Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Заразена система - Advert Bot

evolution13
в Премахване на зловреден софтуер

Featured Replies

Здравейте, проблема ми е следния, всеки път като отварям google chrome ми зарежда страница startingpage123, изтрих всичко от търсещата машина на хрома, със ccleaner, изтрих регистри, настройки всичко, резултата е пак същия. От онлайн сканера на нод32 ми открива над 10000 заплахи. Надявам се на вашата помощ. Компютърът е стар, с windows xp.

  

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-03-2017
Ran by PC1 (administrator) on PC (17-03-2017 22:41:53)
Running from C:\Documents and Settings\PC1\Desktop
Loaded Profiles: PC1 (Available Profiles: User & PC1 & Администратор)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 6 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Don HO [email protected]) C:\Program Files\NOTEPAD2\NOTEPAD2.EXE
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(Transaction Software, D 81737 Munich) C:\BMWgroup\ETKLokal\transbase\TBMUX32.EXE
(Transaction Software, D 81829 Munich) C:\TECDOC_CD\1_2014\DB\TBMUX32.EXE
(Microsoft Corporation) C:\WINDOWS\System32\RUNDLL32.EXE
(Wondershare) C:\Program Files\Wondershare\WAF\2.3.2.220\WsAppService.exe
(Intel Corporation) C:\WINDOWS\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe
() C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\RunOnce: [svg_file_op1] => C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe [20480 2005-04-14] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [svg_file_op2] => C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe [20480 2005-04-14] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [svg_file_op3] => C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe [114688 2005-04-14] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [svg_file_op4] => C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe [20480 2005-04-14] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [svg_file_op5] => C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe [20480 2005-04-14] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [svg_file_op6] => C:\WINDOWS\system32\cmd.exe /D /Q /C del /F /Q "C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\FileOps.exe"
HKLM\...\RunOnce: [svg_file_op7] => C:\WINDOWS\system32\cmd.exe /D /Q /C rd /S /Q "C:\Program Files\Common Files\Adobe\SVG Viewer 3.0"
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2009-04-28] (ATI Technologies Inc.)
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\...\MountPoints2: {6e375684-0442-11e7-b8de-001a4d3d40c3} - G:\LG_PC_Programs.exe
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\...\MountPoints2: {9c41f680-fd92-11e6-b8d5-001a4d3d40c3} - G:\Lenovo_Suite.exe
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\...\MountPoints2: {a57bb390-ae90-11e6-b85a-00d0b79fc3e1} - G:\setup.exe
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\...\MountPoints2: {f8798756-d1cd-11e6-b88d-001a4d3d40c3} - G:\HiSuiteDownLoader.exe
IFEO\MRT.exe: [Debugger] c:\documents and settings\all users\application data\winsapsvc\winsap_update\Gubed.exe -Yrrehs
Lsa: [Authentication Packages] msv1_0 relog_ap
ShellExecuteHooks: No Name - {37CC27DA-A680-11E6-9307-64006A5CFC23} - C:\Documents and Settings\User\Application Data\Zersingbuzich\Wowertherpluqther.dll [124928 2016-11-19] ()
GroupPolicy: Restriction ? <======= ATTENTION
GroupPolicy\User: Restriction ? <======= ATTENTION
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{5AC8EF46-9229-49FA-92FF-23AD8F87982F}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{64CC1445-6DD8-477F-AC63-27D04CBBAB72}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9297E25E-6D28-43E9-A571-67CD34EAB846}: [DhcpNameServer] 212.116.136.2 212.116.128.2
Tcpip\..\Interfaces\{A6432B32-7C78-41ED-8395-4B422A1F4093}: [DhcpNameServer] 78.90.243.1
Tcpip\..\Interfaces\{D8CA88C5-A524-4415-B4F7-297C44F1FEFE}: [NameServer] 192.168.1.1
Tcpip\..\Interfaces\{DAAA9331-263C-4050-BFE8-6DB045A68006}: [DhcpNameServer] 78.90.243.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1481184912&z=a500b68b039a89dcb7da2cegfzbb3g0g3b7zab3e4z&from=archer1028&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1480587051&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=che0812&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1481184912&z=a500b68b039a89dcb7da2cegfzbb3g0g3b7zab3e4z&from=archer1028&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1480587051&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=che0812&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1480587051&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=che0812&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285&q={searchTerms}
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1480587051&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=che0812&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1480587051&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=che0812&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285
HKU\S-1-5-21-1454471165-1677128483-1644491937-1006\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1480587051&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=che0812&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285&q={searchTerms}
URLSearchHook: HKU\S-1-5-21-1454471165-1677128483-1644491937-1006 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "" <======= ATTENTION
SearchScopes: HKLM -> DefaultScope value is missing
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> No File
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-12] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
StartMenuInternet: IEXPLORE.EXE - c:\program files\internet explorer\iexplore.exe hxxp://www.startpageing123.com/?type=sc&ts=1489483749&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=nhe1&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285

FireFox:
========
FF DefaultProfile: 0xe3j81n.default
FF ProfilePath: C:\Documents and Settings\PC1\Application Data\Firefox\Firefox\Profiles\0xe3j81n.default [2016-12-21]
FF Extension: (English (US) Language Pack) - C:\Documents and Settings\PC1\Application Data\Firefox\Firefox\Profiles\0xe3j81n.default\Extensions\[email protected] [2016-12-28] [not signed]
FF Extension: (FF Adr) - C:\Documents and Settings\PC1\Application Data\Firefox\Firefox\Profiles\0xe3j81n.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2016-12-30] [not signed]
FF Extension: (SimilarWeb) - C:\Documents and Settings\PC1\Application Data\Firefox\Firefox\Profiles\0xe3j81n.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2016-12-30] [not signed]
FF HKLM\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird => not found
FF Plugin: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-22] (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2007-11-07] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-11-09] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-11-09] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2008-06-11] (Adobe Systems Inc.)
StartMenuInternet: Firefox.exe - c:\program files\firefox\firefox.exe hxxp://www.startpageing123.com/?type=sc&ts=1489483749&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=nhe1&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> inline.go.mail.ru/homepage?inline_comp=hp&inline_hp_cnt=21071633
CHR StartupUrls: Default -> "hxxp://google.bg/"
CHR Profile: C:\Documents and Settings\PC1\Local Settings\Application Data\Google\Chrome\User Data\Default [2013-10-30]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Documents and Settings\PC1\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-30]
CHR Extension: (Adblock Plus) - C:\Documents and Settings\PC1\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-12-02]
CHR Profile: C:\Documents and Settings\PC1\Local Settings\Application Data\Google\Chrome\User Data\System Profile [2017-01-07]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx <not found>
CHR HKLM\...\Chrome\Extension: [odijcgafkhpobjlnfdgiacpdenpmbgme] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [phkdcinmmljblpnkohlipaiodlonpinf] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [pmpoaahleccaibbhfjfimigepmfmmbbk] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: chrome.exe - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
StartMenuInternet: Google Chrome - c:\program files\google\chrome\application\chrome.exe hxxp://www.startpageing123.com/?type=sc&ts=1489483749&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=nhe1&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285

Opera: 
=======
StartMenuInternet: (HKLM) OperaStable - c:\program files\opera\launcher.exe hxxp://www.startpageing123.com/?type=sc&ts=1489483749&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=nhe1&uid=WDCXWD3200AAKS-00B3A0_WD-WCAT1002628526285

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [456032 2009-11-05] (Acronis)
R2 Archer; C:\Program Files\WinArcher\Archer.dll [760320 2017-02-10] () [File not signed]
S4 ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [593920 2009-04-27] () [File not signed]
S4 bilibili; C:\Program Files\bilibili\bilibili.dll [127488 2017-02-14] () [File not signed]
S4 FirefoxU; C:\Program Files\Firefox\bin\FirefoxUpdate.exe [110256 2016-12-28] ()
R4 Gretingfomesp; C:\Program Files\Drcich\rdsserver.dll [275968 2016-11-19] () [File not signed]
S4 GubedZL; C:\Program Files\Gubed\GubedZL.dll [118272 2017-02-05] () [File not signed]
S4 Gubed_WMI; C:\Program Files\Gubed_WMI\Gubed_WMI.exe [109056 2016-12-23] () [File not signed] <==== ATTENTION
S4 GubZL; C:\Program Files\Gub\GubZL.dll [122880 2017-02-10] () [File not signed]
S3 idsvc; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [864256 2007-10-11] (Microsoft Corporation) [File not signed]
S4 iThemes5; C:\Program Files\Common Files\Services\iThemes.dll [459264 2017-02-14] () [File not signed] <==== ATTENTION
S4 Kyubey; C:\Documents and Settings\PC1\Application Data\Kyubey\Kyubey.exe [113152 2017-03-17] () [File not signed]
R4 Ntp2NetSvc; C:\Program Files\notepad2\notepad2.exe [2340864 2017-02-16] (Don HO [email protected]) [File not signed]
S4 Ntp2UpSvc; C:\Program Files\Common Files\ntp2UpSvc\notepad2.exe [2340864 2017-02-16] (Don HO [email protected]) [File not signed]
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10351856 2016-12-15] (TeamViewer GmbH)
R2 Transbase; C:\BMWgroup\ETKLokal\transbase\tbmux32.exe [385024 2004-08-05] (Transaction Software, D 81737 Munich) [File not signed]
R2 Transbase TECDOC CD 1_2014 Service; C:\TECDOC_CD\1_2014\db\tbmux32.exe [360448 2013-02-25] (Transaction Software, D 81829 Munich) [File not signed]
R2 WinISOComputingGoogle; C:\Program Files\WinISO Computing\WinISOComputingGoogle.dll [224256 2016-11-19] () [File not signed]
U4 WinSAPSvc; C:\Documents and Settings\PC1\Application Data\WinSAPSvc\WinSAP.dll [218624 2017-03-17] (Windows) [File not signed]
R2 WsAppService; C:\Program Files\Wondershare\WAF\2.3.2.220\WsAppService.exe [441344 2017-01-05] (Wondershare) [File not signed]
S4 Convxxxx; "C:\Documents and Settings\PC1\Application Data\ibehb\UvConverter.exe" {2C8E8C85-942B-451C-8243-97A089265577} [X]
S2 ed2kidle; "C:\Program Files\amuleC1\ed2k.exe" -downloadwhenidle [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 akshasp; C:\WINDOWS\System32\DRIVERS\akshasp.sys [327168 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 aksusb; C:\WINDOWS\System32\DRIVERS\aksusb.sys [100096 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
S3 AR5416; C:\WINDOWS\System32\DRIVERS\athw.sys [1574112 2009-06-22] (Atheros Communications, Inc.)
S3 atimtai; C:\WINDOWS\System32\DRIVERS\atimtai.sys [281600 2001-08-17] (ATI Technologies Inc.)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R0 d347bus; C:\WINDOWS\System32\DRIVERS\d347bus.sys [155136 2004-08-22] ( ) [File not signed]
R0 d347prt; C:\WINDOWS\System32\Drivers\d347prt.sys [5248 2004-08-22] ( ) [File not signed]
S3 dtlitescsibus; C:\WINDOWS\System32\DRIVERS\dtlitescsibus.sys [26168 2016-11-19] (Disc Soft Ltd)
S3 dtliteusbbus; C:\WINDOWS\System32\DRIVERS\dtliteusbbus.sys [40504 2016-11-19] (Disc Soft Ltd)
R3 eapihdrv; C:\Documents and Settings\PC1\Local Settings\Temp\ehdrv.sys [135760 2017-03-17] (ESET)
S3 FETNDIS; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [27165 2001-08-17] (VIA Technologies, Inc.              )
R2 Hardlock; C:\WINDOWS\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 L1c; C:\WINDOWS\System32\DRIVERS\l1c51x86.sys [44032 2009-07-28] (Atheros Communications, Inc.)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S3 NETwLx32; C:\WINDOWS\System32\DRIVERS\NETwLx32.sys [6609920 2010-10-07] (Intel Corporation)
S0 nvgts; C:\WINDOWS\System32\DRIVERS\nvgts.sys [145952 2008-08-18] (NVIDIA Corporation)
S3 rtl8029; C:\WINDOWS\System32\DRIVERS\RTL8029.SYS [19017 2001-08-17] (Realtek Semiconductor Corporation)
S3 rtl8139; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [20992 2008-04-13] (Realtek Semiconductor Corporation)
R0 snapman380; C:\WINDOWS\System32\DRIVERS\snman380.sys [134272 2012-02-12] (Acronis)
R0 sptd; C:\WINDOWS\System32\Drivers\sptd.sys [691696 2017-01-05] () [File not signed]
R2 tifsfilter; C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [44384 2012-02-12] (Acronis)
U0 ahcix86; ahcix86.sys [X]
S4 IntelIde; no ImagePath
U4 nicm; no ImagePath
U4 nwfilter; no ImagePath
U4 smbios; no ImagePath
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 vmfilter323; system32\drivers\vmfilter323.sys [X]
S3 WpdUsb; system32\DRIVERS\wpdusb.sys [X]
U1 WS2IFSL; no ImagePath
S3 ZSMC326; System32\Drivers\usbvm323.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-03-17 22:41 - 2017-03-17 22:41 - 01766912 _____ (Farbar) C:\Documents and Settings\PC1\Desktop\FRST.exe
2017-03-17 22:41 - 2017-03-17 22:41 - 00018101 _____ C:\Documents and Settings\PC1\Desktop\FRST.txt
2017-03-17 22:41 - 2017-03-17 22:41 - 00000000 ____D C:\FRST
2017-03-17 22:30 - 2017-03-17 22:30 - 00000000 ___RD C:\Documents and Settings\PC1\My Documents\My Music
2017-03-17 22:03 - 2017-03-17 22:03 - 02870984 _____ (ESET) C:\Documents and Settings\PC1\Desktop\esetsmartinstaller_bgr.exe
2017-03-17 22:02 - 2017-03-17 22:02 - 00000000 ____D C:\Program Files\CCleaner
2017-03-17 20:44 - 2017-03-17 20:44 - 00000000 ____D C:\Program Files\{2CEF74EE-02D6-437C-A7CC-7AE3E3E8F8E2}
2017-03-17 12:44 - 2017-03-17 12:44 - 00000000 ____D C:\WINDOWS\system32\{14724876-FD6A-4DE3-8978-4DE96BEFF46E}
2017-03-16 13:24 - 2017-03-16 13:24 - 00000000 ____D C:\WINDOWS\system32\{F65A17B7-2E4E-4831-AD36-C1484AA26E28}
2017-03-15 15:30 - 2017-03-15 15:30 - 00000000 ____D C:\WINDOWS\system32\{986C9917-A76A-49FA-A28A-D7A83CACC1A5}
2017-03-14 11:30 - 2017-03-14 11:30 - 00000000 ____D C:\Program Files\n1
2017-03-13 17:10 - 2017-03-13 17:10 - 00000000 ____D C:\Program Files\{E54310E4-CE04-44E4-A584-9C29A7D1F871}
2017-03-09 17:23 - 2017-03-09 17:23 - 00000000 ____D C:\Program Files\{E755C9D1-A614-44C4-AE02-6B9814C5086D}
2017-03-09 13:23 - 2017-03-09 13:23 - 00000000 ____D C:\WINDOWS\system32\{A37084F3-0031-4028-AF47-4AFDFFEE630A}
2017-03-08 21:02 - 2017-03-08 21:02 - 00000000 ____D C:\Program Files\{2D6EEEE6-C22F-4C3C-B709-C3E03C4DC214}
2017-03-02 13:39 - 2017-03-02 13:39 - 00000000 ____D C:\WINDOWS\system32\{C8BA2200-B75E-454D-8345-802DD99F5B93}
2017-03-01 21:11 - 2017-03-01 21:11 - 00000000 ____D C:\Program Files\{3DA18CCB-F1EA-4544-B2A2-5DC8A2ECAB27}
2017-03-01 13:11 - 2017-03-01 13:11 - 00000000 ____D C:\Documents and Settings\PC1\Application Data\Kyubey
2017-02-28 17:41 - 2017-02-28 17:41 - 00000000 ____D C:\Program Files\{F40D861A-A74D-4A89-A778-A566AF242FF1}
2017-02-28 13:41 - 2017-02-28 13:41 - 00000000 ____D C:\Program Files\{EB5BE24E-F79B-44DE-88D0-1A8C8796E584}
2017-02-28 11:38 - 2017-02-28 11:38 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Wondershare
2017-02-28 11:38 - 2016-09-27 16:28 - 00000232 _____ C:\WINDOWS\system32\dllhost.exe.config
2017-02-28 11:37 - 2017-02-28 11:37 - 01183056 _____ C:\WINDOWS\unins000.exe
2017-02-28 11:37 - 2017-02-28 11:37 - 00048024 _____ C:\WINDOWS\unins000.dat
2017-02-28 11:37 - 2017-02-28 11:37 - 00022709 _____ C:\WINDOWS\unins000.msg
2017-02-28 11:37 - 2017-02-28 11:37 - 00000000 ____D C:\Program Files\Wondershare
2017-02-28 11:37 - 2017-02-28 11:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Wondershare
2017-02-28 11:37 - 2012-11-29 14:02 - 00000427 _____ C:\WINDOWS\system32\Microsoft.VC80.CRT.manifest
2017-02-25 12:06 - 2017-02-25 12:06 - 00000646 _____ C:\Documents and Settings\All Users\Desktop\InfraRecorder.lnk
2017-02-25 12:06 - 2017-02-25 12:06 - 00000000 ____D C:\Program Files\InfraRecorder
2017-02-25 10:26 - 2017-02-25 10:26 - 00000000 ____D C:\Program Files\{ECB6709A-3C39-4478-81BC-486B8961C4A9}
2017-02-24 13:26 - 2017-02-24 13:26 - 00000000 ____D C:\WINDOWS\system32\{8827E63B-10E2-4D7A-B06A-E562B2432833}
2017-02-23 17:48 - 2017-02-23 17:48 - 00000000 ____D C:\Program Files\{2F80370C-03BE-4182-9008-4D752F6C054B}
2017-02-23 13:48 - 2017-02-23 13:48 - 00000000 ____D C:\Program Files\{F45F508D-6BE8-4045-A421-097F248BDDC5}
2017-02-23 09:48 - 2017-02-23 09:48 - 00000000 ____D C:\WINDOWS\system32\{1E0CA4CF-A235-4054-8950-B1F17D207238}
2017-02-22 13:23 - 2017-02-22 13:23 - 00000000 ____D C:\Program Files\{F18E9273-E3ED-4A69-BBC5-B24534C5527C}
2017-02-22 13:22 - 2017-02-22 13:22 - 00000000 ____D C:\WINDOWS\system32\{B793C34A-81B9-49D8-9942-A63F2571D11A}
2017-02-21 20:24 - 2017-02-21 20:24 - 00199193 _____ C:\Documents and Settings\PC1\Desktop\ESH0019828.pdf
2017-02-21 13:10 - 2017-02-21 13:10 - 00000000 ____D C:\WINDOWS\system32\{135DC2C1-A9EA-4DED-8421-23C15BCE197D}
2017-02-20 17:24 - 2017-02-20 17:24 - 00000000 ____D C:\Program Files\{2E33EA66-B4C6-4C6F-8901-79673C142DB0}
2017-02-16 23:51 - 2017-02-16 23:51 - 00000000 ____D C:\Program Files\{2E7C3949-C5CC-4FD3-8B37-0464F44346D4}
2017-02-16 13:23 - 2017-02-16 13:23 - 00000000 ____D C:\Program Files\notepad2
2017-02-16 13:23 - 2017-02-16 13:23 - 00000000 ____D C:\Program Files\Common Files\ntp2UpSvc

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-03-17 22:28 - 2016-10-27 18:36 - 00065536 _____ C:\WINDOWS\system32\config\ACEEvent.evt
2017-03-17 22:28 - 2013-10-30 19:10 - 00065536 _____ C:\WINDOWS\system32\config\TuneUp.evt
2017-03-17 22:28 - 2011-12-08 19:58 - 00065536 _____ C:\WINDOWS\system32\config\ODiag.evt
2017-03-17 22:28 - 2010-07-02 10:43 - 00065536 _____ C:\WINDOWS\system32\config\Internet.evt
2017-03-17 22:27 - 2010-07-02 08:06 - 00000212 __RSH C:\boot.ini
2017-03-17 22:27 - 2008-04-14 09:00 - 00000841 _____ C:\WINDOWS\win.ini
2017-03-17 22:27 - 2008-04-14 09:00 - 00000227 _____ C:\WINDOWS\system.ini
2017-03-17 22:00 - 2013-04-11 22:30 - 00000080 ___RH C:\WINDOWS\ssystda.dat
2017-03-17 08:44 - 2010-07-02 08:46 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-03-16 22:26 - 2016-08-11 20:09 - 00000012 _____ C:\WINDOWS\bthservsdp.dat
2017-03-16 22:26 - 2013-10-30 19:31 - 00000178 ___SH C:\Documents and Settings\PC1\ntuser.ini
2017-03-16 22:26 - 2010-07-02 08:46 - 00032600 ____N C:\WINDOWS\SchedLgU.Txt
2017-03-14 09:28 - 2008-04-14 09:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2017-03-06 20:36 - 2010-07-02 08:47 - 00000178 ___SH C:\Documents and Settings\User\ntuser.ini
2017-03-02 13:44 - 2016-12-05 13:31 - 00001834 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
2017-03-02 13:44 - 2016-12-05 13:31 - 00001804 _____ C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
2017-03-02 13:44 - 2016-11-09 21:15 - 00002037 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome.lnk
2017-03-02 13:44 - 2016-11-09 21:15 - 00002031 _____ C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
2017-03-02 13:44 - 2013-10-30 19:23 - 00000883 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Opera.lnk
2017-03-02 13:44 - 2013-10-30 19:23 - 00000877 _____ C:\Documents and Settings\All Users\Desktop\Opera.lnk
2017-03-01 10:00 - 2013-10-30 19:33 - 00075256 _____ C:\Documents and Settings\PC1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2017-03-01 09:14 - 2010-07-02 08:07 - 00282128 _____ C:\WINDOWS\system32\FNTCACHE.DAT

==================== Files in the root of some directories =======

2013-10-30 17:35 - 2013-10-30 17:35 - 50053120 _____ () C:\Program Files\GUT7C.tmp
2016-11-19 21:33 - 2016-11-19 21:32 - 1518080 _____ () C:\Program Files\Common Files\gdv3vo.dll
2013-04-11 21:38 - 2014-05-07 18:17 - 4294967290 _____ () C:\Documents and Settings\All Users\OfflineCatalogue_2_2013_TECDOC_CD.log
2015-02-03 16:43 - 2015-02-06 15:58 - 8434432 _____ () C:\Documents and Settings\All Users\OfflineCatalogue_1_2014_TECDOC_CD.log
2014-01-04 09:58 - 2015-02-03 16:45 - 2986984 _____ () C:\Documents and Settings\All Users\UninstallOfflineCatalogue.log

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

 

Addition.txt

Здравейте,

 

СТЪПКА 1

 

Изтеглете програмата GeekUninstaller и я запазете на десктопа.

Разархивирайте я и стартирайте файла geek.exe IxXO5oO.jpg
От списъка намерете amuleC (примера е за Mozilla Firefox, но това е просто за показно).

Кликнете с десен бутон върху програмата и изберете Force Removal
 
XhV2QLa.png
 
След края на инсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи):
 
Пример за Mozilla браузъра:

geekuninstaller-3.png

Натиснете бутона Finish за да изтриете останките от програмата.

Повторете стъпките за следната програма => youndoo - Uninstall

 

СТЪПКА 2

 

След това Изтеглете edit-text.giffixlist.txt и го запазете на десктопа.
Стартирайте FRST.exe и натиснете бутона Fix веднъж!
След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.
 
Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

 

СТЪПКА 3

 

  • Изтеглете и стартирайте 6sv1DN9.jpgAdwCleaner.exe
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[S1].txt и  AdwCleaner[С1].txt) в C:\Adwcleaner
  • Публикувайте съдържанието на  AdwCleaner[С1].txt в следващия си коментар.

 

След това пишете как е положението.

Поздрави!

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.