Здравейте HJT Team !

От известно време ползвам тоя комп с Win Xp Pro и усещам ,че нещо не е наред излизат грешки . При опит за инсталиране на браузера Вивалди ,излиза gr1. При пускане на Junkware Removal Tool  се появява прозореца и се затваря .Дали тези грешки се дължат на зловреден код или системата е омазана,да Ви помоля за вашето мнение и,ако може да помогнете.

Благодаря !

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-01-2017
Ran by doni (administrator) on AMD (11-01-2017 17:02:29)
Running from C:\Documents and Settings\doni\My Documents\Изтегляния
Loaded Profiles: doni (Available Profiles: doni)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: "C:\Program Files\Pale Moon\palemoon.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Murray Hurps Software Pty Ltd) C:\Program Files\Ad Muncher\AdMunch.exe
(Bitsum LLC) C:\Program Files\Process Lasso\ProcessLasso.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
(H.D.S. Hungary) C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
(FinalWire Ltd.) D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\aida64.exe
(Repkasoft) C:\Program Files\YoWindow\yowindow.exe
() C:\Program Files\Jotta\vss\jVSS.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(HP) C:\WINDOWS\system32\HPZipm12.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe
(Zemana Ltd.) C:\Program Files\Zemana AntiMalware\ZAM.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe
(Bitsum LLC) C:\Program Files\Process Lasso\ProcessGovernor.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Moonchild Productions) C:\Program Files\Pale Moon\palemoon.exe
(Moonchild Productions) C:\Program Files\Pale Moon\plugin-container.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Ad Muncher] => C:\Program Files\Ad Muncher\AdMunch.exe [560760 2015-06-17] (Murray Hurps Software Pty Ltd)
HKLM\...\Run: [ProcessLassoManagementConsole] => C:\Program Files\Process Lasso\processlasso.exe [779776 2016-12-10] (Bitsum LLC)
HKLM\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe [2650576 2016-12-14] (Malwarebytes Corporation)
HKLM\...\Run: [Hard Disk Sentinel] => C:\Program Files\Hard Disk Sentinel\HDSentinel.exe [4731552 2016-01-31] (H.D.S. Hungary)
HKLM\...\Run: [ZAM] => C:\Program Files\Zemana AntiMalware\ZAM.exe [14080240 2017-01-07] (Zemana Ltd.)
HKLM Group Policy restriction on software: *.mp4*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *:\RECYCLER <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\8z*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.jse <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.bat <====== ATTENTION
HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: bcdedit.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION
HKLM Group Policy restriction on software: ** <====== ATTENTION
HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.jse <====== ATTENTION
HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION
HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.bat <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.js <====== ATTENTION
HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\8z*\ <====== ATTENTION
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2009-07-29] (ATI Technologies Inc.)
HKLM\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Run: [AIDA64 AutoStart] => D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\aida64.exe [19603408 2016-10-24] (FinalWire Ltd.)
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-854245398-329068152-725345543-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\yowindow.scr [859080 2016-12-04] (repkasoft)
HKU\S-1-5-18\...\Run: [Google Update] => C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [116648 2014-02-08] (Google Inc.)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [ JottaExt1] -> {648B08C1-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
ShellIconOverlayIdentifiers: [ JottaExt2] -> {648B08C2-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
ShellIconOverlayIdentifiers: [ JottaExt3] -> {648B08C3-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
Startup: C:\Documents and Settings\doni\Start Menu\Programs\Startup\YoWindow.lnk [2017-01-10]
ShortcutTarget: YoWindow.lnk -> C:\Program Files\YoWindow\yowindow.exe (Repkasoft)
GroupPolicy: Restriction ? <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C97B26C0-87E8-44A4-9564-5796CD042123}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-854245398-329068152-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-854245398-329068152-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {3A40E547-20FD-44a2-94D0-1C98342D1507} URL = hxxp://search.daum.net/search?nil_profile=ie&ref_code=ms&q={searchTerms}
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {AD43A510-0817-11DE-A4D6-59A755D89593} URL = hxxp://search.yahoo.com/search?ei=utf-8&fr=bfg&q={searchTerms}
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL [2000-04-19] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -  No File

FireFox:
========
FF DefaultProfile: k5gfurjn.default
FF ProfilePath: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default [2017-01-11]
FF Homepage: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> google.bg
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ftp", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ftp_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.socks", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.socks_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ssl", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ssl_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> http", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> http_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> share_proxy_settings", true
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ssl_port", 9050
FF Extension: (Adguard AdBlocker) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-15]
FF Extension: (Bloody Vikings!) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2017-01-09]
FF Extension: (MEGA) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2017-01-02]
FF Extension: (Google™ Translator) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-19]
FF Extension: (S3.Google Translator) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-15]
FF Extension: (Video DownloadHelper) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-02]
FF ProfilePath: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default [2017-01-11]
FF DefaultSearchEngine: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> Google
FF SelectedSearchEngine: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> Google
FF Homepage: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> www.google.bg
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ssl_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> http", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> http_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> share_proxy_settings", true
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ssl_port", 9050
FF Extension: (Adguard AdBlocker (Legacy)) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2016-12-22] [not signed]
FF Extension: (S3.Google Translator) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2016-11-07]
FF Extension: (1-Click YouTube Video Downloader) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2017-01-02]
FF ProfilePath: C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default [2017-01-11]
FF user.js: detected! => C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default\user.js [2006-04-06]
FF Homepage: C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default -> www.google.bg
FF Extension: (NewsFox) - C:\Program Files\K-Meleon\browser\extensions\{899DF1F8-2F43-4394-8315-37F6744E6319}.xpi [2015-03-12] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2016-12-05] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_24_0_0_186.dll [2017-01-09] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2008-11-13] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=3 -> C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2014-02-08] (Google Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=9 -> C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2014-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-854245398-329068152-725345543-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\doni\Local Settings\Application Data\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin HKU\S-1-5-21-854245398-329068152-725345543-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\doni\Local Settings\Application Data\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2010-04-15] (Adobe Systems) [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2241992 2016-12-14] (ESET)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-03-11] (Hewlett-Packard Co.) [File not signed]
R2 Jotta VSS Service; C:\Program Files\Jotta\vss\jVSS.exe [102592 2016-12-12] ()
R2 MbaeSvc; C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe [155088 2016-12-14] (Malwarebytes Corporation)
S4 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [270336 2001-02-23] (Microsoft Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [69632 2004-09-29] (HP) [File not signed]
R2 Unchecky; C:\Program Files\Unchecky\bin\unchecky_svc.exe [254232 2016-08-22] (RaMMicHaeL)
R2 ZAMSvc; C:\Program Files\Zemana AntiMalware\ZAM.exe [14080240 2017-01-07] (Zemana Ltd.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 3FFF8A946; C:\WINDOWS\System32\drivers\3FFF8A946.sys [153784 2016-11-24] (Kaspersky Lab ZAO)
R1 AFS2K; C:\WINDOWS\system32\Drivers\AFS2K.sys [82380 2011-12-28] (Oak Technology Inc.) [File not signed]
R3 AIDA64Driver; C:\Documents and Settings\doni\Local Settings\Temp\AIDA64Driver.sys [44176 2016-10-24] ()
S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 avfwim; C:\WINDOWS\System32\DRIVERS\avfwim.sys [92448 2013-01-22] (Avira GmbH)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [113544 2016-12-13] (ESET)
R1 ehdrv; C:\WINDOWS\System32\DRIVERS\ehdrv.sys [140984 2016-12-13] (ESET)
R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
R1 epfwtdir; C:\WINDOWS\System32\DRIVERS\epfwtdir.sys [60992 2016-12-13] (ESET)
R1 ESProtectionDriver; C:\Program Files\Malwarebytes Anti-Exploit\mbae.sys [59968 2016-12-14] ()
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [51120 2005-03-08] (HP)
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2005-03-08] (HP)
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21744 2005-03-08] (HP)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [24448 2016-03-10] (Malwarebytes)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R3 pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [47360 2010-04-06] (VSO Software) [File not signed]
R3 RTHDMIAzAudService; C:\WINDOWS\System32\drivers\RtKHDMI.sys [3734976 2009-06-25] (Realtek Semiconductor Corp.)
R0 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [691696 2010-03-17] () [File not signed]
R3 VComm; C:\WINDOWS\System32\DRIVERS\VComm.sys [34448 2011-05-28] (IVT Corporation.)
R1 ZAM; C:\WINDOWS\System32\drivers\zam32.sys [181496 2016-12-20] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard32.sys [181496 2016-12-20] (Zemana Ltd.)
U3 a9fze76d; C:\WINDOWS\system32\Drivers\a9fze76d.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [X]
S3 BlueletSCOAudio; system32\DRIVERS\BlueletSCOAudio.sys [X]
S3 BT; system32\DRIVERS\btnetdrv.sys [X]
S3 Btcsrusb; System32\Drivers\btcusb.sys [X]
S3 BTHidEnum; system32\DRIVERS\vbtenum.sys [X]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [X]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [X]
S4 IntelIde; no ImagePath
S3 JL2005C; System32\Drivers\jl2005c.sys [X]
U5 P3; C:\Windows\System32\Drivers\P3.sys [42752 2008-04-14] (Microsoft Corporation)
U0 Partizan; system32\drivers\Partizan.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVC: SSHNAS -> no filepath.

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-11 10:45 - 2017-01-11 10:45 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Package Cache
2017-01-11 08:00 - 2017-01-11 08:00 - 00000000 ____D C:\Program Files\Slimjet
2017-01-11 08:00 - 2017-01-11 08:00 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\FlashPeak Slimjet
2017-01-10 21:45 - 2017-01-10 22:04 - 00000000 ____D C:\Documents and Settings\doni\Application Data\YoWindow
2017-01-10 21:45 - 2017-01-10 21:45 - 00000754 _____ C:\Documents and Settings\All Users\Desktop\YoWindow.lnk
2017-01-10 21:45 - 2017-01-10 21:45 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\YoWindow
2017-01-10 21:45 - 2017-01-10 21:45 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\YoWindow
2017-01-10 21:44 - 2017-01-10 21:45 - 00000000 ____D C:\Program Files\YoWindow
2017-01-09 12:11 - 2017-01-09 12:11 - 00000000 ____D C:\Documents and Settings\doni\Application Data\ESET
2017-01-09 11:57 - 2017-01-09 11:57 - 00802904 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2017-01-09 11:57 - 2017-01-09 11:57 - 00144472 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Program Files\ESET
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\ESET
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\ESET
2017-01-08 10:00 - 2017-01-08 10:00 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\GHISLER
2017-01-08 09:59 - 2017-01-08 10:00 - 00000000 ____D C:\totalcmd
2017-01-08 09:59 - 2017-01-08 09:59 - 00000548 _____ C:\Documents and Settings\doni\Desktop\Total Commander.lnk
2017-01-08 09:59 - 2017-01-08 09:59 - 00000000 ____D C:\Documents and Settings\doni\Start Menu\Programs\Total Commander
2017-01-08 09:59 - 2017-01-08 09:59 - 00000000 ____D C:\Documents and Settings\doni\Application Data\GHISLER
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\UC.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\RAR.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\PKZIP.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\PKUNZIP.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\LHA.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\ARJ.PIF
2017-01-07 20:16 - 2017-01-07 20:16 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Zemana AntiMalware
2017-01-02 12:52 - 2017-01-08 17:09 - 00000000 ____D C:\Documents and Settings\doni\Application Data\vlc
2017-01-02 12:51 - 2017-01-02 12:51 - 00000000 ____D C:\Program Files\VideoLAN
2016-12-31 16:34 - 2016-12-31 16:34 - 00011450 _____ C:\WINDOWS\system32\PARTIZAN.TXT
2016-12-31 14:01 - 2016-12-31 16:40 - 00000000 ____D C:\Program Files\UnHackMe
2016-12-31 14:01 - 2016-12-31 14:01 - 00000682 _____ C:\Documents and Settings\doni\Desktop\UnHackMe.lnk
2016-12-31 14:01 - 2016-12-31 14:01 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\UnHackMe
2016-12-31 14:01 - 2016-12-13 17:04 - 00015016 _____ (Greatis Software, LLC.) C:\WINDOWS\system32\Drivers\UnHackMeDrv.sys
2016-12-31 13:52 - 2016-12-31 13:21 - 00001617 _____ C:\Documents and Settings\doni\Desktop\Shortcut to Zemana AntiMalware.lnk
2016-12-29 17:03 - 2016-12-29 17:03 - 00000638 _____ C:\Documents and Settings\doni\Desktop\Jottacloud.lnk
2016-12-29 17:03 - 2016-12-29 17:03 - 00000000 ____D C:\Documents and Settings\doni\Application Data\Jotta
2016-12-29 17:03 - 2016-12-29 17:03 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Jottacloud
2016-12-20 19:22 - 2016-12-20 19:22 - 00078063 _____ C:\Documents and Settings\doni\My Documents\gr1.JPG
2016-12-20 11:20 - 2017-01-11 17:02 - 00042271 _____ C:\WINDOWS\ZAM.krnl.trace
2016-12-20 11:20 - 2017-01-11 17:02 - 00019107 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2016-12-20 11:20 - 2017-01-07 20:16 - 00000000 ____D C:\Program Files\Zemana AntiMalware
2016-12-20 11:20 - 2016-12-20 11:20 - 00181496 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard32.sys
2016-12-20 11:20 - 2016-12-20 11:20 - 00181496 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam32.sys
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Zemana
2016-12-19 19:34 - 2017-01-03 10:28 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Н
2016-12-19 19:28 - 2016-12-19 19:33 - 00000000 ____D C:\Documents and Settings\doni\My Documents\AA
2016-12-18 22:39 - 2016-12-20 14:44 - 00000000 ____D C:\Program Files\4shared Desktop
2016-12-18 22:39 - 2016-12-18 22:41 - 00000000 ____D C:\Documents and Settings\doni\Application Data\4shared Desktop
2016-12-18 22:39 - 2016-12-18 22:39 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\4shared Desktop
2016-12-18 15:16 - 2016-12-18 15:16 - 00000000 ____D C:\Documents and Settings\doni\My Documents\NOD051216
2016-12-13 19:34 - 2016-12-13 19:34 - 00000088 _____ C:\Documents and Settings\doni\My Documents\enablewsh.bat

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-11 17:02 - 2016-11-16 20:05 - 00000000 ____D C:\FRST
2017-01-11 17:02 - 2016-04-09 10:34 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Изтегляния
2017-01-11 17:02 - 2010-03-11 04:44 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Temp
2017-01-11 16:34 - 2010-05-06 20:27 - 00000986 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2017-01-11 16:24 - 2014-02-08 17:19 - 00001098 ____C C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-18UA.job
2017-01-11 16:09 - 2016-11-04 07:53 - 00001074 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-329068152-725345543-1003UA.job
2017-01-11 15:00 - 2015-12-17 15:00 - 00000632 ____C C:\WINDOWS\Tasks\Auslogics BoostSpeed Scan and Repair.job
2017-01-11 13:43 - 2014-11-30 22:25 - 00000000 ____D C:\AdwCleaner
2017-01-11 12:13 - 2016-11-16 11:53 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes Anti-Exploit
2017-01-11 11:09 - 2016-08-10 14:24 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Загрузки
2017-01-11 09:50 - 2010-03-11 06:28 - 00005096 ____C C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-11 09:46 - 2015-12-17 15:00 - 00000406 ____C C:\WINDOWS\Tasks\Auslogics BoostSpeed Start BoostSpeed оn doni logon.job
2017-01-11 09:46 - 2012-09-14 20:40 - 00000982 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cd92a860a26e52.job
2017-01-11 09:46 - 2010-03-11 04:43 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
2017-01-11 08:17 - 2016-02-24 18:12 - 00032556 _____ C:\WINDOWS\SchedLgU.Txt
2017-01-11 08:17 - 2010-03-11 04:44 - 00000278 __SHC C:\Documents and Settings\doni\ntuser.ini
2017-01-11 07:59 - 2010-03-11 04:44 - 00000000 ____D C:\Documents and Settings\doni
2017-01-10 21:18 - 2010-05-06 20:27 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Temp
2017-01-10 20:35 - 2015-03-27 20:14 - 00170200 ____C (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-01-09 17:24 - 2014-02-08 17:19 - 00001046 ____C C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-18Core.job
2017-01-09 11:57 - 2010-03-11 04:39 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-01-08 23:19 - 2012-01-13 11:06 - 00000406 __RSH C:\Documents and Settings\All Users\ntuser.pol
2017-01-08 23:19 - 2010-03-11 06:25 - 00000000 ____D C:\Documents and Settings\All Users
2017-01-08 22:49 - 2010-03-17 21:49 - 00000000 ____D C:\Documents and Settings\doni\Application Data\Skype
2017-01-08 17:36 - 2010-03-11 06:21 - 00000000 ____D C:\WINDOWS\inf
2017-01-08 16:26 - 2015-06-17 09:43 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Unchecky
2017-01-08 16:18 - 2010-12-14 22:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\TEMP
2017-01-08 09:09 - 2016-11-04 07:53 - 00001022 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-329068152-725345543-1003Core.job
2017-01-06 06:43 - 2001-08-23 13:00 - 00002206 ____C C:\WINDOWS\system32\wpa.dbl
2017-01-03 19:37 - 2016-10-20 12:19 - 00000000 ____D C:\Program Files\Pale Moon
2017-01-02 12:50 - 2010-04-18 13:54 - 00000202 ____C C:\WINDOWS\NeroDigital.ini
2017-01-02 11:28 - 2016-11-09 16:07 - 00000000 ____D C:\Documents and Settings\doni\dwhelper
2016-12-31 16:43 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\doni\My Documents\RegRun2
2016-12-31 16:42 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RegRun
2016-12-31 14:06 - 2015-03-28 08:11 - 00000002 RSHOT C:\WINDOWS\winstart.bat
2016-12-31 14:06 - 2010-03-11 06:28 - 00001688 ____C C:\WINDOWS\system32\AUTOEXEC.NT
2016-12-31 14:06 - 2010-03-11 04:41 - 00002577 ____C C:\WINDOWS\system32\CONFIG.NT
2016-12-29 17:06 - 2016-12-03 10:31 - 00000671 _____ C:\Jottacloud.lnk
2016-12-29 17:06 - 2016-12-03 10:31 - 00000000 ___RD C:\Documents and Settings\doni\Jottacloud
2016-12-29 17:03 - 2016-12-03 10:26 - 00000000 ____D C:\Program Files\Jotta
2016-12-20 19:22 - 2010-03-11 04:44 - 00000000 ___RD C:\Documents and Settings\doni\My Documents
2016-12-20 19:09 - 2016-10-05 16:19 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
2016-12-20 14:44 - 2010-03-11 06:21 - 00000000 ____D C:\WINDOWS\system32\Drivers\etc
2016-12-20 11:20 - 2010-03-11 04:43 - 00000000 ___HD C:\Documents and Settings\LocalService\Local Settings\Application Data
2016-12-19 19:30 - 2010-03-17 22:12 - 00040448 ____C C:\Documents and Settings\doni\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-12-18 20:34 - 2010-03-28 20:57 - 00000000 ____D C:\Documents and Settings\doni\Application Data\dvdcss
2016-12-17 10:23 - 2016-11-17 22:00 - 00000000 ____D C:\Program Files\Hard Disk Sentinel
2016-12-16 08:19 - 2015-01-29 21:42 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-12-16 00:55 - 2016-11-20 22:23 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Exploit
2016-12-16 00:55 - 2016-11-16 11:53 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Exploit
2016-12-15 18:20 - 2016-11-24 18:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-12-14 21:23 - 2016-10-30 23:52 - 00000680 _____ C:\Documents and Settings\doni\Desktop\Shortcut to CCleaner.exe.lnk
2016-12-13 17:11 - 2016-06-23 13:31 - 00140984 _____ (ESET) C:\WINDOWS\system32\Drivers\ehdrv.sys
2016-12-13 17:11 - 2016-06-23 13:31 - 00113544 _____ (ESET) C:\WINDOWS\system32\Drivers\eamonm.sys
2016-12-13 17:11 - 2016-06-23 13:31 - 00060992 _____ (ESET) C:\WINDOWS\system32\Drivers\epfwtdir.sys
2016-12-12 20:45 - 2015-12-17 22:57 - 00000000 ____D C:\Program Files\Process Lasso
2016-12-12 20:45 - 2015-12-17 15:49 - 00000000 ____D C:\Documents and Settings\doni\Application Data\ProcessLasso

==================== Files in the root of some directories =======

2010-04-06 23:40 - 2010-04-06 23:40 - 0081920 ____C () C:\Documents and Settings\doni\Application Data\ezpinst.exe
2010-04-06 23:40 - 2010-04-06 23:40 - 0007176 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.cat
2010-04-06 23:40 - 2010-04-06 23:40 - 0001144 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.inf
2010-04-06 23:40 - 2010-04-06 23:40 - 0000034 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.log
2010-04-06 23:40 - 2010-04-06 23:40 - 0047360 ____C (VSO Software) C:\Documents and Settings\doni\Application Data\pcouffin.sys
2010-03-17 22:12 - 2016-12-19 19:30 - 0040448 ____C () C:\Documents and Settings\doni\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-03-22 10:24 - 2010-03-22 10:24 - 0000127 ____C () C:\Documents and Settings\doni\Local Settings\Application Data\fusioncache.dat
2012-03-06 10:56 - 2016-11-11 06:28 - 0000043 __SHC () C:\Documents and Settings\All Users\Application Data\.zreglib
2016-10-05 16:19 - 2016-10-05 16:19 - 0000232 _____ () C:\Documents and Settings\All Users\Application Data\fontcacheev1.dat
2010-03-22 10:05 - 2012-02-06 14:13 - 0014995 ____C () C:\Documents and Settings\All Users\Application Data\hpzinstall.log

Files to move or delete:
====================
C:\Documents and Settings\doni\TempWmicBatchFile.bat

Some files in TEMP:
====================
C:\Documents and Settings\doni\Local Settings\Temp\Watchdog.AntiMalware.Setup.exe

Some zero byte size files/folders:
==========================
C:\Windows\mansk.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Addition.txt

Привет,

Най-вероятно не можете да стартирате JRT, заради заключената %temp% папка от CryptoPrevent:

HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.exe <====== ATTENTION

Временно дайте UNDO на защитата в CryptoPrevent и вижте дали тръгва вече JRT.

А иначе този setup.exe кога се появява? След стартиране на системата ли?

Здравейте !

След None на CryptoPrevent и рестарт на системата,проблема с JRT остава.

Този setup.exe  се появява след опит да се инсталира Вивалди .

 

Възможно е някоя от инсталираните програми за защита да спира изпълнението му. Вие имате доста антивирусни програми. Желателно е да оставите само една!

Деинсталирайте Avira или NOD32. Временно деинсталирайте Zemana Anti-Malware, UnhackMe, рестартирайте системата и вижте дали проблема остава.

Подгответе и нови логове от FRST след тези промени.

Основната антивирусна е Нод32 .

Преди нея е била Авира.

Деинсталирах Земана и Унхакме .

Изключих CryptoPrevent-а,рестарт-проблема с JRT остава.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-01-2017
Ran by doni (administrator) on AMD (11-01-2017 19:25:46)
Running from C:\Documents and Settings\doni\My Documents\Изтегляния
Loaded Profiles: doni (Available Profiles: doni)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: "C:\Program Files\Pale Moon\palemoon.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Murray Hurps Software Pty Ltd) C:\Program Files\Ad Muncher\AdMunch.exe
(Bitsum LLC) C:\Program Files\Process Lasso\ProcessLasso.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
(H.D.S. Hungary) C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
(FinalWire Ltd.) D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\aida64.exe
(Repkasoft) C:\Program Files\YoWindow\yowindow.exe
() C:\Program Files\Jotta\vss\jVSS.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(HP) C:\WINDOWS\system32\HPZipm12.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe
(Bitsum LLC) C:\Program Files\Process Lasso\ProcessGovernor.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Ad Muncher] => C:\Program Files\Ad Muncher\AdMunch.exe [560760 2015-06-17] (Murray Hurps Software Pty Ltd)
HKLM\...\Run: [ProcessLassoManagementConsole] => C:\Program Files\Process Lasso\processlasso.exe [779776 2016-12-10] (Bitsum LLC)
HKLM\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe [2650576 2016-12-14] (Malwarebytes Corporation)
HKLM\...\Run: [Hard Disk Sentinel] => C:\Program Files\Hard Disk Sentinel\HDSentinel.exe [4731552 2016-01-31] (H.D.S. Hungary)
HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.js <====== ATTENTION
HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.jse <====== ATTENTION
HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.js <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.jse <====== ATTENTION
HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\8z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.jse <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.jse <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: ** <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.js <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION
HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: bcdedit.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.js <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Start Menu\Programs\Startup\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.rar*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.png*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*.com <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *:\RECYCLER <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.rtf*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\*.zip\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.avi*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.mp3*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Application Data\*\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pptx*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\wz*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*.jse <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Application Data\*\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.js <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.js <====== ATTENTION
HKLM Group Policy restriction on software: %allusersprofile%\Local Settings\Application Data\*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.txt*.bat <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Start Menu\Programs\Startup\*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\7z*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION
HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION
HKLM Group Policy restriction on software: *.jpeg*.js <====== ATTENTION
HKLM Group Policy restriction on software: *.7z*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Application Data\*\*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION
HKLM Group Policy restriction on software: %userprofile%\Local Settings\Temp\rar*\*.cmd <====== ATTENTION
HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION
HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\8z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %appdata%\*.bat <====== ATTENTION
HKLM Group Policy restriction on software: *.zip*.bat <====== ATTENTION
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2009-07-29] (ATI Technologies Inc.)
HKLM\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Run: [AIDA64 AutoStart] => D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\aida64.exe [19603408 2016-10-24] (FinalWire Ltd.)
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-854245398-329068152-725345543-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\yowindow.scr [859080 2016-12-04] (repkasoft)
HKU\S-1-5-18\...\Run: [Google Update] => C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [116648 2014-02-08] (Google Inc.)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [ JottaExt1] -> {648B08C1-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
ShellIconOverlayIdentifiers: [ JottaExt2] -> {648B08C2-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
ShellIconOverlayIdentifiers: [ JottaExt3] -> {648B08C3-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
Startup: C:\Documents and Settings\doni\Start Menu\Programs\Startup\YoWindow.lnk [2017-01-10]
ShortcutTarget: YoWindow.lnk -> C:\Program Files\YoWindow\yowindow.exe (Repkasoft)
GroupPolicy: Restriction ? <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C97B26C0-87E8-44A4-9564-5796CD042123}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-854245398-329068152-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-854245398-329068152-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {3A40E547-20FD-44a2-94D0-1C98342D1507} URL = hxxp://search.daum.net/search?nil_profile=ie&ref_code=ms&q={searchTerms}
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {AD43A510-0817-11DE-A4D6-59A755D89593} URL = hxxp://search.yahoo.com/search?ei=utf-8&fr=bfg&q={searchTerms}
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL [2000-04-19] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -  No File

FireFox:
========
FF DefaultProfile: k5gfurjn.default
FF ProfilePath: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default [2017-01-11]
FF Homepage: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> google.bg
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ftp", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ftp_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.socks", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.socks_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ssl", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ssl_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> http", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> http_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> share_proxy_settings", true
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ssl_port", 9050
FF Extension: (Adguard AdBlocker) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-15]
FF Extension: (Bloody Vikings!) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2017-01-09]
FF Extension: (MEGA) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2017-01-02]
FF Extension: (Google™ Translator) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-19]
FF Extension: (S3.Google Translator) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-15]
FF Extension: (Video DownloadHelper) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-02]
FF ProfilePath: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default [2017-01-11]
FF DefaultSearchEngine: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> Google
FF SelectedSearchEngine: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> Google
FF Homepage: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> www.google.bg
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ssl_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> http", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> http_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> share_proxy_settings", true
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ssl_port", 9050
FF Extension: (Adguard AdBlocker (Legacy)) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2016-12-22] [not signed]
FF Extension: (S3.Google Translator) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2016-11-07]
FF Extension: (1-Click YouTube Video Downloader) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2017-01-02]
FF ProfilePath: C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default [2017-01-11]
FF user.js: detected! => C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default\user.js [2006-04-06]
FF Homepage: C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default -> www.google.bg
FF Extension: (NewsFox) - C:\Program Files\K-Meleon\browser\extensions\{899DF1F8-2F43-4394-8315-37F6744E6319}.xpi [2015-03-12] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2016-12-05] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_24_0_0_186.dll [2017-01-09] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2008-11-13] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=3 -> C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2014-02-08] (Google Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=9 -> C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2014-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-854245398-329068152-725345543-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\doni\Local Settings\Application Data\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin HKU\S-1-5-21-854245398-329068152-725345543-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\doni\Local Settings\Application Data\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2010-04-15] (Adobe Systems) [File not signed]
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2241992 2016-12-14] (ESET)
S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-03-11] (Hewlett-Packard Co.) [File not signed]
R2 Jotta VSS Service; C:\Program Files\Jotta\vss\jVSS.exe [102592 2016-12-12] ()
R2 MbaeSvc; C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe [155088 2016-12-14] (Malwarebytes Corporation)
S4 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [270336 2001-02-23] (Microsoft Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [69632 2004-09-29] (HP) [File not signed]
R2 Unchecky; C:\Program Files\Unchecky\bin\unchecky_svc.exe [254232 2016-08-22] (RaMMicHaeL)
S2 ZAMSvc; "C:\Program Files\Zemana AntiMalware\ZAM.exe" /service [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 3FFF8A946; C:\WINDOWS\System32\drivers\3FFF8A946.sys [153784 2016-11-24] (Kaspersky Lab ZAO)
R1 AFS2K; C:\WINDOWS\system32\Drivers\AFS2K.sys [82380 2011-12-28] (Oak Technology Inc.) [File not signed]
R3 AIDA64Driver; C:\Documents and Settings\doni\Local Settings\Temp\AIDA64Driver.sys [44176 2016-10-24] ()
S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 avfwim; C:\WINDOWS\System32\DRIVERS\avfwim.sys [92448 2013-01-22] (Avira GmbH)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [113544 2016-12-13] (ESET)
R1 ehdrv; C:\WINDOWS\System32\DRIVERS\ehdrv.sys [140984 2016-12-13] (ESET)
R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
R1 epfwtdir; C:\WINDOWS\System32\DRIVERS\epfwtdir.sys [60992 2016-12-13] (ESET)
R1 ESProtectionDriver; C:\Program Files\Malwarebytes Anti-Exploit\mbae.sys [59968 2016-12-14] ()
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [51120 2005-03-08] (HP)
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2005-03-08] (HP)
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21744 2005-03-08] (HP)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [24448 2016-03-10] (Malwarebytes)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R3 pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [47360 2010-04-06] (VSO Software) [File not signed]
R3 RTHDMIAzAudService; C:\WINDOWS\System32\drivers\RtKHDMI.sys [3734976 2009-06-25] (Realtek Semiconductor Corp.)
R0 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [691696 2010-03-17] () [File not signed]
R3 VComm; C:\WINDOWS\System32\DRIVERS\VComm.sys [34448 2011-05-28] (IVT Corporation.)
U3 austampv; C:\WINDOWS\system32\Drivers\austampv.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [X]
S3 BlueletSCOAudio; system32\DRIVERS\BlueletSCOAudio.sys [X]
S3 BT; system32\DRIVERS\btnetdrv.sys [X]
S3 Btcsrusb; System32\Drivers\btcusb.sys [X]
S3 BTHidEnum; system32\DRIVERS\vbtenum.sys [X]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [X]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [X]
S4 IntelIde; no ImagePath
S3 JL2005C; System32\Drivers\jl2005c.sys [X]
U5 P3; C:\Windows\System32\Drivers\P3.sys [42752 2008-04-14] (Microsoft Corporation)
U0 Partizan; system32\drivers\Partizan.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]
S3 VcommMgr; System32\Drivers\VcommMgr.sys [X]
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam32.sys [X]
S1 ZAM_Guard; \??\C:\WINDOWS\System32\drivers\zamguard32.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVC: SSHNAS -> no filepath.

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-11 10:45 - 2017-01-11 18:02 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Package Cache
2017-01-11 08:00 - 2017-01-11 08:00 - 00000000 ____D C:\Program Files\Slimjet
2017-01-11 08:00 - 2017-01-11 08:00 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\FlashPeak Slimjet
2017-01-10 21:45 - 2017-01-10 22:04 - 00000000 ____D C:\Documents and Settings\doni\Application Data\YoWindow
2017-01-10 21:45 - 2017-01-10 21:45 - 00000754 _____ C:\Documents and Settings\All Users\Desktop\YoWindow.lnk
2017-01-10 21:45 - 2017-01-10 21:45 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\YoWindow
2017-01-10 21:45 - 2017-01-10 21:45 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\YoWindow
2017-01-10 21:44 - 2017-01-10 21:45 - 00000000 ____D C:\Program Files\YoWindow
2017-01-09 12:11 - 2017-01-09 12:11 - 00000000 ____D C:\Documents and Settings\doni\Application Data\ESET
2017-01-09 11:57 - 2017-01-09 11:57 - 00802904 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2017-01-09 11:57 - 2017-01-09 11:57 - 00144472 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Program Files\ESET
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\ESET
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\ESET
2017-01-08 10:00 - 2017-01-08 10:00 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\GHISLER
2017-01-08 09:59 - 2017-01-08 10:00 - 00000000 ____D C:\totalcmd
2017-01-08 09:59 - 2017-01-08 09:59 - 00000548 _____ C:\Documents and Settings\doni\Desktop\Total Commander.lnk
2017-01-08 09:59 - 2017-01-08 09:59 - 00000000 ____D C:\Documents and Settings\doni\Start Menu\Programs\Total Commander
2017-01-08 09:59 - 2017-01-08 09:59 - 00000000 ____D C:\Documents and Settings\doni\Application Data\GHISLER
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\UC.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\RAR.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\PKZIP.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\PKUNZIP.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\LHA.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\ARJ.PIF
2017-01-02 12:52 - 2017-01-08 17:09 - 00000000 ____D C:\Documents and Settings\doni\Application Data\vlc
2017-01-02 12:51 - 2017-01-02 12:51 - 00000000 ____D C:\Program Files\VideoLAN
2016-12-31 16:34 - 2016-12-31 16:34 - 00011450 _____ C:\WINDOWS\system32\PARTIZAN.TXT
2016-12-31 13:52 - 2016-12-31 13:21 - 00001617 _____ C:\Documents and Settings\doni\Desktop\Shortcut to Zemana AntiMalware.lnk
2016-12-29 17:03 - 2016-12-29 17:03 - 00000638 _____ C:\Documents and Settings\doni\Desktop\Jottacloud.lnk
2016-12-29 17:03 - 2016-12-29 17:03 - 00000000 ____D C:\Documents and Settings\doni\Application Data\Jotta
2016-12-29 17:03 - 2016-12-29 17:03 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Jottacloud
2016-12-20 19:22 - 2016-12-20 19:22 - 00078063 _____ C:\Documents and Settings\doni\My Documents\gr1.JPG
2016-12-20 11:20 - 2017-01-11 19:18 - 00013512 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2016-12-20 11:20 - 2017-01-11 19:17 - 00025315 _____ C:\WINDOWS\ZAM.krnl.trace
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Zemana
2016-12-19 19:34 - 2017-01-03 10:28 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Н
2016-12-19 19:28 - 2016-12-19 19:33 - 00000000 ____D C:\Documents and Settings\doni\My Documents\AA
2016-12-18 22:39 - 2016-12-20 14:44 - 00000000 ____D C:\Program Files\4shared Desktop
2016-12-18 22:39 - 2016-12-18 22:41 - 00000000 ____D C:\Documents and Settings\doni\Application Data\4shared Desktop
2016-12-18 22:39 - 2016-12-18 22:39 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\4shared Desktop
2016-12-18 15:16 - 2016-12-18 15:16 - 00000000 ____D C:\Documents and Settings\doni\My Documents\NOD051216
2016-12-13 19:34 - 2016-12-13 19:34 - 00000088 _____ C:\Documents and Settings\doni\My Documents\enablewsh.bat

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-11 19:26 - 2010-03-11 04:44 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Temp
2017-01-11 19:25 - 2016-11-16 20:05 - 00000000 ____D C:\FRST
2017-01-11 19:25 - 2016-04-09 10:34 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Изтегляния
2017-01-11 19:24 - 2014-02-08 17:19 - 00001098 ____C C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-18UA.job
2017-01-11 19:23 - 2015-12-17 15:00 - 00000406 ____C C:\WINDOWS\Tasks\Auslogics BoostSpeed Start BoostSpeed оn doni logon.job
2017-01-11 19:23 - 2012-09-14 20:40 - 00000982 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cd92a860a26e52.job
2017-01-11 19:23 - 2010-03-11 04:43 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
2017-01-11 19:22 - 2016-02-24 18:12 - 00032480 _____ C:\WINDOWS\SchedLgU.Txt
2017-01-11 19:22 - 2012-01-13 11:06 - 00000406 __RSH C:\Documents and Settings\All Users\ntuser.pol
2017-01-11 19:22 - 2010-03-11 06:25 - 00000000 ____D C:\Documents and Settings\All Users
2017-01-11 19:22 - 2010-03-11 04:44 - 00000278 __SHC C:\Documents and Settings\doni\ntuser.ini
2017-01-11 19:09 - 2016-11-04 07:53 - 00001074 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-329068152-725345543-1003UA.job
2017-01-11 18:34 - 2010-05-06 20:27 - 00000986 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2017-01-11 18:09 - 2010-03-11 06:28 - 00005096 ____C C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-11 17:24 - 2014-02-08 17:19 - 00001046 ____C C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-18Core.job
2017-01-11 15:00 - 2015-12-17 15:00 - 00000632 ____C C:\WINDOWS\Tasks\Auslogics BoostSpeed Scan and Repair.job
2017-01-11 13:43 - 2014-11-30 22:25 - 00000000 ____D C:\AdwCleaner
2017-01-11 12:13 - 2016-11-16 11:53 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes Anti-Exploit
2017-01-11 11:09 - 2016-08-10 14:24 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Загрузки
2017-01-11 07:59 - 2010-03-11 04:44 - 00000000 ____D C:\Documents and Settings\doni
2017-01-10 21:18 - 2010-05-06 20:27 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Temp
2017-01-10 20:35 - 2015-03-27 20:14 - 00170200 ____C (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-01-09 11:57 - 2010-03-11 04:39 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-01-08 22:49 - 2010-03-17 21:49 - 00000000 ____D C:\Documents and Settings\doni\Application Data\Skype
2017-01-08 17:36 - 2010-03-11 06:21 - 00000000 ____D C:\WINDOWS\inf
2017-01-08 16:26 - 2015-06-17 09:43 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Unchecky
2017-01-08 16:18 - 2010-12-14 22:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\TEMP
2017-01-08 09:09 - 2016-11-04 07:53 - 00001022 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-329068152-725345543-1003Core.job
2017-01-06 06:43 - 2001-08-23 13:00 - 00002206 ____C C:\WINDOWS\system32\wpa.dbl
2017-01-03 19:37 - 2016-10-20 12:19 - 00000000 ____D C:\Program Files\Pale Moon
2017-01-02 12:50 - 2010-04-18 13:54 - 00000202 ____C C:\WINDOWS\NeroDigital.ini
2017-01-02 11:28 - 2016-11-09 16:07 - 00000000 ____D C:\Documents and Settings\doni\dwhelper
2016-12-31 16:43 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\doni\My Documents\RegRun2
2016-12-31 16:42 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RegRun
2016-12-31 14:06 - 2015-03-28 08:11 - 00000002 RSHOT C:\WINDOWS\winstart.bat
2016-12-31 14:06 - 2010-03-11 06:28 - 00001688 ____C C:\WINDOWS\system32\AUTOEXEC.NT
2016-12-31 14:06 - 2010-03-11 04:41 - 00002577 ____C C:\WINDOWS\system32\CONFIG.NT
2016-12-29 17:06 - 2016-12-03 10:31 - 00000671 _____ C:\Jottacloud.lnk
2016-12-29 17:06 - 2016-12-03 10:31 - 00000000 ___RD C:\Documents and Settings\doni\Jottacloud
2016-12-29 17:03 - 2016-12-03 10:26 - 00000000 ____D C:\Program Files\Jotta
2016-12-20 19:22 - 2010-03-11 04:44 - 00000000 ___RD C:\Documents and Settings\doni\My Documents
2016-12-20 19:09 - 2016-10-05 16:19 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
2016-12-20 14:44 - 2010-03-11 06:21 - 00000000 ____D C:\WINDOWS\system32\Drivers\etc
2016-12-20 11:20 - 2010-03-11 04:43 - 00000000 ___HD C:\Documents and Settings\LocalService\Local Settings\Application Data
2016-12-19 19:30 - 2010-03-17 22:12 - 00040448 ____C C:\Documents and Settings\doni\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-12-18 20:34 - 2010-03-28 20:57 - 00000000 ____D C:\Documents and Settings\doni\Application Data\dvdcss
2016-12-17 10:23 - 2016-11-17 22:00 - 00000000 ____D C:\Program Files\Hard Disk Sentinel
2016-12-16 08:19 - 2015-01-29 21:42 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-12-16 00:55 - 2016-11-20 22:23 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Exploit
2016-12-16 00:55 - 2016-11-16 11:53 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Exploit
2016-12-15 18:20 - 2016-11-24 18:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-12-14 21:23 - 2016-10-30 23:52 - 00000680 _____ C:\Documents and Settings\doni\Desktop\Shortcut to CCleaner.exe.lnk
2016-12-13 17:11 - 2016-06-23 13:31 - 00140984 _____ (ESET) C:\WINDOWS\system32\Drivers\ehdrv.sys
2016-12-13 17:11 - 2016-06-23 13:31 - 00113544 _____ (ESET) C:\WINDOWS\system32\Drivers\eamonm.sys
2016-12-13 17:11 - 2016-06-23 13:31 - 00060992 _____ (ESET) C:\WINDOWS\system32\Drivers\epfwtdir.sys
2016-12-12 20:45 - 2015-12-17 22:57 - 00000000 ____D C:\Program Files\Process Lasso
2016-12-12 20:45 - 2015-12-17 15:49 - 00000000 ____D C:\Documents and Settings\doni\Application Data\ProcessLasso

==================== Files in the root of some directories =======

2010-04-06 23:40 - 2010-04-06 23:40 - 0081920 ____C () C:\Documents and Settings\doni\Application Data\ezpinst.exe
2010-04-06 23:40 - 2010-04-06 23:40 - 0007176 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.cat
2010-04-06 23:40 - 2010-04-06 23:40 - 0001144 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.inf
2010-04-06 23:40 - 2010-04-06 23:40 - 0000034 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.log
2010-04-06 23:40 - 2010-04-06 23:40 - 0047360 ____C (VSO Software) C:\Documents and Settings\doni\Application Data\pcouffin.sys
2010-03-17 22:12 - 2016-12-19 19:30 - 0040448 ____C () C:\Documents and Settings\doni\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-03-22 10:24 - 2010-03-22 10:24 - 0000127 ____C () C:\Documents and Settings\doni\Local Settings\Application Data\fusioncache.dat
2012-03-06 10:56 - 2016-11-11 06:28 - 0000043 __SHC () C:\Documents and Settings\All Users\Application Data\.zreglib
2016-10-05 16:19 - 2016-10-05 16:19 - 0000232 _____ () C:\Documents and Settings\All Users\Application Data\fontcacheev1.dat
2010-03-22 10:05 - 2012-02-06 14:13 - 0014995 ____C () C:\Documents and Settings\All Users\Application Data\hpzinstall.log

Files to move or delete:
====================
C:\Documents and Settings\doni\TempWmicBatchFile.bat

Some zero byte size files/folders:
==========================
C:\Windows\mansk.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Addition.txt

Като гледам в логовете  ще трябва да напиша скрипт, защото защитата от CryptoPrevent е останала активна и подозирам, че именно там е проблема.

Но ще е след малко като се прибера в нас.

Поздрави!

 Внимателно в този сняг . Аз да доуточня,че :

"Изключих CryptoPrevent-а,рестарт-проблема с JRT остава". След това включих пак CryptoPrevent-а.

Благодаря за загрижеността.

Все пак изберете None в CryptoPrevent, след това рестартирайте и подгответе новите лог файлове. Искам да изчистим възможните причинители един по един. Може би има някакви проблеми с правата над %TEMP% папката и след новите логове ще подготвя скрипта. Ако не стане с него ще се наложи да пробваме с Process Monitor да видим какво се случва при изпълнението на JRT. Като цяло нестартирането на JRT не е непременен симптом за наличието на злонамерен софтуер или други проблеми, но все пак не би трябвало да се получава.

Друга евентуална причина за проблема с JRT е ако има някакви проблеми/промени с променливите на потребителския акаунт (Environment Variables). Ще е добре да проверим и това.

Поздрави!

None в CryptoPrevent-a -рестарт.

Заповядай:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-01-2017
Ran by doni (administrator) on AMD (11-01-2017 21:23:15)
Running from C:\Documents and Settings\doni\My Documents\Изтегляния
Loaded Profiles: doni (Available Profiles: doni)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: "C:\Program Files\Pale Moon\palemoon.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Murray Hurps Software Pty Ltd) C:\Program Files\Ad Muncher\AdMunch.exe
(Bitsum LLC) C:\Program Files\Process Lasso\ProcessLasso.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
(H.D.S. Hungary) C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
(FinalWire Ltd.) D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\aida64.exe
(Repkasoft) C:\Program Files\YoWindow\yowindow.exe
(Foolish IT LLC) C:\Program Files\Foolish IT\CryptoPrevent\CryptoPrevent.exe
() C:\Program Files\Jotta\vss\jVSS.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(HP) C:\WINDOWS\system32\HPZipm12.exe
(Skype Technologies) C:\Program Files\Skype\Updater\Updater.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe
(Bitsum LLC) C:\Program Files\Process Lasso\ProcessGovernor.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Ad Muncher] => C:\Program Files\Ad Muncher\AdMunch.exe [560760 2015-06-17] (Murray Hurps Software Pty Ltd)
HKLM\...\Run: [ProcessLassoManagementConsole] => C:\Program Files\Process Lasso\processlasso.exe [779776 2016-12-10] (Bitsum LLC)
HKLM\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe [2650576 2016-12-14] (Malwarebytes Corporation)
HKLM\...\Run: [Hard Disk Sentinel] => C:\Program Files\Hard Disk Sentinel\HDSentinel.exe [4731552 2016-01-31] (H.D.S. Hungary)
HKLM Group Policy restriction on software: %TEMP%\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\8z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\8z*\ <====== ATTENTION
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2009-07-29] (ATI Technologies Inc.)
HKLM\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Run: [AIDA64 AutoStart] => D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\aida64.exe [19603408 2016-10-24] (FinalWire Ltd.)
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 0
HKU\S-1-5-21-854245398-329068152-725345543-1003\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-854245398-329068152-725345543-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\yowindow.scr [859080 2016-12-04] (repkasoft)
HKU\S-1-5-18\...\Run: [Google Update] => C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [116648 2014-02-08] (Google Inc.)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Documents and Settings\doni\Local Settings\Application Data\MEGAsync\ShellExtX32.dll [2016-12-01] ()
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [ JottaExt1] -> {648B08C1-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
ShellIconOverlayIdentifiers: [ JottaExt2] -> {648B08C2-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
ShellIconOverlayIdentifiers: [ JottaExt3] -> {648B08C3-8BB1-46e1-8F8A-64EF3F28D417} => C:\Program Files\Jotta\jottaext64.dll [2016-12-12] ()
Startup: C:\Documents and Settings\doni\Start Menu\Programs\Startup\YoWindow.lnk [2017-01-10]
ShortcutTarget: YoWindow.lnk -> C:\Program Files\YoWindow\yowindow.exe (Repkasoft)
GroupPolicy: Restriction ? <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{C97B26C0-87E8-44A4-9564-5796CD042123}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-854245398-329068152-725345543-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-854245398-329068152-725345543-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {3A40E547-20FD-44a2-94D0-1C98342D1507} URL = hxxp://search.daum.net/search?nil_profile=ie&ref_code=ms&q={searchTerms}
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {AD43A510-0817-11DE-A4D6-59A755D89593} URL = hxxp://search.yahoo.com/search?ei=utf-8&fr=bfg&q={searchTerms}
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL [2000-04-19] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -  No File

FireFox:
========
FF DefaultProfile: k5gfurjn.default
FF ProfilePath: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default [2017-01-11]
FF Homepage: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> google.bg
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ftp", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ftp_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.socks", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.socks_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ssl", ""
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> backup.ssl_port", 0
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> http", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> http_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> share_proxy_settings", true
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default -> ssl_port", 9050
FF Extension: (Adguard AdBlocker) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-15]
FF Extension: (Bloody Vikings!) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2017-01-09]
FF Extension: (MEGA) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2017-01-02]
FF Extension: (Google™ Translator) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-19]
FF Extension: (S3.Google Translator) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\[email protected] [2016-12-15]
FF Extension: (Video DownloadHelper) - C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2017-01-02]
FF ProfilePath: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default [2017-01-11]
FF DefaultSearchEngine: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> Google
FF SelectedSearchEngine: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> Google
FF Homepage: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> www.google.bg
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> backup.ssl_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ftp", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ftp_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> http", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> http_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> share_proxy_settings", true
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> socks", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> socks_port", 9050
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ssl", "127.0.0.1"
FF NetworkProxy: C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default -> ssl_port", 9050
FF Extension: (Adguard AdBlocker (Legacy)) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2016-12-22] [not signed]
FF Extension: (S3.Google Translator) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2016-11-07]
FF Extension: (1-Click YouTube Video Downloader) - C:\Documents and Settings\doni\Application Data\Moonchild Productions\Pale Moon\Profiles\p3bt4kaz.default\Extensions\[email protected] [2017-01-02]
FF ProfilePath: C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default [2017-01-11]
FF user.js: detected! => C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default\user.js [2006-04-06]
FF Homepage: C:\Documents and Settings\doni\Application Data\K-Meleon\puoi2cit.default -> www.google.bg
FF Extension: (NewsFox) - C:\Program Files\K-Meleon\browser\extensions\{899DF1F8-2F43-4394-8315-37F6744E6319}.xpi [2015-03-12] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2016-12-05] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_24_0_0_186.dll [2017-01-09] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50709.0\npctrl.dll [2016-07-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2008-11-13] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2008-09-10] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=3 -> C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2014-02-08] (Google Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=9 -> C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll [2014-02-08] (Google Inc.)
FF Plugin HKU\S-1-5-21-854245398-329068152-725345543-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\doni\Local Settings\Application Data\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin HKU\S-1-5-21-854245398-329068152-725345543-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\doni\Local Settings\Application Data\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.

R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2241992 2016-12-14] (ESET)
R2 Jotta VSS Service; C:\Program Files\Jotta\vss\jVSS.exe [102592 2016-12-12] ()
R2 MbaeSvc; C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe [155088 2016-12-14] (Malwarebytes Corporation)
S4 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 Unchecky; C:\Program Files\Unchecky\bin\unchecky_svc.exe [254232 2016-08-22] (RaMMicHaeL)
S2 ZAMSvc; "C:\Program Files\Zemana AntiMalware\ZAM.exe" /service [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 3FFF8A946; C:\WINDOWS\System32\drivers\3FFF8A946.sys [153784 2016-11-24] (Kaspersky Lab ZAO)
R1 AFS2K; C:\WINDOWS\system32\Drivers\AFS2K.sys [82380 2011-12-28] (Oak Technology Inc.)
R3 AIDA64Driver; D:\Важни Програми\AIDA64 Extreme Edition\aida64extreme580\kerneld.x32 [44176 2016-10-24] ()
S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 avfwim; C:\WINDOWS\System32\DRIVERS\avfwim.sys [92448 2013-01-22] (Avira GmbH)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [113544 2016-12-13] (ESET)
R1 ehdrv; C:\WINDOWS\System32\DRIVERS\ehdrv.sys [140984 2016-12-13] (ESET)
R1 ElbyCDIO; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
R1 epfwtdir; C:\WINDOWS\System32\DRIVERS\epfwtdir.sys [60992 2016-12-13] (ESET)
R1 ESProtectionDriver; C:\Program Files\Malwarebytes Anti-Exploit\mbae.sys [59968 2016-12-14] ()
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [51120 2005-03-08] (HP)
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2005-03-08] (HP)
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21744 2005-03-08] (HP)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [24448 2016-03-10] (Malwarebytes)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R3 RTHDMIAzAudService; C:\WINDOWS\System32\drivers\RtKHDMI.sys [3734976 2009-06-25] (Realtek Semiconductor Corp.)
R0 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [691696 2010-03-17] ()
R3 VComm; C:\WINDOWS\System32\DRIVERS\VComm.sys [34448 2011-05-28] (IVT Corporation.)
U3 awv3m4ts; C:\WINDOWS\system32\Drivers\awv3m4ts.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S3 BlueletAudio; system32\DRIVERS\blueletaudio.sys [X]
S3 BlueletSCOAudio; system32\DRIVERS\BlueletSCOAudio.sys [X]
S3 BT; system32\DRIVERS\btnetdrv.sys [X]
S3 Btcsrusb; System32\Drivers\btcusb.sys [X]
S3 BTHidEnum; system32\DRIVERS\vbtenum.sys [X]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [X]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [X]
S4 IntelIde; no ImagePath
S3 JL2005C; System32\Drivers\jl2005c.sys [X]
U5 P3; C:\Windows\System32\Drivers\P3.sys [42752 2008-04-14] (Microsoft Corporation)
U0 Partizan; system32\drivers\Partizan.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] ()
S3 VcommMgr; System32\Drivers\VcommMgr.sys [X]
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam32.sys [X]
S1 ZAM_Guard; \??\C:\WINDOWS\System32\drivers\zamguard32.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVC: SSHNAS -> no filepath.

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-11 10:45 - 2017-01-11 18:02 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Package Cache
2017-01-11 08:00 - 2017-01-11 08:00 - 00000000 ____D C:\Program Files\Slimjet
2017-01-11 08:00 - 2017-01-11 08:00 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\FlashPeak Slimjet
2017-01-10 21:45 - 2017-01-10 22:04 - 00000000 ____D C:\Documents and Settings\doni\Application Data\YoWindow
2017-01-10 21:45 - 2017-01-10 21:45 - 00000754 _____ C:\Documents and Settings\All Users\Desktop\YoWindow.lnk
2017-01-10 21:45 - 2017-01-10 21:45 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\YoWindow
2017-01-10 21:45 - 2017-01-10 21:45 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\YoWindow
2017-01-10 21:44 - 2017-01-10 21:45 - 00000000 ____D C:\Program Files\YoWindow
2017-01-09 12:11 - 2017-01-09 12:11 - 00000000 ____D C:\Documents and Settings\doni\Application Data\ESET
2017-01-09 11:57 - 2017-01-09 11:57 - 00802904 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2017-01-09 11:57 - 2017-01-09 11:57 - 00144472 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Program Files\ESET
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\ESET
2017-01-08 17:49 - 2017-01-08 17:49 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\ESET
2017-01-08 10:00 - 2017-01-08 10:00 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\GHISLER
2017-01-08 09:59 - 2017-01-08 10:00 - 00000000 ____D C:\totalcmd
2017-01-08 09:59 - 2017-01-08 09:59 - 00000548 _____ C:\Documents and Settings\doni\Desktop\Total Commander.lnk
2017-01-08 09:59 - 2017-01-08 09:59 - 00000000 ____D C:\Documents and Settings\doni\Start Menu\Programs\Total Commander
2017-01-08 09:59 - 2017-01-08 09:59 - 00000000 ____D C:\Documents and Settings\doni\Application Data\GHISLER
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\UC.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\RAR.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\PKZIP.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\PKUNZIP.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\LHA.PIF
2017-01-08 09:59 - 2016-12-14 09:00 - 00000545 _____ C:\WINDOWS\ARJ.PIF
2017-01-02 12:52 - 2017-01-08 17:09 - 00000000 ____D C:\Documents and Settings\doni\Application Data\vlc
2017-01-02 12:51 - 2017-01-02 12:51 - 00000000 ____D C:\Program Files\VideoLAN
2016-12-31 16:34 - 2016-12-31 16:34 - 00011450 _____ C:\WINDOWS\system32\PARTIZAN.TXT
2016-12-31 13:52 - 2016-12-31 13:21 - 00001617 _____ C:\Documents and Settings\doni\Desktop\Shortcut to Zemana AntiMalware.lnk
2016-12-29 17:03 - 2016-12-29 17:03 - 00000638 _____ C:\Documents and Settings\doni\Desktop\Jottacloud.lnk
2016-12-29 17:03 - 2016-12-29 17:03 - 00000000 ____D C:\Documents and Settings\doni\Application Data\Jotta
2016-12-29 17:03 - 2016-12-29 17:03 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Jottacloud
2016-12-20 19:22 - 2016-12-20 19:22 - 00078063 _____ C:\Documents and Settings\doni\My Documents\gr1.JPG
2016-12-20 11:20 - 2017-01-11 19:18 - 00013512 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2016-12-20 11:20 - 2017-01-11 19:17 - 00025315 _____ C:\WINDOWS\ZAM.krnl.trace
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Zemana
2016-12-19 19:34 - 2017-01-03 10:28 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Н
2016-12-19 19:28 - 2016-12-19 19:33 - 00000000 ____D C:\Documents and Settings\doni\My Documents\AA
2016-12-18 22:39 - 2016-12-20 14:44 - 00000000 ____D C:\Program Files\4shared Desktop
2016-12-18 22:39 - 2016-12-18 22:41 - 00000000 ____D C:\Documents and Settings\doni\Application Data\4shared Desktop
2016-12-18 22:39 - 2016-12-18 22:39 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\4shared Desktop
2016-12-18 15:16 - 2016-12-18 15:16 - 00000000 ____D C:\Documents and Settings\doni\My Documents\NOD051216
2016-12-13 19:34 - 2016-12-13 19:34 - 00000088 _____ C:\Documents and Settings\doni\My Documents\enablewsh.bat

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-11 21:23 - 2016-11-16 20:05 - 00000000 ____D C:\FRST
2017-01-11 21:23 - 2016-04-09 10:34 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Изтегляния
2017-01-11 21:23 - 2010-03-11 04:44 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Temp
2017-01-11 21:21 - 2015-12-17 15:00 - 00000406 ____C C:\WINDOWS\Tasks\Auslogics BoostSpeed Start BoostSpeed оn doni logon.job
2017-01-11 21:21 - 2012-09-14 20:40 - 00000982 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cd92a860a26e52.job
2017-01-11 21:21 - 2010-03-11 04:43 - 00000006 ___HC C:\WINDOWS\Tasks\SA.DAT
2017-01-11 21:20 - 2016-02-24 18:12 - 00032480 _____ C:\WINDOWS\SchedLgU.Txt
2017-01-11 21:20 - 2012-01-13 11:06 - 00000406 __RSH C:\Documents and Settings\All Users\ntuser.pol
2017-01-11 21:20 - 2010-03-11 06:25 - 00000000 ____D C:\Documents and Settings\All Users
2017-01-11 21:20 - 2010-03-11 04:44 - 00000278 __SHC C:\Documents and Settings\doni\ntuser.ini
2017-01-11 21:09 - 2016-11-04 07:53 - 00001074 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-329068152-725345543-1003UA.job
2017-01-11 20:34 - 2010-05-06 20:27 - 00000986 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2017-01-11 20:24 - 2014-02-08 17:19 - 00001098 ____C C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-18UA.job
2017-01-11 19:38 - 2010-03-11 04:44 - 00000000 ____D C:\Documents and Settings\doni
2017-01-11 19:27 - 2010-03-11 06:28 - 00005096 ____C C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-11 17:24 - 2014-02-08 17:19 - 00001046 ____C C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-18Core.job
2017-01-11 15:00 - 2015-12-17 15:00 - 00000632 ____C C:\WINDOWS\Tasks\Auslogics BoostSpeed Scan and Repair.job
2017-01-11 13:43 - 2014-11-30 22:25 - 00000000 ____D C:\AdwCleaner
2017-01-11 12:13 - 2016-11-16 11:53 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes Anti-Exploit
2017-01-11 11:09 - 2016-08-10 14:24 - 00000000 ____D C:\Documents and Settings\doni\My Documents\Загрузки
2017-01-10 21:18 - 2010-05-06 20:27 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Temp
2017-01-10 20:35 - 2015-03-27 20:14 - 00170200 ____C (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-01-09 11:57 - 2010-03-11 04:39 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-01-08 22:49 - 2010-03-17 21:49 - 00000000 ____D C:\Documents and Settings\doni\Application Data\Skype
2017-01-08 17:36 - 2010-03-11 06:21 - 00000000 ____D C:\WINDOWS\inf
2017-01-08 16:26 - 2015-06-17 09:43 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Unchecky
2017-01-08 16:18 - 2010-12-14 22:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\TEMP
2017-01-08 09:09 - 2016-11-04 07:53 - 00001022 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-854245398-329068152-725345543-1003Core.job
2017-01-06 06:43 - 2001-08-23 13:00 - 00002206 ____C C:\WINDOWS\system32\wpa.dbl
2017-01-03 19:37 - 2016-10-20 12:19 - 00000000 ____D C:\Program Files\Pale Moon
2017-01-02 12:50 - 2010-04-18 13:54 - 00000202 ____C C:\WINDOWS\NeroDigital.ini
2017-01-02 11:28 - 2016-11-09 16:07 - 00000000 ____D C:\Documents and Settings\doni\dwhelper
2016-12-31 16:43 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\doni\My Documents\RegRun2
2016-12-31 16:42 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RegRun
2016-12-31 14:06 - 2015-03-28 08:11 - 00000002 RSHOT C:\WINDOWS\winstart.bat
2016-12-31 14:06 - 2010-03-11 06:28 - 00001688 ____C C:\WINDOWS\system32\AUTOEXEC.NT
2016-12-31 14:06 - 2010-03-11 04:41 - 00002577 ____C C:\WINDOWS\system32\CONFIG.NT
2016-12-29 17:06 - 2016-12-03 10:31 - 00000671 _____ C:\Jottacloud.lnk
2016-12-29 17:06 - 2016-12-03 10:31 - 00000000 ___RD C:\Documents and Settings\doni\Jottacloud
2016-12-29 17:03 - 2016-12-03 10:26 - 00000000 ____D C:\Program Files\Jotta
2016-12-20 19:22 - 2010-03-11 04:44 - 00000000 ___RD C:\Documents and Settings\doni\My Documents
2016-12-20 19:09 - 2016-10-05 16:19 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Package Cache
2016-12-20 14:44 - 2010-03-11 06:21 - 00000000 ____D C:\WINDOWS\system32\Drivers\etc
2016-12-20 11:20 - 2010-03-11 04:43 - 00000000 ___HD C:\Documents and Settings\LocalService\Local Settings\Application Data
2016-12-19 19:30 - 2010-03-17 22:12 - 00040448 ____C C:\Documents and Settings\doni\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-12-18 20:34 - 2010-03-28 20:57 - 00000000 ____D C:\Documents and Settings\doni\Application Data\dvdcss
2016-12-17 10:23 - 2016-11-17 22:00 - 00000000 ____D C:\Program Files\Hard Disk Sentinel
2016-12-16 08:19 - 2015-01-29 21:42 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-12-16 00:55 - 2016-11-20 22:23 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Exploit
2016-12-16 00:55 - 2016-11-16 11:53 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Exploit
2016-12-15 18:20 - 2016-11-24 18:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-12-14 21:23 - 2016-10-30 23:52 - 00000680 _____ C:\Documents and Settings\doni\Desktop\Shortcut to CCleaner.exe.lnk
2016-12-13 17:11 - 2016-06-23 13:31 - 00140984 _____ (ESET) C:\WINDOWS\system32\Drivers\ehdrv.sys
2016-12-13 17:11 - 2016-06-23 13:31 - 00113544 _____ (ESET) C:\WINDOWS\system32\Drivers\eamonm.sys
2016-12-13 17:11 - 2016-06-23 13:31 - 00060992 _____ (ESET) C:\WINDOWS\system32\Drivers\epfwtdir.sys
2016-12-12 20:45 - 2015-12-17 22:57 - 00000000 ____D C:\Program Files\Process Lasso
2016-12-12 20:45 - 2015-12-17 15:49 - 00000000 ____D C:\Documents and Settings\doni\Application Data\ProcessLasso

==================== Files in the root of some directories =======

2010-04-06 23:40 - 2010-04-06 23:40 - 0081920 ____C () C:\Documents and Settings\doni\Application Data\ezpinst.exe
2010-04-06 23:40 - 2010-04-06 23:40 - 0007176 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.cat
2010-04-06 23:40 - 2010-04-06 23:40 - 0001144 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.inf
2010-04-06 23:40 - 2010-04-06 23:40 - 0000034 ____C () C:\Documents and Settings\doni\Application Data\pcouffin.log
2010-04-06 23:40 - 2010-04-06 23:40 - 0047360 ____C (VSO Software) C:\Documents and Settings\doni\Application Data\pcouffin.sys
2010-03-17 22:12 - 2016-12-19 19:30 - 0040448 ____C () C:\Documents and Settings\doni\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-03-22 10:24 - 2010-03-22 10:24 - 0000127 ____C () C:\Documents and Settings\doni\Local Settings\Application Data\fusioncache.dat
2012-03-06 10:56 - 2016-11-11 06:28 - 0000043 __SHC () C:\Documents and Settings\All Users\Application Data\.zreglib
2016-10-05 16:19 - 2016-10-05 16:19 - 0000232 _____ () C:\Documents and Settings\All Users\Application Data\fontcacheev1.dat
2010-03-22 10:05 - 2012-02-06 14:13 - 0014995 ____C () C:\Documents and Settings\All Users\Application Data\hpzinstall.log

Files to move or delete:
====================
C:\Documents and Settings\doni\TempWmicBatchFile.bat

Some zero byte size files/folders:
==========================
C:\Windows\mansk.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => MD5 is legit
C:\WINDOWS\system32\winlogon.exe => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit
C:\WINDOWS\system32\User32.dll => MD5 is legit
C:\WINDOWS\system32\userinit.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\dnsapi.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\volsnap.sys => MD5 is legit

==================== End of FRST.txt ============================

Addition.txt

Така...готов съм със скрипта, но преди него искам да обсъдим още 2 неща.

1. Предполагам вие сте добавили proxy настройките в Mozilla и затова няма да ги трия?

2. Освен CryptoPrevent, вие използвате ОЩЕ ЕДНА ПОДОБНА ДУБЛИРАЩА се програма в лицето на FixRun. Премахнете защитата добавена от програмата и рестартирайте и вижте дали сега JRT тръгва и дали Vivaldi вече се инсталира успешно.

Иначе видях и причината за появата на грешката от снимка номер 2 - това е планираната задача добавена от Auslogics:

Task: C:\WINDOWS\Tasks\Auslogics BoostSpeed Scan and Repair.job => rundll32 exe FTaskSchedulerHelper dll RunTask BoostSpeed exe

Ще я премахнем и това трябва да реши този проблем.

Поздрави!

1) Да,аз,но и да ги изтриете не е проблем .

2) Проблем е,че не мога да намеря тоя FixRun,ако се дублират програмите,изтрийте я !

 

И чакам следващите стъпки .

Не мисля, че проблема е в изтриването и, а че приложените защити от нея ще останат активни. Просто я изтеглете наново и ако отметките са включени ги махнете:

http://safezone.cc/resources/fixrun-fixsecurity-zaschita-ot-shifrovalschikov.196/

След това изтеглете fixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Вижте дали проблемите остават/.

Поздрави!

FixRun го инсталнах без нито една отметка. Да попитам,нея ли да оставя с отметки или да си остане CryptoPrevent.

 

JRT се оправи,но Вивалди не иска да се инсталне и излиза същата грешка .

 

Заповядай:

Fix result of Farbar Recovery Scan Tool (x86) Version: 11-01-2017
Ran by doni (11-01-2017 22:54:52) Run:1
Running from C:\Documents and Settings\doni\My Documents\Изтегляния
Loaded Profiles: doni (Available Profiles: doni)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
AV: Avira Desktop (Enabled - Out of date) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
AV: Avira Desktop (Enabled - Up to date) {11638345-E4FC-4BEE-BB73-EC754659C5F6}
HKLM Group Policy restriction on software: %TEMP%\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\8z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\Rar*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\_tc\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\wz*\ <====== ATTENTION
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\7z*\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\*.zip\ <====== ATTENTION
HKLM Group Policy restriction on software: %TEMP%\8z*\ <====== ATTENTION
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
ShellIconOverlayIdentifiers: [  MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll -> No File
GroupPolicy: Restriction ? <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {3A40E547-20FD-44a2-94D0-1C98342D1507} URL = hxxp://search.daum.net/search?nil_profile=ie&ref_code=ms&q={searchTerms}
SearchScopes: HKU\S-1-5-21-854245398-329068152-725345543-1003 -> {AD43A510-0817-11DE-A4D6-59A755D89593} URL = hxxp://search.yahoo.com/search?ei=utf-8&fr=bfg&q={searchTerms}
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} -  No File
R0 3FFF8A946; C:\WINDOWS\System32\drivers\3FFF8A946.sys [153784 2016-11-24] (Kaspersky Lab ZAO)
C:\WINDOWS\System32\drivers\3FFF8A946.sys
R3 avfwim; C:\WINDOWS\System32\DRIVERS\avfwim.sys [92448 2013-01-22] (Avira GmbH)
C:\WINDOWS\System32\DRIVERS\avfwim.sys
U0 Partizan; system32\drivers\Partizan.sys [X]
S2 ZAMSvc; "C:\Program Files\Zemana AntiMalware\ZAM.exe" /service [X]
S1 ZAM; \??\C:\WINDOWS\System32\drivers\zam32.sys [X]
S1 ZAM_Guard; \??\C:\WINDOWS\System32\drivers\zamguard32.sys [X]
cmd: type "C:\WINDOWS\system32\PARTIZAN.TXT"
2016-12-31 16:34 - 2016-12-31 16:34 - 00011450 _____ C:\WINDOWS\system32\PARTIZAN.TXT
2016-12-31 13:52 - 2016-12-31 13:21 - 00001617 _____ C:\Documents and Settings\doni\Desktop\Shortcut to Zemana AntiMalware.lnk
2016-12-20 11:20 - 2017-01-11 19:18 - 00013512 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2016-12-20 11:20 - 2017-01-11 19:17 - 00025315 _____ C:\WINDOWS\ZAM.krnl.trace
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana
2016-12-20 11:20 - 2016-12-20 11:20 - 00000000 ____D C:\Documents and Settings\doni\Local Settings\Application Data\Zemana
2017-01-11 13:43 - 2014-11-30 22:25 - 00000000 ____D C:\AdwCleaner
ListPermissions: C:\Documents and Settings\doni\Local Settings\Application Data\Temp
Unlock: C:\Documents and Settings\doni\Local Settings\Application Data\Temp
2016-12-31 16:43 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\doni\My Documents\RegRun2
2016-12-31 16:42 - 2015-03-28 08:11 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RegRun
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{04EBE69E-2DED-44F6-9854-9A3988F751ED}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> no filepath
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{64A9418A-B6B1-4112-B75C-E61633C9A31F}\InprocServer32 -> C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll => No File
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{6775BBF1-8D9D-4D14-A999-4E78DF8DCEC6}\InprocServer32 -> C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll => No File
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{6A2E142B-EA63-433A-AC05-5223CBD26E65}\InprocServer32 -> C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll => No File
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{6AFCC535-2F12-4F50-9F0A-1CF856CFC95D}\InprocServer32 -> C:\DOCUME~1\doni\LOCALS~1\Temp\mcse32_00.dll => No File
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}\localserver32 -> no filepath
CustomCLSID: HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{E7A37920-253C-4FF1-B169-298A7CE6CAA9}\localserver32 -> no filepath
Task: C:\WINDOWS\Tasks\Auslogics BoostSpeed Scan and Repair.job => rundll32 exe FTaskSchedulerHelper dll RunTask BoostSpeed exe
Task: C:\WINDOWS\Tasks\Auslogics BoostSpeed Start BoostSpeed оn doni logon.job => C:\Program Files\Auslogics\Auslogics BoostSpeed\BoostSpeed.exe
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B [308]
AlternateDataStreams: C:\Documents and Settings\All Users\Application Data\TEMP:1CE11B51 [188]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\3FFF8A946.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\41512932.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\47594798.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\3FFF8A946.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\41512932.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\47594798.sys => ""="Driver"
MSCONFIG\startupreg: MCShield Monitor => C:\Program Files\MCShield\mcshieldrtm.exe
MSCONFIG\startupreg: UnHackMe Monitor => C:\Program Files\UnHackMe\hackmon.exe
MSCONFIG\startupreg: ZAM => "C:\Program Files\Zemana AntiMalware\ZAM.exe" /minimized
CMD: winmgmt /resyncperf
CMD: lodctr /R
CMD: reg query hkcu\Environment
CMD: reg query "hklm\system\currentcontrolset\control\session manager\environment"
CMD: reg query hklm\SOFTWARE\Microsoft\Windows\CurrentVersion
cmd: del %temp%\*.* /f /s /q
cmd: rd /s /q %temp%
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
AV: Avira Desktop (Enabled - Out of date) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE} => removed successfully.
AV: Avira Desktop (Enabled - Up to date) {11638345-E4FC-4BEE-BB73-EC754659C5F6} => removed successfully.
HKLM Group Policy restriction on software: %TEMP%\wz*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\8z*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\*.zip\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %TEMP%\_tc\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %TEMP%\7z*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %TEMP%\Rar*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\Rar*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\_tc\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\wz*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %UserProfile%\Local Settings\Temp\7z*\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %TEMP%\*.zip\ <====== ATTENTION => restored successfully
HKLM Group Policy restriction on software: %TEMP%\8z*\ <====== ATTENTION => restored successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\  MailRuCloudIconOverlay0 => key removed successfully.
HKCR\CLSID\{64A9418A-B6B1-4112-B75C-E61633C9A31F} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\  MailRuCloudIconOverlay1 => key removed successfully.
HKCR\CLSID\{6A2E142B-EA63-433A-AC05-5223CBD26E65} => key not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\  MailRuCloudIconOverlay2 => key removed successfully.
HKCR\CLSID\{6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => key not found.
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3A40E547-20FD-44a2-94D0-1C98342D1507} => key removed successfully.
HKCR\CLSID\{3A40E547-20FD-44a2-94D0-1C98342D1507} => key not found.
HKU\S-1-5-21-854245398-329068152-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AD43A510-0817-11DE-A4D6-59A755D89593} => key removed successfully.
HKCR\CLSID\{AD43A510-0817-11DE-A4D6-59A755D89593} => key not found.
HKCR\PROTOCOLS\Handler\livecall => key not found.
HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => key not found.
HKCR\PROTOCOLS\Handler\msnim => key not found.
HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => key not found.
HKCR\PROTOCOLS\Handler\wlmailhtml => key not found.
HKCR\CLSID\{03C514A3-1EFB-4856-9F99-10D7BE1653C0} => key not found.
3FFF8A946 => Unable to stop service.
HKLM\System\CurrentControlSet\Services\3FFF8A946 => key removed successfully.
3FFF8A946 => service removed successfully.
C:\WINDOWS\System32\drivers\3FFF8A946.sys => moved successfully
avfwim => Unable to stop service.
HKLM\System\CurrentControlSet\Services\avfwim => key removed successfully.
avfwim => service removed successfully.
C:\WINDOWS\System32\DRIVERS\avfwim.sys => moved successfully
HKLM\System\CurrentControlSet\Services\Partizan => key removed successfully.
Partizan => service removed successfully.
HKLM\System\CurrentControlSet\Services\ZAMSvc => key removed successfully.
ZAMSvc => service removed successfully.
HKLM\System\CurrentControlSet\Services\ZAM => key removed successfully.
ZAM => service removed successfully.
HKLM\System\CurrentControlSet\Services\ZAM_Guard => key removed successfully.
ZAM_Guard => service removed successfully.

========= type "C:\WINDOWS\system32\PARTIZAN.TXT" =========

Partizan 2.1 started.
Day: 31. Month:12.2016 Time (GMT +0):14:34:32
Windows Version:5.1 Build:2600
Partizan driver is active.

Opening command file: SUCCESS.

Safe deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}

Checking file existence...

Confirmed. File exists.

Safe deleting is OFF. Continue to full delete file.

ReSetFileRights started.

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}

It is a directory!
ListDirectory:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
NtCreateFile passed

RtlAllocateHeap passed

Entry...

Entry...

Entry...

Deleting file in folder:

chrome

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\chrome

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

chrome.manifest

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\chrome.manifest

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

defaults

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\defaults

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

EULA.txt

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\EULA.txt

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

icon.png

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\icon.png

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

install.rdf

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\install.rdf

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

META-INF

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\META-INF

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

modules

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\modules

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Entry...

Entry...

Deleting file in folder:

chrome

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\chrome

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

chrome.manifest

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\chrome.manifest

Doesn't exist

Entry...

Deleting file in folder:

defaults

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\defaults

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

EULA.txt

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\EULA.txt

Doesn't exist

Entry...

Deleting file in folder:

icon.png

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\icon.png

Doesn't exist

Entry...

Deleting file in folder:

install.rdf

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\install.rdf

Doesn't exist

Entry...

Deleting file in folder:

META-INF

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\META-INF

Reset file attributes: SUCCESS.

Delete: SUCCESS.
Entry...

Deleting file in folder:

modules

 

Deleting file:

\??\C:\Documents and Settings\doni\Application Data\Mozilla\Firefox\Profiles\k5gfurjn.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}\modules

Reset file attributes: SUCCESS.

Delete: SUCCESS.

Reset file attributes: SUCCESS.

Delete: SUCCESS.

Safe deleting file:

\??\C:\DOCUMENTS AND SETTINGS\DONI\LOCAL SETTINGS\APPLICATION DATA\PACKAGEAWARE

Checking file existence...

File doesn't exist.

- Doesn't exist.

Safe deleting file:

\??\C:\DOCUMENTS AND SETTINGS\DONI\APPLICATION DATA\DOWNLOAD MASTER

Checking file existence...

File doesn't exist.

- Doesn't exist.

Deleting file:

\??\C:\WINDOWS\system32\Partizan.RRI

========= End of CMD: =========

C:\WINDOWS\system32\PARTIZAN.TXT => moved successfully
C:\Documents and Settings\doni\Desktop\Shortcut to Zemana AntiMalware.lnk => moved successfully
C:\WINDOWS\ZAM_Guard.krnl.trace => moved successfully
C:\WINDOWS\ZAM.krnl.trace => moved successfully
C:\Documents and Settings\LocalService\Local Settings\Application Data\Zemana => moved successfully
C:\Documents and Settings\doni\Local Settings\Application Data\Zemana => moved successfully
C:\AdwCleaner => moved successfully
===================================
permissions of "C:\Documents and Settings\doni\Local Settings\Application Data\Temp":

Owner: AMD\doni

DACL(NP):

AMD\doni    ALLOW    FULL    (I)
AMD\doni    ALLOW    FULL    (OI-CI-I-OI)
NT AUTHORITY\SYSTEM    ALLOW    FULL    (I)
NT AUTHORITY\SYSTEM    ALLOW    FULL    (OI-CI-I-OI)
BUILTIN\Administrators    ALLOW    FULL    (I)
BUILTIN\Administrators    ALLOW    FULL    (OI-CI-I-OI)

===================================
"C:\Documents and Settings\doni\Local Settings\Application Data\Temp" => was unlocked
C:\Documents and Settings\doni\My Documents\RegRun2 => moved successfully
C:\Documents and Settings\All Users\Application Data\RegRun => moved successfully
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{04EBE69E-2DED-44F6-9854-9A3988F751ED} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{64A9418A-B6B1-4112-B75C-E61633C9A31F} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{6775BBF1-8D9D-4D14-A999-4E78DF8DCEC6} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{6A2E142B-EA63-433A-AC05-5223CBD26E65} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6} => key removed successfully.
HKU\S-1-5-21-854245398-329068152-725345543-1003_Classes\CLSID\{E7A37920-253C-4FF1-B169-298A7CE6CAA9} => key removed successfully.
C:\WINDOWS\Tasks\Auslogics BoostSpeed Scan and Repair.job => moved successfully
C:\WINDOWS\Tasks\Auslogics BoostSpeed Start BoostSpeed оn doni logon.job => moved successfully
C:\Documents and Settings\All Users\Application Data\TEMP => ":07BF512B" ADS removed successfully..
C:\Documents and Settings\All Users\Application Data\TEMP => ":1CE11B51" ADS removed successfully..
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\3FFF8A946.sys => key removed successfully.
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\41512932.sys => key removed successfully.
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\47594798.sys => key removed successfully.
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\3FFF8A946.sys => key removed successfully.
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\41512932.sys => key removed successfully.
HKLM\System\CurrentControlSet\Control\SafeBoot\Network\47594798.sys => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MCShield Monitor => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UnHackMe Monitor => key removed successfully.
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZAM => key removed successfully.

========= winmgmt /resyncperf =========

========= End of CMD: =========

========= lodctr /R =========

 

LODCTR
    Updates Performance Monitor counter names and explain text for an extensible counter

Usage:
    LODCTR [\\computername] filename
        computername is the name of the remote computer.
            Local machine is used if computername is not specified.
        filename is the name of the initialization file that contains
            the counter name definitions and explain text for an extensible
            counter DLL.

    LODCTR /S:<FileName>
        save current perf registry strings and info to <FileName>

    LODCTR /R:<FileName>
        restore perf registry strings and info using <FileName>

Note: any arguments with spaces in the names must be enclosed within
Double Quotation marks.

========= End of CMD: =========

========= reg query hkcu\Environment =========

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\Local Settings\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\Local Settings\Temp

========= End of CMD: =========

========= reg query "hklm\system\currentcontrolset\control\session manager\environment" =========

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\environment
    ComSpec    REG_EXPAND_SZ    %SystemRoot%\system32\cmd.exe
    FP_NO_HOST_CHECK    REG_SZ    NO
    NUMBER_OF_PROCESSORS    REG_SZ    2
    OS    REG_SZ    Windows_NT
    Path    REG_EXPAND_SZ    %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Common Files\Adobe\AGL;C:\WINDOWS\system32\WindowsPowerShell\v1.0;C:\Program Files\Skype\Phone\;C:\Program Files\Process Lasso
    PATHEXT    REG_SZ    .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.PSC1
    PROCESSOR_ARCHITECTURE    REG_SZ    x86
    PROCESSOR_IDENTIFIER    REG_SZ    x86 Family 16 Model 6 Stepping 2, AuthenticAMD
    PROCESSOR_LEVEL    REG_SZ    16
    PROCESSOR_REVISION    REG_SZ    0602
    TEMP    REG_EXPAND_SZ    %SystemRoot%\TEMP
    TMP    REG_EXPAND_SZ    %SystemRoot%\TEMP
    windir    REG_EXPAND_SZ    %SystemRoot%
    ProgramData    REG_SZ    C:\Documents and Settings\All Users\Application Data

========= End of CMD: =========

========= reg query hklm\SOFTWARE\Microsoft\Windows\CurrentVersion =========

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    DevicePath    REG_EXPAND_SZ    %SystemRoot%\NLDRV\002;%SystemRoot%\NLDRV\001;%SystemRoot%\inf;C:\Program Files\Samsung\USB Drivers\01_Simmental;C:\Program Files\Samsung\USB Drivers\02_Siberian;C:\Program Files\Samsung\USB Drivers\03_Swallowtail;C:\Program Files\Samsung\USB Drivers\04_semseyite;C:\Program Files\Samsung\USB Drivers\07_Schorl;C:\Program Files\Samsung\USB Drivers\09_Hsp;C:\Program Files\Samsung\USB Drivers\11_HSP_Plus_Default;C:\Program Files\Samsung\USB Drivers\16_Shrewsbury;C:\Program Files\Samsung\USB Drivers\20_NXP_Driver;C:\Program Files\Samsung\USB Drivers\24_flashusbdriver;C:\Program Files\Samsung\USB Drivers\25_escape
    MediaPathUnexpanded    REG_EXPAND_SZ    %SystemRoot%\Media
    SM_GamesName    REG_SZ    Games
    SM_ConfigureProgramsName    REG_SZ    Set Program Access and Defaults
    ProgramFilesDir    REG_SZ    C:\Program Files
    CommonFilesDir    REG_SZ    C:\Program Files\Common Files
    ProductId    REG_SZ    55274-640-8201073-23071
    WallPaperDir    REG_EXPAND_SZ    %SystemRoot%\Web\Wallpaper
    MediaPath    REG_SZ    C:\WINDOWS\Media
    ProgramFilesPath    REG_EXPAND_SZ    %ProgramFiles%
    SM_AccessoriesName    REG_SZ    Accessories
    PF_AccessoriesName    REG_SZ    Accessories
    SM_ConfigureProgramsExisted    REG_DWORD    0x1
    EPIC_NAME    REG_SZ    J Tao

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Controls Folder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CSCSettings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DIFx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DIFxApp

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Dynamic Directory

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\H323TSP

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\IPConfTSP

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MCD

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MS-DOS Emulation

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MSSHA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Nls

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PhotoPropertyHandler

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PreviewHandlers

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reinstall

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run_Hidden

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellScrap

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SMDEn

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\StillImage

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Syncmgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Unimodem

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WebCheck

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wordpad

========= End of CMD: =========

========= del %temp%\*.* /f /s /q =========

Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\AIDA64Driver.sys
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\news.ini
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\tmpsafeb
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_appinit.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_chrext.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_chrstrg.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_ffext.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_ffplugin.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_ffxml.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_ffxpi.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_foldersC.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_foldersM.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_foldersS.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_lnkfiles.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_lnkurls.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_services.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_tasks.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_urls.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\bl_values.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\clean_shortcut.vbs
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\CreateRestorePoint.exe
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\CUT.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\get.bat
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\GREP.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\jrtcurrentmd5
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\jrtnewmd5
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\libiconv2.dll
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\libintl3.dll
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\NIRCMD.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\null
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\pcre3.dll
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\regex2.dll
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\SED.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\SHORTCUT.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\SORT_.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\WGET.DAT
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\wl_bhos.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\wl_firefox.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\wl_processes.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\wl_services.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\wl_tasks.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\wl_toolbars.cfg
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\GNU utilities for Win32.url
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\grep-2.5.4-GnuWin32.README
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\NirCmd.chm
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\nircmdc.exe
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\sed-4.2.1-GnuWin32.README
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\sed.txt
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\shortcut.txt
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\wget-1.11.4-1-GnuWin32.README
Deleted file - C:\DOCUME~1\doni\LOCALS~1\Temp\jrt\nfo\wget.txt

========= End of CMD: =========

========= rd /s /q %temp% =========

========= End of CMD: =========

========= bitsadmin /reset /allusers =========

'bitsadmin' is not recognized as an internal or external command,
operable program or batch file.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the machine in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 15130 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache => 57898 B
Java, Flash, Steam htmlcache => 854 B
Windows/system/dllcache/drivers => 472 B
Edge => 0 B
Chrome => 0 B
Firefox => 28340004 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Documents and Settings => 0 B
Default User => 16610 B
All Users => 0 B
systemprofile => 82146 B
LocalService => 131700 B
NetworkService => 33396 B
doni => 115200 B

RecycleBin => 110013 B
EmptyTemp: => 27.6 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 22:55:37 ====

преди 4 минути, j_d написа:

FixRun го инсталнах без нито една отметка. Да попитам,нея ли да оставя с отметки или да си остане CryptoPrevent.

JRT се оправи,но Вивалди не иска да се инсталне и излиза същата грешка .

А другата грешка от снимка номер 2 появява ли се още? Ако не, значи сме оправили две неща и остава само последното - Vivaldi.

Коя версия инсталирате? Гледам на сайта им, че новите версии не поддържат Windows XP. Тази е последната за Windows XP и Vista:

https://downloads.vivaldi.com/stable/Vivaldi.1.0.435.46.exe

Колкото до FixRun или CryptoPrevent не мога да кажа със сигурност, защото не съм се занимавал много с FixRun, но знам, че някои от защитите (като правилата в SRP - Software Restriction Policies) се припокриват. Аз бих оставил CryptoPrevent (но и двата инструмента са основно за напреднали потребители). Това е и пасивна защита и не недостатъчна срещу модерните криптиращи бацили. Трябва допълнително подпомагане. Ако сте начинаещ потребител аз бих махнал и двете програми и бих се насочил към някоя, която е автоматично ефективна като инструмента на Kaspersky. WinAntiRansom е може би една от най-добрите в своята област, но е платена. От безплатните добра комбинация предлага пясъчника на Comodo Firewall 10 + антивирусната на 360 Total Security с включена опция за защита от Ransomware.

Поздрави!

Вивалди, с правилната версия(вашата) за Win Xp се инстална без проблем,а когато се мъчиш с версия която не е за Win Xp няма как да стане.

Грешка от снимка номер 2 не се е появявала за сега. Ако се появи пак,ще пиша тук.

Ще оставя CryptoPrevent засега.

Относно разяснението за защитата от крипто вирусите,благодаря .

Разчистихме ли системата от разните остатъци от предни програми?

Чакам следващата стъпка.

Извинявам се за късния отговор,но може и утре да продължим,ако има още нещо да се прави.

Благодаря.

 

 

Ами мисля, че сме готови. Решихме и 3-те проблема (тези от 2-те снимки) + JRT. Разчистихме и остатъците от старите антивирусни програми и други защитни продукти и други нещица, които не им бе там мястото.

Можете да погледнете следните финални инструкции и да приложите САМО ТЕЗИ, които сметнете за подходящи за вашата система и познания (не е необходимо да следвате всички съвети дадени в този пост):

Ако нямате повече въпроси и проблеми ще маркирам случая като решен!

Поздрави и лека вечер!

 Георги(B-boy/Style/),благодаря ти

 

и в твое лице, и на целия Kaldata HJT Team.

Живи и здрави да сте  и всичките Ние покрай Вас

и все така всеотдайни и готови да помогнете на всеки .

Благодаря !

Благодаря ви за пожеланията. Да ви се връщат!

А иначе внимавайте просто с броя и вида на защитните продукти, защото понякога могат да причинят повече проблеми от зловреден софтуер, ако не знаете какво и как да комбинирате.

Въздържайте се и от употребата на програми за оптимизация на Windows от рода на BoostSpeed и други механици отново ако не сте наясно с това как работят.

Лек и усмихнат ден!