:\Program Files\Explorer\iedvutils.exe [64184 2017-01-20] ()
R2 iSafeService; C:\Program Files\Elex-tech\YAC\iSafeSvc.exe [131024 2016-08-19] (Elex do Brasil Participações Ltda)
R3 iThemes5; C:\Program Files\Common Files\Services\iThemes.dll [583680 2017-01-19] () [File not signed] <==== ATTENTION
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2017-01-05] (Oracle Corporation)
R2 Kosers; C:\Program Files\Chiviied\dlnPrv.dll [280576 2016-12-06] () [File not signed]
R2 MozillaMaintenanceServicexerox; C:\Program Files\xerox\MozillaMaintenanceServicexerox.dll [223744 2016-12-06] () [File not signed]
R2 WinSAPSvc; C:\Documents and Settings\All Users\Application Data\WinSAPSvc\WinSAP.dll [183808 2017-02-03] () [File not signed]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AGV; C:\WINDOWS\System32\drivers\AGV.sys [189112 2013-06-20] (GeoVision Inc.)
S3 AR9271; C:\WINDOWS\System32\DRIVERS\athuw.sys [1714176 2010-01-05] (Atheros Communications, Inc.) [File not signed]
R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [24184 2014-05-15] ()
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [67824 2014-05-15] (AVAST Software)
R1 AswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [54832 2014-05-15] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49944 2014-05-15] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software)
R1 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57672 2014-05-15] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [180632 2014-05-15] ()
S3 GV800S; C:\WINDOWS\System32\drivers\GV800S.sys [82224 2013-06-20] (GeoVision Inc.)
R1 iSafeKrnl; C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys [227776 2016-05-23] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\WINDOWS\System32\DRIVERS\iSafeKrnlBoot.sys [50280 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys [97912 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys [45032 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys [73232 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\WINDOWS\System32\DRIVERS\iSafeNetFilter.sys [67288 2016-05-19] (Elex do Brasil Participações Ltda)
R0 PxHelp20; C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [20016 2003-10-28] (Sonic Solutions) [File not signed]
R3 yukonwxp; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [298784 2010-09-23] (Marvell)
R1 ZAM; C:\WINDOWS\System32\drivers\zam32.sys [181496 2016-12-16] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard32.sys [181496 2016-12-16] (Zemana Ltd.)
S3 igfx; system32\DRIVERS\igdkmd32.sys [X]
S4 IntelIde; no ImagePath
S3 NVHDA; system32\drivers\nvhda32.sys [X]
U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-06 11:24 - 2017-02-06 11:27 - 00019314 _____ C:\Documents and Settings\Administrator\Desktop\FRST.txt
2017-02-06 11:24 - 2017-02-06 11:24 - 00000000 ____D C:\FRST
2017-02-06 11:23 - 2017-02-06 11:23 - 01763328 _____ (Farbar) C:\Documents and Settings\Administrator\Desktop\FRST.exe
2017-01-25 07:18 - 2017-01-25 07:18 - 00000000 ____D C:\Program Files\amuleC3
2017-01-22 09:04 - 2017-01-22 09:04 - 00000000 ____D C:\Program Files\9w4jhvy5
2017-01-20 17:28 - 2017-01-20 17:28 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
2017-01-20 17:28 - 2017-01-20 17:28 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Mozilla
2017-01-20 17:28 - 2017-01-20 17:28 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\dhadg
2017-01-20 17:23 - 2017-01-20 17:23 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Elex-tech
2017-01-20 17:20 - 2017-01-23 10:26 - 00001900 _____ C:\Documents and Settings\All Users\Desktop\Internet Explorer.lnk
2017-01-20 17:20 - 2017-01-20 17:20 - 00000000 ____D C:\Program Files\Elex-tech
2017-01-20 17:20 - 2017-01-20 17:20 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Elex-tech
2017-01-20 17:20 - 2016-05-23 04:41 - 00050280 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeKrnlBoot.sys
2017-01-20 17:20 - 2016-05-19 08:42 - 00067288 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeNetFilter.sys
2017-01-20 17:19 - 2017-01-20 17:19 - 00000000 ____D C:\Program Files\Explorer
2017-01-20 13:23 - 2017-02-06 10:40 - 00000446 _____ C:\WINDOWS\Tasks\Milimili.job
2017-01-20 13:23 - 2017-01-20 13:23 - 00000000 ____D C:\Program Files\MIO
2017-01-20 13:23 - 2017-01-20 13:23 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Tencent
2017-01-12 15:35 - 2017-02-06 10:35 - 00000342 _____ C:\WINDOWS\Tasks\WinTOOL.job
2017-01-12 15:35 - 2017-01-18 14:55 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\wintools
2017-01-12 15:34 - 2017-01-25 07:18 - 00000000 ____D C:\Documents and Settings\Administrator\Start Menu\Programs\amuleC
2017-01-12 15:34 - 2017-01-25 07:18 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\aMule
2017-01-12 15:34 - 2017-01-12 15:34 - 00000000 ____D C:\Program Files\amuleC2

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-06 11:27 - 2013-01-24 13:14 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Temp
2017-02-06 11:24 - 2016-12-16 14:13 - 00549890 _____ C:\WINDOWS\ZAM.krnl.trace
2017-02-06 11:24 - 2016-12-16 14:13 - 00523549 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2017-02-06 11:02 - 2013-07-12 14:48 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2017-02-06 09:04 - 2016-12-06 11:03 - 00000412 _____ C:\WINDOWS\Tasks\Mlerckanogpy Builder.job
2017-02-05 13:35 - 2014-05-26 09:32 - 00032494 _____ C:\WINDOWS\SchedLgU.Txt
2017-02-05 11:04 - 2016-12-06 11:04 - 00000414 _____ C:\WINDOWS\Tasks\daeac89e71384db9308822996ae3a510.job
2017-02-03 13:18 - 2016-12-07 07:45 - 00000000 ____D C:\Program Files\byuoy334
2017-02-03 13:18 - 2016-12-06 11:02 - 00000000 ____D C:\Program Files\Chiviied
2017-02-03 10:56 - 2016-12-07 07:49 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\WinSAPSvc
2017-01-20 17:28 - 2013-01-24 13:14 - 00000000 __SHD C:\Documents and Settings\LocalService
2017-01-20 17:20 - 2013-01-24 13:16 - 00002016 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
2017-01-20 14:33 - 2013-01-24 16:29 - 00000364 ____H C:\WINDOWS\Tasks\avast! Emergency Update.job
2017-01-20 13:17 - 2016-12-06 11:26 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2017-01-20 13:17 - 2014-05-26 09:32 - 00000238 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2017-01-20 13:17 - 2013-01-24 16:33 - 00000000 __SHD C:\WINDOWS\CSC
2017-01-20 13:17 - 2013-01-24 13:14 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-01-20 13:17 - 2013-01-24 12:47 - 00000000 ____D C:\Program Files\Common Files\Services
2017-01-20 13:17 - 2008-04-14 11:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2017-01-18 14:55 - 2016-12-07 07:50 - 00000000 ____D C:\Program Files\WinArcher
2017-01-18 10:49 - 2013-01-24 12:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-01-12 15:36 - 2016-12-16 14:29 - 00002121 _____ C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
2017-01-12 15:36 - 2016-12-12 13:56 - 00001894 _____ C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
2017-01-11 15:48 - 2013-01-24 13:51 - 00001912 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
2017-01-09 14:27 - 2016-12-30 09:51 - 00000000 ____D C:\Program Files\amuleC1
2017-01-09 14:03 - 2015-07-22 13:27 - 00000114 _____ C:\Documents and Settings\Administrator\Desktop\Login GPS.URL
2017-01-09 10:26 - 2014-05-26 09:32 - 00000232 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

==================== Files in the root of some directories =======

2013-01-24 16:12 - 2013-01-24 16:12 - 0000136 _____ () C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat

Some files in TEMP:
====================
2017-01-12 15:34 - 2017-01-12 15:35 - 26883792 _____ () C:\Documents and Settings\Administrator\Local Settings\Temp\ins16F.tmp.exe
2017-01-17 12:56 - 2017-01-18 14:55 - 26967248 _____ () C:\Documents and Settings\Administrator\Local Settings\Temp\inst12.exe
2015-04-13 18:25 - 2015-04-13 18:25 - 0938408 _____ (Oracle Corporation) C:\Documents and Settings\Administrator\Local Settings\Temp\jre-7u79-windows-i586-iftw_59f7da76.exe
2017-01-05 15:45 - 2017-01-05 15:45 - 0361472 _____ (update) C:\Documents and Settings\Administrator\Local Settings\Temp\~ct4A.tmp.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Addition.txt

Това лие което ви трябва?

Здравейте..! 

Изтеглете програмата GeekUninstaller и я запазете на десктопа.
Разархивирайте я и стартирайте файла geek.exe IxXO5oO.jpg  От списъка намерете и деинсталирайте всички програми които съм ви написал в карето:

 

Цитат

amuleC (HKLM\...\{19539992-061C-4E8B-9053-07B175303AF4}) (Version: 1.0.1 - amuleC) <==== ATTENTION
amuleC (HKLM\...\{418DDAC3-E16C-47C2-B5FE-4FBCAB0E10D0}) (Version: 1.0.1 - amuleC) <==== ATTENTION
amuleC (HKLM\...\{B2EFFD4E-D098-4845-9D56-DE75BEB35913}) (Version: 1.0.1 - amuleC) <==== ATTENTION

YAC(Yet Another Cleaner!) 

Кликнете с десен бутон върху програмата и изберете Uninstall
 
XhV2QLa.png
 
 
След края на всяка деинсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи).Натиснете бутона Finish за да изтриете останките от програмата.

 

GfiJrQ9.png Malwarebytes Anti-Malware (MBAM)

Моля, изтеглете Malwarebytes Anti-Malware 2.2.0.1024 Final и я запазете на вашия десктоп.

  • Стартирайте файла mbam-setup-bc.хххх-х.х.х.хххх.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи се уверете че сте сложили отметка пред:
  • Launch Malwarebytes Anti-Malware
  • Отметката активираща пробния 14 дневен период също е маркиран по-подразбиране. Ако не желаете да тествате защитата в реално време на програмата през следващите 14 дни тогава премахнете отметката. Т.е. премахнете първата отметка:

DkgJ7Zr.png

  • Натиснете бутона Finish.
  • Отидете до табът Settings > Detection and Protection > и под категориятаDetection Options включете опцията "Scan for rootkits".
  • Отидете до табът Scan, сложете радио-бутона пред Threat Scan и след това натиснете бутона Scan Now >> . Ако е намерена актуализация тогава натиснете бутона Update Now.
  • Ще започне проверка за зловреден софтуер.
  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи натиснете бутона Apply Actions.
  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.
  • След рестарта, когато се появи десктопа MBAM ще се зареди още веднъж.
  • Отидете то табът History > Application Logs.

65ZBqkR.jpg

  • Отворете рапорта с последната дата и час и натиснете бутона "Copy to Clipboard"
  • Сега вече поставете съдържанието на лог файла с клавишната комбинацияCtrl + V и го публикувайте в следващия си коментар.

 

BY4dvz9.png Сканиране с AdwCleaner

 
Моля, изтеглете и стартирайте програмата Malwarebytes AdwCleaner (by Xplode):

  • Затворете всички стартирани програми и браузъри
  • Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
  • Натиснете OK, за да потвърдите, че всички стартирани програми ще бъдат затворени.
  • Маркирайте A49sxPr.pngScan (провери).
  • След завършване, кликнете на 6cyn5v5.pngLogfile (дневник).Ще се отвори прозорец в който се намира дневника (AdwCleaner [S0] .txt).Кликнете два пъти върх реда и ще се отвори съдържанието на дневника.Публикувайте го в следващия си пост
  • Върнете се към основния прозорец на AdwCleaner .маркирайте MqHawIb.pngClean (Почисти)
  • Следвайте указанията и разрешете на компютъра да се рестартира.
  • След рестарта ще се отвори дневник AdwCleaner[C0].txt . Моля копирайте съдържанието на лог файла в следващия си пост.

 

 

E3feWj5.png  Сканиране с Junkware Removal Tool
 
Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

122.jpg?1414578932  Моля, изтеглете  Check Browsers' LNK by Dragokas & regist

  • Запомнете архива на вашия декстоп,разархивирате.
  • Временно спрете вашия  антивирусен софтуер.
  • Стартирайте файла Check Browsers LNK.exe от името на администратор.
  • Изчакайте програмата да завърши работата си.Това може да отнеме до 5 минути. Моля бъдете търпеливи. След сканирането, отворете генерираната папка LOG и публикувайте отчета Check_Browsers_LNK.log, в следвашия си пост.

 

 Дневници
 
В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

  • Дневник от Malwarebytes Anti -Malware
  • AdwCleaner.txt
  • JRT.txt
  • Check_Browsers_LNK.log

 

  • Автор

Malwarebytes Anti-Malware
www.malwarebytes.org

Дата на сканиране: 06.2.2017 г.
Час на сканиране: 13:04:39
Дневник: 
Администратор: Да

Версия: 2.2.0.1024
База от данни за злонамерен софтуер: v2017.02.06.01
База от данни за рууткити: v2016.11.20.01
Лиценз: Безплатен
Защита от злонамерен софтуер: Забранено
Защита от злонамерени страници: Забранено
Самозащита: Забранено

ОС: Windows XP Service Pack 3
Процесор: x86
Файлова система: NTFS
Потребител: Administrator

Тип сканиране: Сканиране за заплахи
Резултат: Завършено
Сканиране обекти: 257473
Изминало време: 1 ч., 9 мин., 4 сек.

Памет: Разрешено
Начално стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
Рууткити: Разрешено
Евристика: Разрешено
ПНП: Разрешено
ПНИ: Разрешено

Процеси: 0
(Не бяха открити злонамерени обекти)

Модули: 0
(Не бяха открити злонамерени обекти)

Ключове в системния регистър: 0
(Не бяха открити злонамерени обекти)

Стойности в системния регистър: 0
(Не бяха открити злонамерени обекти)

Данни в системния регистър: 0
(Не бяха открити злонамерени обекти)

Папки: 0
(Не бяха открити злонамерени обекти)

Файлове: 0
(Не бяха открити злонамерени обекти)

Физически сектори: 0
(Не бяха открити злонамерени обекти)


(end)

  • Автор

Malwarebytes Anti-Malware
www.malwarebytes.org


Error, 06.2.2017 г. 12:59:44, SYSTEM, COMP, Update, Bad md5 or size: domains, 11, 
Error, 06.2.2017 г. 12:59:44, SYSTEM, COMP, Update, Bad md5 or size: ips, 11, 
Error, 06.2.2017 г. 12:59:44, SYSTEM, COMP, Update, Bad md5 or size: akadomains, 11, 
Error, 06.2.2017 г. 12:59:44, SYSTEM, COMP, Update, Bad md5 or size: akaips, 11, 
Update, 06.2.2017 г. 12:59:44, SYSTEM, COMP, Manual, AKA Domain Database, 0.0.0.0, 2015.9.11.2, 
Update, 06.2.2017 г. 12:59:45, SYSTEM, COMP, Manual, AKA IP Database, 0.0.0.0, 2015.9.11.2, 
Update, 06.2.2017 г. 12:59:45, SYSTEM, COMP, Manual, Remediation Database, 2015.9.16.1, 2017.1.23.1, 
Update, 06.2.2017 г. 12:59:45, SYSTEM, COMP, Manual, Rootkit Database, 2015.9.18.1, 2016.11.20.1, 
Update, 06.2.2017 г. 12:59:45, SYSTEM, COMP, Manual, IP Database, 0.0.0.0, 2017.2.5.4, 
Update, 06.2.2017 г. 12:59:45, SYSTEM, COMP, Manual, Domain Database, 0.0.0.0, 2017.2.6.1, 
Update, 06.2.2017 г. 12:59:47, SYSTEM, COMP, Manual, Malware Database, 2015.9.22.5, 2017.2.6.1, 
Error, 06.2.2017 г. 14:22:26, SYSTEM, COMP, Protection, IsLicensed, 13, 
Protection, 06.2.2017 г. 14:22:26, SYSTEM, COMP, Protection, Malware Protection, Stopping, 
Protection, 06.2.2017 г. 14:22:26, SYSTEM, COMP, Protection, Malware Protection, Stopped, 

(end)

# AdwCleaner v6.043 - Logfile created 06/02/2017 at 14:33:22
# Updated on 27/01/2017 by Malwarebytes
# Database : 2017-02-03.2 [Server]
# Operating System : Microsoft Windows XP Service Pack 3 (X86)
# Username : Administrator - COMP
# Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner_6.043(1).exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

Service Found:  iSafeKrnl
Service Found:  iSafeKrnlBoot
Service Found:  iSafeKrnlKit
Service Found:  iSafeKrnlMon
Service Found:  iSafeKrnlR3
Service Found:  iSafeNetFilter
Service Found:  iSafeService
Service Found:  WinSAPSvc
Service Found:  Archer
Service Found:  ed2kidle
Service Found:  iThemes5
Service Found:  Gubed_WMI
Service Found:  GubedZL


***** [ Folders ] *****

Folder Found:  C:\Documents and Settings\All Users\Start Menu\Programs\MediaPlayer
Folder Found:  C:\Program Files\MediaPlayer
Folder Found:  C:\WINDOWS\MediaPlayer
Folder Found:  C:\Documents and Settings\All Users\Application Data\ChelfNotify
Folder Found:  C:\Documents and Settings\All Users\Application Data\WinSAPSvc
Folder Found:  C:\Documents and Settings\All Users\Application Data\winsapsvc
Folder Found:  C:\Documents and Settings\All Users\Application Data\chelfnotify
Folder Found:  C:\Program Files\Conduit
Folder Found:  C:\Program Files\Elex-tech
Folder Found:  C:\Program Files\WinArcher
Folder Found:  C:\Program Files\UvConverter
Folder Found:  C:\Program Files\winarcher
Folder Found:  C:\Program Files\amuleC1
Folder Found:  C:\Program Files\Gubed_WMI
Folder Found:  C:\Program Files\Gubed
Folder Found:  C:\Program Files\Firefox
Folder Found:  C:\Documents and Settings\All Users\Application Data\WinTools
Folder Found:  C:\Program Files\MIO


***** [ Files ] *****

File Found:  C:\WINDOWS\system32\drivers\iSafeKrnlBoot.sys
File Found:  C:\WINDOWS\system32\drivers\iSafeNetFilter.sys
File Found:  C:\Program Files\Common Files\SERVICES\ITHEMES.DLL
File Found:  C:\Documents and Settings\All Users\Documents\report.dat


***** [ DLL ] *****

No malicious DLLs found.


***** [ WMI ] *****

No malicious keys found.


***** [ Shortcuts ] *****

Shortcut infected:  C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk ( hxxp://www.amisites.com/?type=sc&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE
Shortcut infected:  C:\Documents and Settings\All Users\Desktop\Internet Explorer.lnk ( hxxp://www.amisites.com/?type=sc&ts=1485159910&z=c29d7993d4a275f02343387gbzebfw6gdwftdt5t6z&from=archer1028&uid=HitachiXHDS721010DLE
Shortcut infected:  C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk ( hxxp://www.amisites.com/?type=sc&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_M
Shortcut infected:  C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome.lnk ( hxxp://www.amisites.com/?type=sc&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS7
Shortcut infected:  C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk ( hxxp://www.amisites.com/?type=sc&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHD


***** [ Scheduled Tasks ] *****

Task Found:  WinTOOL
Task Found:  Milimili


***** [ Registry ] *****

Key Found:  HKLM\SOFTWARE\Classes\MediaPlayer.MediaPlayer
Key Found:  HKLM\SOFTWARE\Classes\MediaPlayer.MediaPlayer.1
Key Found:  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found:  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found:  HKU\.DEFAULT\Software\ecb`nl
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Conduit
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Softonic
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\AppDataLow\Software\Conduit
Key Found:  HKU\S-1-5-18\Software\ecb`nl
Key Found:  HKCU\Software\Conduit
Key Found:  HKCU\Software\Softonic
Key Found:  HKCU\Software\AppDataLow\Software\Conduit
Key Found:  HKLM\SOFTWARE\Conduit
Key Found:  HKLM\SOFTWARE\Elex-tech
Key Found:  HKLM\SOFTWARE\youndooSoftware
Key Found:  HKLM\SOFTWARE\ScreenShot
Key Found:  HKLM\SOFTWARE\ecb`nl
Key Found:  HKLM\SOFTWARE\WinArcher
Key Found:  HKLM\SOFTWARE\amule-custom
Key Found:  HKLM\SOFTWARE\amisitesSoftware
Key Found:  HKLM\SOFTWARE\UvConv
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{418DDAC3-E16C-47C2-B5FE-4FBCAB0E10D0}
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\iSafe
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{418DDAC3-E16C-47C2-B5FE-4FBCAB0E10D0}
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F39E5917C417B4041A46F88010121C6E
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B68CE107A2DED706DC47D6BC4BF3C4C1
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C767D9D7BB3F9C4B839FF09B6C80DCF
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EE2F0310EBEC29A0C48C035C43786AA
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B2A47D6F1D42DD81A292C027724D291
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02C076B2283AB74D88D5E4D34BC497FF
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F39E5917C417B4041A46F88010121C6E
Key Found:  HKLM\SOFTWARE\Classes\Installer\Features\F39E5917C417B4041A46F88010121C6E
Key Found:  HKLM\SOFTWARE\Classes\Installer\Products\F39E5917C417B4041A46F88010121C6E
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cb
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&fr
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bco
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS721010D
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE52
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS721010D
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE52
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS7
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS7
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Found:  HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Value Found:  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [WinSAPSvc]
Value Found:  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [ArcherGroupEx]
Value Found:  HKLM\SYSTEM\CurrentControlSet\Services\Themes [DependOnService]
Value Found:  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [GubedZLGroupEx]
Value Found:  HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
Value Found:  HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
Value Found:  HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
Key Found:  HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Key Found:  HKLM\SOFTWARE\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda


***** [ Web browsers ] *****

No malicious Firefox based browser items found.
No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [10284 Bytes] - [06/02/2017 14:33:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10358 Bytes] ##########
 

Цитат
  • Върнете се към основния прозорец на AdwCleaner .маркирайте MqHawIb.pngClean (Почисти)
  • Следвайте указанията и разрешете на компютъра да се рестартира.
  • След рестарта ще се отвори дневник AdwCleaner[C0].txt . Моля копирайте съдържанието на лог файла в следващия си пост.

Това с програмата  AdwCleaner ..! 

  • Автор

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Microsoft Windows XP x86 
Ran by Administrator (Administrator) on 06.02.2017 Ј. at 15:37:08,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


File System: 5 

Failed to delete: C:\Program Files\elex-tech (Folder) 
Successfully deleted: C:\Documents and Settings\Administrator\Application Data\elex-tech (Folder) 
Successfully deleted: C:\WINDOWS\System32\drivers\isafenetfilter.sys (File) 
Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\DHCU4VD4 (Temporary Internet Files Folder) 
Successfully deleted: C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\DHCU4VD4 (Temporary Internet Files Folder) 

Registry: 7 

Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\iSafeKrnl (Registry Key) 
Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\iSafeKrnlBoot (Registry Key) 
Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\iSafeKrnlKit (Registry Key) 
Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\iSafeKrnlR3 (Registry Key) 
Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\iSafeNetFilter (Registry Key) 
Failed to delete: HKLM\SYSTEM\CurrentControlSet\services\iSafeService (Registry Key) 
Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\iSafeKrnlMon (Registry Key) 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.02.2017 Ј. at 15:40:43,59
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

преди 5 часа, icotonev написа:
  • Върнете се към основния прозорец на AdwCleaner .маркирайте MqHawIb.pngClean (Почисти)
  • Следвайте указанията и разрешете на компютъра да се рестартира.
  • След рестарта ще се отвори дневник AdwCleaner[C0].txt . Моля копирайте съдържанието на лог файла в следващия си пост.

Здравейте..! Тук не виждам дневник с премахнатите обекти..!!! Моля спазвайте реда по който съм ви дал инструкциите...! Това е важно за мен..! :)

  • Автор
на 6.02.2017 г. в 14:56, icotonev написа:

Това с програмата  AdwCleaner ..! 

AdwCleaner[C0].txt   - да, не ми се отвоори  AdwCleaner[C0].txt   и неуспях да следвам май инструкциите

Ясно...!Сканирането е на два етапа..!

Етап 1: AdwCleaner - Само сканиране

Това вие сте го направили..и сте публикували  дневника (AdwCleaner [S0] .txt

Цитат

# AdwCleaner v6.043 - Logfile created 06/02/2017 at 14:33:22
# Updated on 27/01/2017 by Malwarebytes
# Database : 2017-02-03.2 [Server]
# Operating System : Microsoft Windows XP Service Pack 3 (X86)
# Username : Administrator - COMP
# Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner_6.043(1).exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

Service Found:  iSafeKrnl
Service Found:  iSafeKrnlBoot
Service Found:  iSafeKrnlKit
Service Found:  iSafeKrnlMon
Service Found:  iSafeKrnlR3
Service Found:  iSafeNetFilter
Service Found:  iSafeService
Service Found:  WinSAPSvc
Service Found:  Archer
Service Found:  ed2kidle
Service Found:  iThemes5
Service Found:  Gubed_WMI
Service Found:  GubedZL


***** [ Folders ] *****

Folder Found:  C:\Documents and Settings\All Users\Start Menu\Programs\MediaPlayer
Folder Found:  C:\Program Files\MediaPlayer
Folder Found:  C:\WINDOWS\MediaPlayer
Folder Found:  C:\Documents and Settings\All Users\Application Data\ChelfNotify
Folder Found:  C:\Documents and Settings\All Users\Application Data\WinSAPSvc
Folder Found:  C:\Documents and Settings\All Users\Application Data\winsapsvc
Folder Found:  C:\Documents and Settings\All Users\Application Data\chelfnotify
Folder Found:  C:\Program Files\Conduit
Folder Found:  C:\Program Files\Elex-tech
Folder Found:  C:\Program Files\WinArcher
Folder Found:  C:\Program Files\UvConverter
Folder Found:  C:\Program Files\winarcher
Folder Found:  C:\Program Files\amuleC1
Folder Found:  C:\Program Files\Gubed_WMI
Folder Found:  C:\Program Files\Gubed
Folder Found:  C:\Program Files\Firefox
Folder Found:  C:\Documents and Settings\All Users\Application Data\WinTools
Folder Found:  C:\Program Files\MIO


***** [ Files ] *****

File Found:  C:\WINDOWS\system32\drivers\iSafeKrnlBoot.sys
File Found:  C:\WINDOWS\system32\drivers\iSafeNetFilter.sys
File Found:  C:\Program Files\Common Files\SERVICES\ITHEMES.DLL
File Found:  C:\Documents and Settings\All Users\Documents\report.dat


***** [ DLL ] *****

No malicious DLLs found.


***** [ WMI ] *****

No malicious keys found.


***** [ Shortcuts ] *****

Shortcut infected:  C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk ( hxxp://www.amisites.com/?type=sc&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE
Shortcut infected:  C:\Documents and Settings\All Users\Desktop\Internet Explorer.lnk ( hxxp://www.amisites.com/?type=sc&ts=1485159910&z=c29d7993d4a275f02343387gbzebfw6gdwftdt5t6z&from=archer1028&uid=HitachiXHDS721010DLE
Shortcut infected:  C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk ( hxxp://www.amisites.com/?type=sc&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_M
Shortcut infected:  C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome.lnk ( hxxp://www.amisites.com/?type=sc&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS7
Shortcut infected:  C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk ( hxxp://www.amisites.com/?type=sc&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHD


***** [ Scheduled Tasks ] *****

Task Found:  WinTOOL
Task Found:  Milimili


***** [ Registry ] *****

Key Found:  HKLM\SOFTWARE\Classes\MediaPlayer.MediaPlayer
Key Found:  HKLM\SOFTWARE\Classes\MediaPlayer.MediaPlayer.1
Key Found:  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found:  HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Found:  HKU\.DEFAULT\Software\ecb`nl
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Conduit
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Softonic
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\AppDataLow\Software\Conduit
Key Found:  HKU\S-1-5-18\Software\ecb`nl
Key Found:  HKCU\Software\Conduit
Key Found:  HKCU\Software\Softonic
Key Found:  HKCU\Software\AppDataLow\Software\Conduit
Key Found:  HKLM\SOFTWARE\Conduit
Key Found:  HKLM\SOFTWARE\Elex-tech
Key Found:  HKLM\SOFTWARE\youndooSoftware
Key Found:  HKLM\SOFTWARE\ScreenShot
Key Found:  HKLM\SOFTWARE\ecb`nl
Key Found:  HKLM\SOFTWARE\WinArcher
Key Found:  HKLM\SOFTWARE\amule-custom
Key Found:  HKLM\SOFTWARE\amisitesSoftware
Key Found:  HKLM\SOFTWARE\UvConv
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{418DDAC3-E16C-47C2-B5FE-4FBCAB0E10D0}
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\iSafe
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{418DDAC3-E16C-47C2-B5FE-4FBCAB0E10D0}
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F39E5917C417B4041A46F88010121C6E
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B68CE107A2DED706DC47D6BC4BF3C4C1
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C767D9D7BB3F9C4B839FF09B6C80DCF
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EE2F0310EBEC29A0C48C035C43786AA
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B2A47D6F1D42DD81A292C027724D291
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02C076B2283AB74D88D5E4D34BC497FF
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F39E5917C417B4041A46F88010121C6E
Key Found:  HKLM\SOFTWARE\Classes\Installer\Features\F39E5917C417B4041A46F88010121C6E
Key Found:  HKLM\SOFTWARE\Classes\Installer\Products\F39E5917C417B4041A46F88010121C6E
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cb
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&fr
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7
Data Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bco
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS721010D
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE52
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630
Data Found:  HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.amisites.com/search/?type=ds&ts=1482133747&z=da06621fc2e21773199bf0dgdz3bcocg5c6cbm6t4c&from=archer1028&uid=HitachiXHDS
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS721010D
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.amisites.com/?type=hp&ts=1484228103&z=9582e2cf038890e6d9ecc70g4z5b5zfo5o8b3g7m3g&from=che0812&uid=HitachiXHDS721010DLE630_MSE52
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS7
Data Found:  HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch] - hxxp://www.amisites.com/search/?type=ds&ts=1481183432&z=69ace56fa29aae2e4cf1b57g7z3b8gfgfb2c0z6q3c&from=archer1028&uid=HitachiXHDS7
Key Found:  HKU\S-1-5-21-1229272821-179605362-1801674531-500\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Found:  HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Value Found:  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [WinSAPSvc]
Value Found:  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [ArcherGroupEx]
Value Found:  HKLM\SYSTEM\CurrentControlSet\Services\Themes [DependOnService]
Value Found:  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost [GubedZLGroupEx]
Value Found:  HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
Value Found:  HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
Value Found:  HKLM\SOFTWARE\Mozilla\Firefox\Extensions [[email protected]]
Key Found:  HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Key Found:  HKLM\SOFTWARE\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda


***** [ Web browsers ] *****

No malicious Firefox based browser items found.
No malicious Chromium based browser items found.

*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [10284 Bytes] - [06/02/2017 14:33:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10358 Bytes] ##########
 

 
 
  •  

 

Етап 2: AdwCleaner - Сканиране и Почистване

 

1.Стартирате отново програмата.

2. Щракнете отново върху бутона A49sxPr.pngScan (провери).

3.Когато сканирането приключи, ще видите съобщение в прозореца на AdwCleaner: "В очакване на действие Моля, махнете елементи, които искате да запазите.." ( "Waiting for action. Please uncheck elements you want to keep."

Тук конкретно за вашия случай махнете отметките на следните редове:

Цитат

***** [ Folders ] *****

Folder Found:  C:\Documents and Settings\All Users\Start Menu\Programs\MediaPlayer
Folder Found:  C:\Program Files\MediaPlayer
Folder Found:  C:\WINDOWS\MediaPlayer

***** [ Registry ] *****

Key Found:  HKLM\SOFTWARE\Classes\MediaPlayer.MediaPlayer
Key Found:  HKLM\SOFTWARE\Classes\MediaPlayer.MediaPlayer.1

 

4. Щракнете върху MqHawIb.pngClean (Почисти)

5.След като завърши AdwCleaner ще ви подкани да рестартирате. Моля,  разрешете на компютъра да се рестартира

6. След рестарта ще се отвори дневник AdwCleaner[C0 или C1].txt . Моля копирайте съдържанието на дневника файла в следващия си пост.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.