Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Компютъра ми работи бавно след като си заразих фейзбука с вирус

valyo_93
в Премахване на зловреден софтуер

Featured Replies

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-05-2017
Ran by Administrator (administrator) on GLBG1543PC02 (25-05-2017 09:22:41)
Running from D:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: Librarian & Visitor & Administrator)
Platform: Microsoft Windows 7 Enterprise  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
() C:\Program Files\Unlocker\UnlockerAssistant.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
() C:\Program Files\Canon\ImageBrowser EX\MFManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Adobe Systems, Incorporated) C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(OCS Inventory NG) C:\Program Files\OCS Inventory Agent\OcsService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-13] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-31] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-15] (AVAST Software)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [IME JPN 2007 Migration] => C:\Program Files\Common Files\microsoft shared\IME12\IMEJP\IMJPKLMG.EXE [63856 2011-09-19] (Microsoft Corporation)
HKLM\...\Run: [UnlockerAssistant] => C:\Program Files\Unlocker\UnlockerAssistant.exe [17408 2010-07-04] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
Winlogon\Notify\avldr: avldr.dll [X]
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6369048 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\MountPoints2: {8213861c-3b64-11e7-81f9-3cd92b637c04} - H:\Startme.exe
HKU\S-1-5-21-299244719-1399796724-3294634451-500\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [413696 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [27716568 2017-05-04] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-10-17] (AVAST Software)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  -> No File
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2015-06-11]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2015-06-09] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk [2015-09-07]
ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files\Canon\ImageBrowser EX\MFManager.exe ()
Startup: C:\Users\Librarian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk [2014-10-31]
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Administrator\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (No File)
GroupPolicy\User: Restriction ? <======= ATTENTION
GroupPolicyUsers\S-1-5-21-299244719-1399796724-3294634451-1006\User: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{A753DA6E-FE95-49B7-AA56-3DC81D3E4609}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-299244719-1399796724-3294634451-500 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-10-25] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL => No File
Toolbar: HKU\S-1-5-21-299244719-1399796724-3294634451-500 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-299244719-1399796724-3294634451-500 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} -  No File
Handler: AutorunsDisabled\skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} -  No File []
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default [2017-05-25]
FF Extension: (facepaste) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\Extensions\[email protected] [2016-12-05]
FF Extension: (BitComet Video Downloader) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\Extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [2015-06-10] [not signed]
FF Extension: (Download YouTube Videos as MP4) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2016-12-05]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-11-21]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-11-21]
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-06-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL [No File]
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-299244719-1399796724-3294634451-500: @tools.google.com/Google Update;version=3 -> C:\Users\Administrator\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-25] (Google Inc.)
FF Plugin HKU\S-1-5-21-299244719-1399796724-3294634451-500: @tools.google.com/Google Update;version=9 -> C:\Users\Administrator\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-25] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npBitCometAgent.dll [2012-01-12] (BitComet)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default [2017-05-22]
CHR Extension: (A Good Movie to watch) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahpdggjilcdffpgpkmgcfhmhlhomkfmm [2017-03-07]
CHR Extension: (Google Диск) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (DownAlbum) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgjnhhjpfcdhbhlcmmjppicjmgfkppok [2017-02-07]
CHR Extension: (Google Търсене) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (AdBlock) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-03-10]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-08]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-07]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Guest Profile [2015-06-11]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-05-25]
CHR Extension: (Google Диск) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-06-10]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-10]
CHR Extension: (Google Документи офлайн) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-10]
CHR Extension: (AdBlock) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-18]
CHR Extension: (Avast Online Security) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-05-18]
CHR Extension: (Updateurs) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hgmffafdgliicdpjplbecdjddhkicekf [2017-05-22]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-06-10]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-12]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\System Profile [2017-05-22]
CHR HKLM\...\Chrome\Extension: [daanglpcpkjjlkhcbladppjphglbigam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [dhigneefebkcagnpnpbibganpmfgebnk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome.7NNAC2DCODL2MFYEJRXT4CMY3Q - C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe
StartMenuInternet: Google Chrome.Visitor - C:\Users\Visitor\AppData\Local\Google\Chrome\Application\chrome.exe

Opera: 
=======
OPR Extension: (No Name) - C:\Users\Administrator\AppData\Roaming\Opera Software\Opera Stable\Extensions\lnpddjhhjmmcnjbjdbopmniafbpfppkb [2015-05-28]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AgentService; C:\Program Files\LibraryClient\globalLibx32\service.exe [46592 2012-02-20] () [File not signed]
R2 AGSService; C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-02-27] (Adobe Systems, Incorporated)
R2 AMD FUEL Service; c:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2011-07-13] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-10-17] (AVAST Software)
S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3398608 2017-05-09] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [104200 2016-10-18] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280864 2016-10-18] (Microsoft Corporation)
R2 OCS Inventory Service; C:\Program Files\OCS Inventory Agent\OcsService.exe [38912 2013-04-08] (OCS Inventory NG) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
U4 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.01; c:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [39424 2011-06-24] (Advanced Micro Devices) [File not signed]
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34008 2016-10-17] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-10-17] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [92256 2016-10-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [91232 2016-10-17] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [60424 2016-10-17] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [735488 2016-10-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433768 2016-10-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [118664 2016-10-17] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [224752 2016-10-17] (AVAST Software)
S3 cxbu0wdm; C:\Windows\System32\DRIVERS\cxbu0wdm.sys [131064 2014-05-14] (HID Global Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [41984 2008-10-28] (Samsung Electronics Co., Ltd.) [File not signed]
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [220088 2017-05-23] (Malwarebytes)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [252808 2016-08-25] (Microsoft Corporation)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2008-10-27] (Samsung Electronics) [File not signed]
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2009-09-19] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2009-09-19] (MCCI Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]
U4 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-25 09:22 - 2017-05-25 09:22 - 00000000 ____D C:\FRST
2017-05-17 10:58 - 2017-05-17 10:58 - 00171798 ____T C:\Windows\system32\z
2017-05-17 10:56 - 2017-05-17 10:56 - 00164727 ____T C:\Windows\system32\a
2017-05-11 13:28 - 2017-05-11 13:28 - 00000000 ____D C:\Program Files\Common Files\Skype
2017-05-11 09:45 - 2017-05-23 18:17 - 00000632 __RSH C:\Users\Administrator\ntuser.pol
2017-05-11 01:03 - 2017-04-28 03:36 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-05-11 01:03 - 2017-04-28 03:36 - 03945192 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-05-11 01:03 - 2017-04-28 03:36 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-05-11 01:03 - 2017-04-28 03:36 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-05-11 01:03 - 2017-04-28 03:34 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-05-11 01:03 - 2017-04-28 03:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-05-11 01:03 - 2017-04-28 03:11 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-05-11 01:03 - 2017-04-28 03:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-05-11 01:03 - 2017-04-28 03:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-05-11 01:03 - 2017-04-28 03:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-05-11 01:03 - 2017-04-28 03:09 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-05-11 01:03 - 2017-04-28 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-05-11 01:03 - 2017-04-28 03:07 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-05-11 01:03 - 2017-04-28 03:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-05-11 01:03 - 2017-04-28 03:07 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-05-11 01:03 - 2017-04-28 03:07 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-05-11 01:03 - 2017-04-28 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-05-11 01:03 - 2017-04-28 03:07 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-05-11 01:03 - 2017-04-26 17:51 - 02400768 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-05-11 01:03 - 2017-04-21 18:15 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-05-11 01:03 - 2017-04-20 02:16 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 01417728 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00377344 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:54 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-05-11 01:03 - 2017-04-17 17:51 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-05-11 01:03 - 2017-04-17 17:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-11 01:03 - 2017-04-16 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-05-11 01:03 - 2017-04-16 11:19 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-05-11 01:03 - 2017-04-16 11:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-05-11 01:03 - 2017-04-16 11:01 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-05-11 01:03 - 2017-04-16 11:01 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-05-11 01:03 - 2017-04-16 11:01 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-05-11 01:03 - 2017-04-16 11:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-05-11 01:03 - 2017-04-16 10:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-05-11 01:03 - 2017-04-16 10:52 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-05-11 01:03 - 2017-04-16 10:52 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-05-11 01:03 - 2017-04-16 10:49 - 20278272 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-05-11 01:03 - 2017-04-16 10:48 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-05-11 01:03 - 2017-04-16 10:47 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-05-11 01:03 - 2017-04-16 10:47 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-05-11 01:03 - 2017-04-16 10:47 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-05-11 01:03 - 2017-04-16 10:46 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-05-11 01:03 - 2017-04-16 10:39 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-05-11 01:03 - 2017-04-16 10:35 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-05-11 01:03 - 2017-04-16 10:30 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-05-11 01:03 - 2017-04-16 10:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-05-11 01:03 - 2017-04-16 10:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-05-11 01:03 - 2017-04-16 10:25 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-05-11 01:03 - 2017-04-16 10:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-05-11 01:03 - 2017-04-16 10:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-05-11 01:03 - 2017-04-16 10:20 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-05-11 01:03 - 2017-04-16 10:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-05-11 01:03 - 2017-04-16 10:10 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-05-11 01:03 - 2017-04-16 10:10 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-05-11 01:03 - 2017-04-16 10:08 - 04548608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-05-11 01:03 - 2017-04-16 10:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-05-11 01:03 - 2017-04-16 10:08 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-05-11 01:03 - 2017-04-16 09:53 - 13661184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-05-11 01:03 - 2017-04-16 09:37 - 02767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-05-11 01:03 - 2017-04-16 09:34 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-05-11 01:03 - 2017-04-16 09:34 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-05-11 01:03 - 2017-04-12 18:26 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-05-11 01:03 - 2017-04-12 18:25 - 01176064 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-05-11 01:03 - 2017-04-12 18:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-05-11 01:03 - 2017-04-12 18:25 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-05-11 01:03 - 2017-04-07 18:26 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-05-11 01:03 - 2017-04-07 18:26 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-05-11 01:03 - 2017-04-07 18:21 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-05-11 01:03 - 2017-04-07 18:20 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-05-11 01:03 - 2017-04-05 18:00 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-05-11 01:03 - 2017-04-05 18:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-05-11 01:03 - 2017-04-05 18:00 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-05-11 01:03 - 2017-04-04 18:25 - 01309928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-05-11 01:03 - 2017-04-04 18:25 - 00240872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-05-11 01:03 - 2017-04-04 18:25 - 00187624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-05-11 01:03 - 2017-04-04 17:52 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-05-11 01:03 - 2017-04-04 17:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-05-11 01:03 - 2017-03-10 19:20 - 01508352 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2017-05-11 01:03 - 2017-03-10 19:20 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2017-05-11 01:03 - 2017-03-10 18:52 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\plasrv.exe
2017-05-11 01:03 - 2017-03-10 18:51 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2017-05-11 01:03 - 2017-03-10 18:51 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2017-05-11 01:03 - 2017-03-09 19:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-05-10 11:27 - 2017-05-10 11:27 - 00001014 __RSH C:\Users\Visitor\ntuser.pol
2017-05-10 09:59 - 2017-05-10 10:04 - 00000000 ____D C:\Users\Visitor\AppData\LocalLow\Mozilla

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-25 09:09 - 2013-04-11 15:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-05-25 09:08 - 2016-12-05 15:34 - 00000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2017-05-25 09:05 - 2016-12-05 15:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-05-25 02:00 - 2010-10-30 10:53 - 00000000 ____D C:\Users\Administrator\AppData\Local\Adobe
2017-05-24 13:09 - 2011-04-04 16:21 - 00000972 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-299244719-1399796724-3294634451-1005Core.job
2017-05-24 09:09 - 2013-08-14 18:06 - 00000000 ____D C:\Windows\system32\MRT
2017-05-24 09:00 - 2010-10-24 18:39 - 129479984 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-23 18:17 - 2010-10-25 14:50 - 00000000 ____D C:\Users\Administrator
2017-05-23 16:45 - 2009-07-14 07:34 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-23 16:45 - 2009-07-14 07:34 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-23 16:38 - 2017-03-10 09:49 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-23 16:36 - 2017-03-22 12:09 - 00000000 ____D C:\Program Files\Common Files\McAfee
2017-05-23 16:36 - 2015-12-04 01:04 - 00000000 ____D C:\Program Files\Common Files\AV
2017-05-23 16:36 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-23 16:35 - 2011-03-25 20:39 - 00000000 ____D C:\ProgramData\McAfee
2017-05-23 16:33 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\inf
2017-05-22 16:30 - 2017-02-22 16:16 - 00000000 ____D C:\ProgramData\Ashampoo
2017-05-22 16:01 - 2017-03-10 09:49 - 00001986 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-05-22 16:00 - 2017-03-10 09:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-22 15:18 - 2017-03-22 12:09 - 00000000 ____D C:\Program Files\McAfee
2017-05-22 14:42 - 2014-11-26 11:41 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Google
2017-05-18 08:48 - 2010-10-24 19:26 - 01425750 _____ C:\Windows\system32\perfh01F.dat
2017-05-18 08:48 - 2010-10-24 19:26 - 00880564 _____ C:\Windows\system32\perfc01F.dat
2017-05-18 08:48 - 2010-10-24 18:25 - 00006452 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-16 05:17 - 2013-09-25 11:13 - 00002105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-12 17:37 - 2016-07-13 10:25 - 00000000 ____D C:\Windows\rescache
2017-05-11 13:28 - 2013-09-25 13:32 - 00000000 ___RD C:\Program Files\Skype
2017-05-11 13:28 - 2010-10-24 18:32 - 00000000 ____D C:\ProgramData\Skype
2017-05-11 09:21 - 2009-07-14 07:33 - 03763560 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-11 09:18 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-05-10 11:27 - 2010-10-25 14:45 - 00000000 ____D C:\Users\Visitor
2017-05-10 10:59 - 2014-04-15 11:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Carambis
2017-05-10 10:59 - 2014-04-15 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carambis
2017-05-10 10:59 - 2014-04-15 11:32 - 00000000 ____D C:\Program Files\Carambis
2017-05-10 10:59 - 2010-10-25 14:24 - 00000000 ____D C:\Users\Librarian
2017-05-10 09:59 - 2010-10-31 14:30 - 00000000 ____D C:\Users\Visitor\AppData\Local\Mozilla
2017-05-10 09:17 - 2010-10-24 20:22 - 00000039 _____ C:\Windows\vbaddin.ini
2017-05-09 16:37 - 2017-03-10 09:48 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys

==================== Files in the root of some directories =======

2013-01-19 10:44 - 2013-01-19 10:44 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files\Common Files\atimpenc.dll
2013-09-23 12:52 - 2015-02-17 13:54 - 0000135 _____ () C:\Users\Administrator\AppData\Roaming\WB.CFG
2010-10-29 19:41 - 2014-09-12 13:09 - 0008082 _____ () C:\Users\Administrator\AppData\Roaming\XeroxFaxOptions.xml
2010-10-26 17:33 - 2010-10-26 17:33 - 0000017 _____ () C:\Users\Administrator\AppData\Local\resmon.resmoncfg
2016-03-13 15:44 - 2016-03-13 15:44 - 0000000 _____ () C:\Users\Administrator\AppData\Local\{922103B9-20F4-4D54-81F7-9D2B835CCA02}

Some files in TEMP:
====================
2017-05-23 16:35 - 2016-11-28 09:21 - 1027864 _____ (McAfee, Inc.) C:\Users\Administrator\AppData\Local\Temp\0173931495546510McInst.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-13 00:05

==================== End of FRST.txt ============================

Addition.txt

Здравейте...! 

Тези скрипти познати ли ви са:

Цитат

C:\Windows\Scripts\logoff.bat

C:\Windows\Scripts\del.bat

Проверете ги на  VirusTotal и публикувайте линк с  резултатите в следващия си пост.

 

 

  • Автор
SHA256: d6810607c546138d822e40de13da953d168893ad6045c3378587d3085b02e2ea
Име на файла: del.bat
Съотношение на разпознаване: 0 / 55
Дата на анализиране: 2017-05-25 10:33:08 UTC (преди 0 минути)
chart?chs=120x60&cht=gom&chco=d60c1A,379f32&chds=-100,100&chd=t:0
0
 
0
 
Антивирусен софтуер Резултат Версия на обновление
Ad-Aware   20170525
AegisLab   20170525
AhnLab-V3   20170525
Alibaba   20170525
ALYac   20170525
Antiy-AVL   20170525
Arcabit   20170525
Avast   20170525
AVG   20170525
Avira (no cloud)   20170525
AVware   20170525
BitDefender   20170525
Bkav   20170525
CAT-QuickHeal   20170525
ClamAV   20170525
CMC   20170524
Comodo   20170525
CrowdStrike Falcon (ML)   20170420
Cyren   20170525
DrWeb   20170525
Emsisoft   20170525
Endgame   20170515
ESET-NOD32   20170525
F-Prot   20170525
F-Secure   20170525
Fortinet   20170525
GData   20170525
Ikarus   20170525
Invincea   20170519
Jiangmin   20170525
K7AntiVirus   20170525
K7GW   20170525
Kaspersky   20170525
Kingsoft   20170525
Malwarebytes   20170525
McAfee   20170525
McAfee-GW-Edition   20170525
Microsoft   20170525
eScan   20170525
NANO-Antivirus   20170525
nProtect   20170525
Palo Alto Networks (Known Signatures)   20170525
Panda   20170524
Qihoo-360   20170525
Rising   20170525
SentinelOne (Static ML)   20170516
Sophos   20170525
SUPERAntiSpyware   20170525
Symantec   20170525
Symantec Mobile Insight   20170525
Tencent   20170525
TheHacker   20170525
TrendMicro   20170525
TrendMicro-HouseCall   20170525
Trustlook   20170525
VBA32   20170525
VIPRE   20170525
ViRobot   20170525
Webroot   20170525
WhiteArmor   20170524
Yandex   20170518
Zillya   20170524
ZoneAlarm by Check Point   20170525

Zoner

 

 

 

SHA256: 66ecc23707600a22322c21026a29f2297002f1729d24d4e412a9c5e6704fa3d0
Име на файла: logoff.bat
Съотношение на разпознаване: 0 / 55
Дата на анализиране: 2017-05-25 10:36:26 UTC (преди 0 минути)
chart?chs=120x60&cht=gom&chco=d60c1A,379f32&chds=-100,100&chd=t:0
0
 
0
 
Антивирусен софтуер Резултат Версия на обновление
Ad-Aware   20170525
AegisLab   20170525
AhnLab-V3   20170525
Alibaba   20170525
ALYac   20170525
Antiy-AVL   20170525
Arcabit   20170525
Avast   20170525
AVG   20170525
Avira (no cloud)   20170525
AVware   20170525
BitDefender   20170525
Bkav   20170525
CAT-QuickHeal   20170525
ClamAV   20170525
CMC   20170524
Comodo   20170525
CrowdStrike Falcon (ML)   20170420
Cyren   20170525
DrWeb   20170525
Emsisoft   20170525
Endgame   20170515
ESET-NOD32   20170525
F-Prot   20170525
F-Secure   20170525
Fortinet   20170525
GData   20170525
Ikarus   20170525
Invincea   20170519
Jiangmin   20170525
K7AntiVirus   20170525
K7GW   20170525
Kaspersky   20170525
Kingsoft   20170525
Malwarebytes   20170525
McAfee   20170525
McAfee-GW-Edition   20170525
Microsoft   20170525
eScan   20170525
NANO-Antivirus   20170525
nProtect   20170525
Palo Alto Networks (Known Signatures)   20170525
Panda   20170524
Qihoo-360   20170525
Rising   20170525
SentinelOne (Static ML)   20170516
Sophos   20170525
SUPERAntiSpyware   20170525
Symantec   20170525
Symantec Mobile Insight   20170525
Tencent   20170525
TheHacker   20170525
TrendMicro   20170525
TrendMicro-HouseCall   20170525
Trustlook   20170525
VBA32   20170525
VIPRE   20170525
ViRobot   20170525
Webroot   20170525
WhiteArmor   20170524
Yandex   20170518
Zillya   20170524
ZoneAlarm by Check Point   20170525
Zoner   20170525
 

20170525

 

 

 

 

 

 

 

 

 

Чисти са...!

Моля, изтеглете  Zemana AntiMalware и го запишете на вашия работен плот.

  • Инсталирайте програмата и след като инсталацията приключи, тя ще се стартира автоматично.
  • Без да промените каквито и опции, натиснете Scan, за да започне проверката
  • След кратко сканирането приключи, ако са открити заплахи натиснете Next за да ги премахнете.

Забележка: Ако се изиска рестартиране, за да завършите процеса на почистване, трябва да щракнете върху Reboot . Ако не се изисква рестартиране, моля рестартирайте компютъра ръчно.

  • Отворете  Zemana AntiMalware отново.
  • Кликнете върху [IMG] икона и кликнете два пъти върху последния доклад.
  • Сега кликнете File > Save As  и изберете своя Desktop преди да натиснете Save.
  • Моля копирайте съдържанието на лог файла в следващия си пост.

Дневници
 
В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

  • Дневник от Zemana AntiMalware
  • Автор

Zemana AntiMalware 2.72.2.388 (инсталираната версия)

-------------------------------------------------------
Scan Result            : Завършено
Scan Date              : 2017.5.25
Operating System       : Windows 7 32-bit
Processor              : 2X AMD Athlon(tm) II X2 220 Processor
BIOS Mode              : Legacy
CUID                   : 127E10DBE49355D173645B
Scan Type              : Проверка на системата
Duration               : 28m 58s
Scanned Objects        : 91056
Detected Objects       : 17
Excluded Objects       : 0
Read Level             : SCSI
Auto Upload            : Включен
Detect All Extensions  : Изключен
Scan Documents         : Изключен
Domain Info            : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

Firefox Search
Status             : Проверено
Object             : Речник РЅР° Portal.BG - http://portal.bg
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Подозрителна настройка на браузъра
Cleaning Action    : Поправи
Related Objects    :
                Настройка на браузъра - Firefox Search

Firefox Search
Status             : Проверено
Object             : Дири.Р±Рі - http://diri.bg
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Подозрителна настройка на браузъра
Cleaning Action    : Поправи
Related Objects    :
                Настройка на браузъра - Firefox Search

Файл Hosts
Status             : Проверено
Object             : %systemroot%\system32\drivers\etc\hosts
MD5                : 28ED94911B269CAE3D69830D0A3E029B
Publisher          : -
Size               : 848
Version            : -
Detection          : Изменен е файла Hosts
Cleaning Action    : Поправи
Related Objects    :
                Файл hosts - Прекалено много празни редове във файла Hosts
                Файл - %systemroot%\system32\drivers\etc\hosts

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{0d34f758-4a5d-4c5c-8ea9-1d8e68ff71de}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{0D34F758-4A5D-4C5C-8EA9-1D8E68FF71DE}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{2215dcb5-482f-40fe-992f-ba02fd5404eb}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{2215DCB5-482F-40FE-992F-BA02FD5404EB}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{2ae7c77e-1ec3-4d5e-8928-b7ecab639d2c}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{2AE7C77E-1EC3-4D5E-8928-B7ECAB639D2C}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{36213e3a-f8f6-4dbf-8fe9-b76ab2ee3d2e}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{36213E3A-F8F6-4DBF-8FE9-B76AB2EE3D2E}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{39ab4816-e9f6-4bf4-acbe-5beb48882af7}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{39AB4816-E9F6-4BF4-ACBE-5BEB48882AF7}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{767bc7a4-7184-475d-b05b-dadde3688dc6}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{767BC7A4-7184-475D-B05B-DADDE3688DC6}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{bb0cc33d-b17e-4c02-ba3d-eefbd04f3cf7}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{BB0CC33D-B17E-4C02-BA3D-EEFBD04F3CF7}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{bfefef9d-18dd-4696-809d-71fc54ff1536}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{BFEFEF9D-18DD-4696-809D-71FC54FF1536}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{ee45757f-f030-4b30-b4f9-d1e84b071296}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{EE45757F-F030-4B30-B4F9-D1E84B071296}

Trojan:Win32/Poweliks
Status             : Проверено
Object             : %systemroot%\system32\tasks\{ef0834e5-1364-4f01-981e-9ace334292cc}|c:\program files\internet explorer\iexplore.exe
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Fileless Malware
Cleaning Action    : Изтрий
Related Objects    :
                Планирана задача - C:\Windows\System32\Tasks\{EF0834E5-1364-4F01-981E-9ACE334292CC}

{10173e04-771c-4a22-b19e-ef0a6a76e3c7}
Status             : Проверено
Object             : NE->c:\windows\system32\tasks\{10173e04-771c-4a22-b19e-ef0a6a76e3c7}
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Adware:Win32/CHR.TASKSCHD.GEN.A!Neng
Cleaning Action    : Карантина
Related Objects    :
                (null) - (null)

{20b27b16-07c0-47bc-a806-282084a75634}
Status             : Проверено
Object             : NE->c:\windows\system32\tasks\{20b27b16-07c0-47bc-a806-282084a75634}
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Adware:Win32/CHR.TASKSCHD.GEN.A!Neng
Cleaning Action    : Карантина
Related Objects    :
                (null) - (null)

{8edf089a-8118-40c0-9b3d-41f7c8538214}
Status             : Проверено
Object             : NE->c:\windows\system32\tasks\{8edf089a-8118-40c0-9b3d-41f7c8538214}
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Adware:Win32/CHR.TASKSCHD.GEN.A!Neng
Cleaning Action    : Карантина
Related Objects    :
                (null) - (null)

{b34b21f7-a582-468b-99a5-4bc06fefbcf1}
Status             : Проверено
Object             : NE->c:\windows\system32\tasks\{b34b21f7-a582-468b-99a5-4bc06fefbcf1}
MD5                : -
Publisher          : -
Size               : -
Version            : -
Detection          : Adware:Win32/CHR.TASKSCHD.GEN.A!Neng
Cleaning Action    : Карантина
Related Objects    :
                (null) - (null)


Cleaning Result
-------------------------------------------------------
Cleaned               : 17
Reported as safe      : 0
Failed                : 0

 

Какво е положението сега..?

Моля за свежа проверка с..:

Сканиране с Farbar Recovery Scan

  • Моля изтеглете icon1337953436.pngFarbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете надесктопа.
  • Стартирайте файла FRST.exe (или FRST64.exe)
  • Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
  • Натиснете бутона YClYkft.jpg.
  • Изчакайте търпеливо проверката да приключи.
  • Ще се създадат два лог файла с името - FRST.txt и Addition.txt надесктопа.
  • Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение).

 

 Дневници
 
В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

  • FRST.txt (копирате цялото съдържание)
  • Addition.txt (прикачате..) 
 
  • Автор

Все още работи бавно

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-05-2017
Ran by Administrator (administrator) on GLBG1543PC02 (25-05-2017 16:32:19)
Running from D:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: Librarian & Visitor & Administrator)
Platform: Microsoft Windows 7 Enterprise  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Adobe Systems, Incorporated) C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(OCS Inventory NG) C:\Program Files\OCS Inventory Agent\OcsService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
() C:\Program Files\Unlocker\UnlockerAssistant.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
() C:\Program Files\Canon\ImageBrowser EX\MFManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Copyright 2017.) C:\Program Files\Zemana AntiMalware\ZAM.exe
(Copyright 2017.) C:\Program Files\Zemana AntiMalware\ZAM.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [StartCCC] => c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-13] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-31] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-15] (AVAST Software)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [IME JPN 2007 Migration] => C:\Program Files\Common Files\microsoft shared\IME12\IMEJP\IMJPKLMG.EXE [63856 2011-09-19] (Microsoft Corporation)
HKLM\...\Run: [UnlockerAssistant] => C:\Program Files\Unlocker\UnlockerAssistant.exe [17408 2010-07-04] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM\...\Run: [ZAM] => C:\Program Files\Zemana AntiMalware\ZAM.exe [14522512 2017-04-03] (Copyright 2017.)
Winlogon\Notify\avldr: avldr.dll [X]
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6369048 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-299244719-1399796724-3294634451-500\...\MountPoints2: {8213861c-3b64-11e7-81f9-3cd92b637c04} - H:\Startme.exe
HKU\S-1-5-21-299244719-1399796724-3294634451-500\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [413696 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [27716568 2017-05-04] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-10-17] (AVAST Software)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  -> No File
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk [2015-06-11]
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2015-06-09] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk [2015-09-07]
ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files\Canon\ImageBrowser EX\MFManager.exe ()
Startup: C:\Users\Librarian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk [2014-10-31]
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Administrator\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (No File)
GroupPolicy\User: Restriction ? <======= ATTENTION
GroupPolicyUsers\S-1-5-21-299244719-1399796724-3294634451-1006\User: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{A753DA6E-FE95-49B7-AA56-3DC81D3E4609}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-299244719-1399796724-3294634451-500 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll [2013-11-29] (BitComet)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-10-25] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL => No File
Toolbar: HKU\S-1-5-21-299244719-1399796724-3294634451-500 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-299244719-1399796724-3294634451-500 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} -  No File
Handler: AutorunsDisabled\skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} -  No File []
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default [2017-05-25]
FF Extension: (facepaste) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\Extensions\[email protected] [2016-12-05]
FF Extension: (BitComet Video Downloader) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\Extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [2015-06-10] [not signed]
FF Extension: (Download YouTube Videos as MP4) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2017-05-25]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-11-21]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-11-21]
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-06-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL [No File]
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-299244719-1399796724-3294634451-500: @tools.google.com/Google Update;version=3 -> C:\Users\Administrator\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-25] (Google Inc.)
FF Plugin HKU\S-1-5-21-299244719-1399796724-3294634451-500: @tools.google.com/Google Update;version=9 -> C:\Users\Administrator\AppData\Local\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-25] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npBitCometAgent.dll [2012-01-12] (BitComet)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)

Chrome:
=======
CHR DefaultProfile: Profile 1
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default [2017-05-22]
CHR Extension: (A Good Movie to watch) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahpdggjilcdffpgpkmgcfhmhlhomkfmm [2017-03-07]
CHR Extension: (Google Диск) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (DownAlbum) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgjnhhjpfcdhbhlcmmjppicjmgfkppok [2017-02-07]
CHR Extension: (Google Търсене) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (AdBlock) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-03-10]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-08]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-07]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Guest Profile [2015-06-11]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-05-25]
CHR Extension: (Google Диск) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-06-10]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-10]
CHR Extension: (Google Документи офлайн) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-10]
CHR Extension: (AdBlock) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-18]
CHR Extension: (Avast Online Security) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-05-18]
CHR Extension: (Updateurs) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hgmffafdgliicdpjplbecdjddhkicekf [2017-05-22]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-06-10]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-12]
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\System Profile [2017-05-22]
CHR HKLM\...\Chrome\Extension: [daanglpcpkjjlkhcbladppjphglbigam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [dhigneefebkcagnpnpbibganpmfgebnk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome.7NNAC2DCODL2MFYEJRXT4CMY3Q - C:\Users\Administrator\AppData\Local\Google\Chrome\Application\chrome.exe
StartMenuInternet: Google Chrome.Visitor - C:\Users\Visitor\AppData\Local\Google\Chrome\Application\chrome.exe

Opera:
=======
OPR Extension: (No Name) - C:\Users\Administrator\AppData\Roaming\Opera Software\Opera Stable\Extensions\lnpddjhhjmmcnjbjdbopmniafbpfppkb [2015-05-28]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AgentService; C:\Program Files\LibraryClient\globalLibx32\service.exe [46592 2012-02-20] () [File not signed]
R2 AGSService; C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-02-27] (Adobe Systems, Incorporated)
R2 AMD FUEL Service; c:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2011-07-13] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-10-17] (AVAST Software)
S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [3398608 2017-05-09] (Malwarebytes)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [104200 2016-10-18] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280864 2016-10-18] (Microsoft Corporation)
R2 OCS Inventory Service; C:\Program Files\OCS Inventory Agent\OcsService.exe [38912 2013-04-08] (OCS Inventory NG) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 ZAMSvc; C:\Program Files\Zemana AntiMalware\ZAM.exe [14522512 2017-04-03] (Copyright 2017.)
U4 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.01; c:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [39424 2011-06-24] (Advanced Micro Devices) [File not signed]
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34008 2016-10-17] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-10-17] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [92256 2016-10-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [91232 2016-10-17] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [60424 2016-10-17] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [735488 2016-10-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433768 2016-10-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [118664 2016-10-17] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [224752 2016-10-17] (AVAST Software)
S3 cxbu0wdm; C:\Windows\System32\DRIVERS\cxbu0wdm.sys [131064 2014-05-14] (HID Global Corporation)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [41984 2008-10-28] (Samsung Electronics Co., Ltd.) [File not signed]
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-17] (Elaborate Bytes AG)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [220088 2017-05-23] (Malwarebytes)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [252808 2016-08-25] (Microsoft Corporation)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2008-10-27] (Samsung Electronics) [File not signed]
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2009-09-19] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2009-09-19] (MCCI Corporation)
R1 ZAM; C:\Windows\System32\drivers\zam32.sys [181496 2017-05-25] (Zemana Ltd.)
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard32.sys [181496 2017-05-25] (Zemana Ltd.)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-07-04] () [File not signed]
U4 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-25 14:05 - 2017-05-25 16:32 - 00041892 _____ C:\Windows\ZAM.krnl.trace
2017-05-25 14:04 - 2017-05-25 16:32 - 00026027 _____ C:\Windows\ZAM_Guard.krnl.trace
2017-05-25 14:04 - 2017-05-25 14:04 - 00181496 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zamguard32.sys
2017-05-25 14:04 - 2017-05-25 14:04 - 00181496 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zam32.sys
2017-05-25 14:04 - 2017-05-25 14:04 - 00001854 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2017-05-25 14:04 - 2017-05-25 14:04 - 00000000 ____D C:\Users\Administrator\AppData\Local\Zemana
2017-05-25 14:04 - 2017-05-25 14:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2017-05-25 14:04 - 2017-05-25 14:04 - 00000000 ____D C:\Program Files\Zemana AntiMalware
2017-05-25 09:22 - 2017-05-25 16:32 - 00000000 ____D C:\FRST
2017-05-17 10:58 - 2017-05-17 10:58 - 00171798 ____T C:\Windows\system32\z
2017-05-17 10:56 - 2017-05-17 10:56 - 00164727 ____T C:\Windows\system32\a
2017-05-11 13:28 - 2017-05-11 13:28 - 00000000 ____D C:\Program Files\Common Files\Skype
2017-05-11 09:45 - 2017-05-23 18:17 - 00000632 __RSH C:\Users\Administrator\ntuser.pol
2017-05-11 01:03 - 2017-04-28 03:36 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-05-11 01:03 - 2017-04-28 03:36 - 03945192 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-05-11 01:03 - 2017-04-28 03:36 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-05-11 01:03 - 2017-04-28 03:36 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-05-11 01:03 - 2017-04-28 03:34 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-05-11 01:03 - 2017-04-28 03:32 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-05-11 01:03 - 2017-04-28 03:11 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-05-11 01:03 - 2017-04-28 03:11 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-05-11 01:03 - 2017-04-28 03:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-05-11 01:03 - 2017-04-28 03:11 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-05-11 01:03 - 2017-04-28 03:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-05-11 01:03 - 2017-04-28 03:09 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-05-11 01:03 - 2017-04-28 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-05-11 01:03 - 2017-04-28 03:07 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-05-11 01:03 - 2017-04-28 03:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-05-11 01:03 - 2017-04-28 03:07 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-05-11 01:03 - 2017-04-28 03:07 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-05-11 01:03 - 2017-04-28 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-05-11 01:03 - 2017-04-28 03:07 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-05-11 01:03 - 2017-04-26 17:51 - 02400768 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-05-11 01:03 - 2017-04-21 18:15 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-05-11 01:03 - 2017-04-20 02:16 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 01417728 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00377344 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:54 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-05-11 01:03 - 2017-04-17 17:51 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-05-11 01:03 - 2017-04-17 17:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-11 01:03 - 2017-04-17 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-11 01:03 - 2017-04-16 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-05-11 01:03 - 2017-04-16 11:19 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-05-11 01:03 - 2017-04-16 11:02 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-05-11 01:03 - 2017-04-16 11:01 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-05-11 01:03 - 2017-04-16 11:01 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-05-11 01:03 - 2017-04-16 11:01 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-05-11 01:03 - 2017-04-16 11:00 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-05-11 01:03 - 2017-04-16 10:53 - 02290176 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-05-11 01:03 - 2017-04-16 10:52 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-05-11 01:03 - 2017-04-16 10:52 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-05-11 01:03 - 2017-04-16 10:49 - 20278272 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-05-11 01:03 - 2017-04-16 10:48 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-05-11 01:03 - 2017-04-16 10:47 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-05-11 01:03 - 2017-04-16 10:47 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-05-11 01:03 - 2017-04-16 10:47 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-05-11 01:03 - 2017-04-16 10:46 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-05-11 01:03 - 2017-04-16 10:39 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-05-11 01:03 - 2017-04-16 10:35 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-05-11 01:03 - 2017-04-16 10:30 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-05-11 01:03 - 2017-04-16 10:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-05-11 01:03 - 2017-04-16 10:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-05-11 01:03 - 2017-04-16 10:25 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-05-11 01:03 - 2017-04-16 10:24 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-05-11 01:03 - 2017-04-16 10:22 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-05-11 01:03 - 2017-04-16 10:20 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-05-11 01:03 - 2017-04-16 10:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-05-11 01:03 - 2017-04-16 10:10 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-05-11 01:03 - 2017-04-16 10:10 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-05-11 01:03 - 2017-04-16 10:08 - 04548608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-05-11 01:03 - 2017-04-16 10:08 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-05-11 01:03 - 2017-04-16 10:08 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-05-11 01:03 - 2017-04-16 09:53 - 13661184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-05-11 01:03 - 2017-04-16 09:37 - 02767872 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-05-11 01:03 - 2017-04-16 09:34 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-05-11 01:03 - 2017-04-16 09:34 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-05-11 01:03 - 2017-04-12 18:26 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-05-11 01:03 - 2017-04-12 18:25 - 01176064 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-05-11 01:03 - 2017-04-12 18:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-05-11 01:03 - 2017-04-12 18:25 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-05-11 01:03 - 2017-04-07 18:26 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-05-11 01:03 - 2017-04-07 18:26 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-05-11 01:03 - 2017-04-07 18:21 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-05-11 01:03 - 2017-04-07 18:20 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-05-11 01:03 - 2017-04-05 18:00 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-05-11 01:03 - 2017-04-05 18:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-05-11 01:03 - 2017-04-05 18:00 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-05-11 01:03 - 2017-04-04 18:25 - 01309928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-05-11 01:03 - 2017-04-04 18:25 - 00240872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-05-11 01:03 - 2017-04-04 18:25 - 00187624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-05-11 01:03 - 2017-04-04 17:52 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-05-11 01:03 - 2017-04-04 17:52 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-05-11 01:03 - 2017-03-10 19:20 - 01508352 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2017-05-11 01:03 - 2017-03-10 19:20 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2017-05-11 01:03 - 2017-03-10 18:52 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\plasrv.exe
2017-05-11 01:03 - 2017-03-10 18:51 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2017-05-11 01:03 - 2017-03-10 18:51 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2017-05-11 01:03 - 2017-03-09 19:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-05-10 11:27 - 2017-05-25 09:51 - 00001014 __RSH C:\Users\Visitor\ntuser.pol
2017-05-10 09:59 - 2017-05-10 10:04 - 00000000 ____D C:\Users\Visitor\AppData\LocalLow\Mozilla

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-25 14:41 - 2016-12-05 15:34 - 00000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2017-05-25 14:05 - 2010-10-25 14:50 - 00000000 ____D C:\Users\Administrator
2017-05-25 14:04 - 2015-09-25 11:23 - 00008192 ___SH C:\Users\Administrator\Thumbs.db
2017-05-25 13:09 - 2011-04-04 16:21 - 00000972 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-299244719-1399796724-3294634451-1005Core.job
2017-05-25 09:51 - 2010-10-25 14:45 - 00000000 ____D C:\Users\Visitor
2017-05-25 09:09 - 2013-04-11 15:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-05-25 09:05 - 2016-12-05 15:33 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-05-25 02:00 - 2010-10-30 10:53 - 00000000 ____D C:\Users\Administrator\AppData\Local\Adobe
2017-05-24 09:09 - 2013-08-14 18:06 - 00000000 ____D C:\Windows\system32\MRT
2017-05-24 09:00 - 2010-10-24 18:39 - 129479984 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-23 16:45 - 2009-07-14 07:34 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-23 16:45 - 2009-07-14 07:34 - 00020832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-23 16:38 - 2017-03-10 09:49 - 00220088 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-23 16:36 - 2017-03-22 12:09 - 00000000 ____D C:\Program Files\Common Files\McAfee
2017-05-23 16:36 - 2015-12-04 01:04 - 00000000 ____D C:\Program Files\Common Files\AV
2017-05-23 16:36 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-23 16:35 - 2011-03-25 20:39 - 00000000 ____D C:\ProgramData\McAfee
2017-05-23 16:33 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\inf
2017-05-22 16:30 - 2017-02-22 16:16 - 00000000 ____D C:\ProgramData\Ashampoo
2017-05-22 16:01 - 2017-03-10 09:49 - 00001986 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-05-22 16:00 - 2017-03-10 09:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-22 15:18 - 2017-03-22 12:09 - 00000000 ____D C:\Program Files\McAfee
2017-05-22 14:42 - 2014-11-26 11:41 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Google
2017-05-18 08:48 - 2010-10-24 19:26 - 01425750 _____ C:\Windows\system32\perfh01F.dat
2017-05-18 08:48 - 2010-10-24 19:26 - 00880564 _____ C:\Windows\system32\perfc01F.dat
2017-05-18 08:48 - 2010-10-24 18:25 - 00006452 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-16 05:17 - 2013-09-25 11:13 - 00002105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-12 17:37 - 2016-07-13 10:25 - 00000000 ____D C:\Windows\rescache
2017-05-11 13:28 - 2013-09-25 13:32 - 00000000 ___RD C:\Program Files\Skype
2017-05-11 13:28 - 2010-10-24 18:32 - 00000000 ____D C:\ProgramData\Skype
2017-05-11 09:21 - 2009-07-14 07:33 - 03763560 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-11 09:18 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-05-10 10:59 - 2014-04-15 11:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Carambis
2017-05-10 10:59 - 2014-04-15 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carambis
2017-05-10 10:59 - 2014-04-15 11:32 - 00000000 ____D C:\Program Files\Carambis
2017-05-10 10:59 - 2010-10-25 14:24 - 00000000 ____D C:\Users\Librarian
2017-05-10 09:59 - 2010-10-31 14:30 - 00000000 ____D C:\Users\Visitor\AppData\Local\Mozilla
2017-05-10 09:17 - 2010-10-24 20:22 - 00000039 _____ C:\Windows\vbaddin.ini
2017-05-09 16:37 - 2017-03-10 09:48 - 00059904 _____ C:\Windows\system32\Drivers\mbae.sys

==================== Files in the root of some directories =======

2013-01-19 10:44 - 2013-01-19 10:44 - 2174976 _____ (Advanced Micro Devices Inc.) C:\Program Files\Common Files\atimpenc.dll
2013-09-23 12:52 - 2015-02-17 13:54 - 0000135 _____ () C:\Users\Administrator\AppData\Roaming\WB.CFG
2010-10-29 19:41 - 2014-09-12 13:09 - 0008082 _____ () C:\Users\Administrator\AppData\Roaming\XeroxFaxOptions.xml
2010-10-26 17:33 - 2010-10-26 17:33 - 0000017 _____ () C:\Users\Administrator\AppData\Local\resmon.resmoncfg
2016-03-13 15:44 - 2016-03-13 15:44 - 0000000 _____ () C:\Users\Administrator\AppData\Local\{922103B9-20F4-4D54-81F7-9D2B835CCA02}

Some files in TEMP:
====================
2017-05-23 16:35 - 2016-11-28 09:21 - 1027864 _____ (McAfee, Inc.) C:\Users\Administrator\AppData\Local\Temp\0173931495546510McInst.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-13 00:05

==================== End of FRST.txt ===========================

Addition.txt

Сега се налага да излизам служебно....Ще огледам подробно дневниците довечера и ще напиша скрипт...Определено има какво да се пипне...През това време ще ви помоля да направите следното:

Старт меню => Принадлежности => Системни инструменти => Resource Monitor..стартирате инструмента:

Resource%20Monitor%20%287%29_thumb.png

 

Поставете отметка в квадратчетата в ляво на процеса който товари . След това отивате в таб "CPU"

 

Resource%20Monitor%20%288%29_thumb.png
Вече се виждат всички услуги които работят във фонов режим със съответния процес.Пишете коя е тя....!

 

image_3.png

 

 

Хубаво е да ми ги напишете или да направите снимка..!!! 

 

Фикс с Farbar Recovery Scan Tool

icon13.gif Изтеглете прикачения файл fixlist.txt   и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Press%20the%20FIX%20button_zpsdd5zi3mt.p


Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.
 
ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

 

pfNZP4A.png  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FixLog.txt
  • Автор

Съжелявам за закъснението.

Снимката е направена преди сканирането,да не ми е проблема хрома пак ми работи бавно.Пуснах клип от вбокс защото в покой не товари изобщо

П.П. с мозилата ми работи по добре от колкото в хрома

Fixlog.txt

Untitled.jpg

Редактирано от valyo_93 (преглед на промените)

Цитат

Компютъра ми работи бавно след като си заразих фейзбука с вирус

Чакай сега ..По заглавието аз разбирам че компютъра ви като цялао работи бавно..!?! Сега от последния ви пост ми говорите за браузъра Хром.....Това са малко различни работи..! Уточнете подробно кое по системата ви работи бавно..???

  • Автор

Извинявам се за объркването.Компютъра се ползва главно за интернет и ми работеше бавно в интернет.Върнах фабрични настроики на хрома и се оправи.Благодаря ви за помоща

т.е сега всичко е наред ..? Така и така сме почнали да направим още една провека и приключваме:

BY4dvz9.png Сканиране с AdwCleaner

 
Моля, изтеглете и стартирайте програмата Malwarebytes AdwCleaner (by Xplode):

  • Затворете всички стартирани програми и браузъри
  • Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.
  • Натиснете OK, за да потвърдите, че всички стартирани програми ще бъдат затворени.
  • Маркирайте A49sxPr.pngScan (провери).
  • След завършване, кликнете на 6cyn5v5.pngLogfile (дневник).Ще се отвори прозорец в който се намира дневника (AdwCleaner [S0] .txt).Кликнете два пъти върх реда и ще се отвори съдържанието на дневника.Публикувайте го в следващия си пост
  • Върнете се към основния прозорец на AdwCleaner .маркирайте MqHawIb.pngClean (Почисти)
  • Следвайте указанията и разрешете на компютъра да се рестартира.
  • След рестарта ще се отвори дневник AdwCleaner[C0].txt . Моля копирайте съдържанието на лог файла в следващия си пост.

E3feWj5.png  Сканиране с Junkware Removal Tool
 
Моля, изтеглете Junkware Removal Tool (by Thisisu ) и запазете на вашия десктоп.

  • Спрете временно работата на защитните програми.
  • Стартирайте инструмента JRT.exe
  • Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.
  • Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.
  • Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).
  • Моля копирайте съдържанието на лог файла в следващия си пост.

 

Дневници
 
В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

  • AdwCleaner.txt
  • JRT.txt
  • Автор

С втората програма не ми дава да сканирам като натисна произволен бутон не се маха дос,снимах го

 

# AdwCleaner v6.047 - Logfile created 26/05/2017 at 11:22:47
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-05-26.1 [Server]
# Operating System : Windows 7 Enterprise Service Pack 1 (X86)
# Username : Administrator - GLBG1543PC02
# Running from : D:\Users\Administrator\Desktop\adwcleaner_6.047.exe
# Mode: Scan
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.


***** [ Folders ] *****

Folder Found:  C:\Users\Administrator\AppData\Roaming\Babylon
Folder Found:  C:\ProgramData\Babylon
Folder Found:  C:\ProgramData\Application Data\Babylon
Folder Found:  C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eiimolhnbbbdagljikeckdkldgemmmlj


***** [ Files ] *****

File Found:  C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\invalidprefs.js


***** [ DLL ] *****

No malicious DLLs found.


***** [ WMI ] *****

No malicious keys found.


***** [ Shortcuts ] *****

No infected shortcut found.


***** [ Scheduled Tasks ] *****

No malicious task found.


***** [ Registry ] *****

Key Found:  HKU\.DEFAULT\Software\Classes\keepmysearch
Key Found:  HKU\S-1-5-18\Software\Classes\keepmysearch
Key Found:  HKLM\SOFTWARE\Classes\IMWeb.IMWebControl.1
Key Found:  HKLM\SOFTWARE\Classes\Prod.cap
Key Found:  HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
Key Found:  HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
Key Found:  HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{A8F7D0A5-7074-40B8-9BDC-1174BDD0A132}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{D14D64BC-A0E4-42E3-BB72-FB41EA43C198}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{DD1F043F-ABC8-4643-8B95-D2C5B22BB019}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{E3F3E8F9-F747-4DD6-BA6B-82A6CE1E0860}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{ED0B64D4-BF27-4521-AD27-190F49BF5EA7}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{023E9EC8-B147-40EB-B0B3-DF90618FB371}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{0522D9A4-4D57-437D-978D-E5B3B6C9005D}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{07F41522-AF7D-4F26-B394-094F059FDB8A}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{0C40F472-7407-4467-8914-1DEA7C326972}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{212E6D43-6062-492A-B8CC-144669FF11ED}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{224FE662-1E6D-4BC0-AEBB-9E2FB4057BE9}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{3A807417-B46D-4D37-8C9A-19AC6DE204F9}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{3CC60715-D6C5-429D-830E-43FA3F86C61D}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{4517D94C-19BA-46FA-BE66-2A30CEAC4A85}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{555D7146-94A8-4C94-AE76-C39CDC7F7705}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{59D188FA-757A-424E-8C93-F58FFD896BD7}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{8120D9D6-785C-4413-9C0C-DF2028C56FAD}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{823AE2EB-E62C-4847-B192-C99B91B92416}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{9B4F7CFE-987D-410E-A8E4-20182E0B3C24}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{9B9A45F4-18FC-484A-BACA-076D78273D8E}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{A6D54287-7939-466A-8579-92546D946C8C}
Key Found:  HKLM\SOFTWARE\Classes\Interface\{A78EDAFB-926F-4D93-AB13-8232D7378EB1}
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Key Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Value Found:  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved [{2097A1B6-E86A-4072-A32D-2249A3ECBC5A}]
Key Found:  HKU\S-1-5-19\Software\bProtector
Key Found:  HKU\S-1-5-20\Software\bProtector
Value Found:  HKU\S-1-5-21-299244719-1399796724-3294634451-500\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
Value Found:  HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
Key Found:  HKLM\SOFTWARE\Classes\CLSID\ForeceRemove


***** [ Web browsers ] *****

No malicious Firefox based browser items found.
Chrome pref Found:  [C:\Users\Visitor\AppData\Local\Google\Chrome\User Data\Default\Web data] - ask.com
Chrome pref Found:  [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] - ask.com
Chrome pref Found:  [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] - yahoo! search
Chrome pref Found:  [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] - dts.search.ask.com
Chrome pref Found:  [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] - dsrlte.com
Chrome pref Found:  [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences ] - fcfenmboojpjinhpgggodefccipikbpd
Chrome pref Found:  [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] - ask.com

[!] You may need to disable the Chrome synchronization from your Google account in order to fully remove the malicious preferences. Please consult this Google help: https://support.google.com/chrome/answer/3097271?hl=en [!]


*************************

C:\AdwCleaner\AdwCleaner[S0].txt - [5364 Bytes] - [26/05/2017 11:22:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5437 Bytes] ##########
 

 

# AdwCleaner v6.047 - Logfile created 26/05/2017 at 11:24:27
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-05-26.1 [Server]
# Operating System : Windows 7 Enterprise Service Pack 1 (X86)
# Username : Administrator - GLBG1543PC02
# Running from : D:\Users\Administrator\Desktop\adwcleaner_6.047.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\Administrator\AppData\Roaming\Babylon
[-] Folder deleted: C:\ProgramData\Babylon
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Babylon
[-] Folder deleted: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\eiimolhnbbbdagljikeckdkldgemmmlj


***** [ Files ] *****

[-] File deleted: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\2bbrihkd.default\invalidprefs.js


***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKU\.DEFAULT\Software\Classes\keepmysearch
[#] Key deleted on reboot: HKU\S-1-5-18\Software\Classes\keepmysearch
[-] Key deleted: HKLM\SOFTWARE\Classes\IMWeb.IMWebControl.1
[-] Key deleted: HKLM\SOFTWARE\Classes\Prod.cap
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{A8F7D0A5-7074-40B8-9BDC-1174BDD0A132}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{D14D64BC-A0E4-42E3-BB72-FB41EA43C198}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{DD1F043F-ABC8-4643-8B95-D2C5B22BB019}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{E3F3E8F9-F747-4DD6-BA6B-82A6CE1E0860}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{ED0B64D4-BF27-4521-AD27-190F49BF5EA7}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{023E9EC8-B147-40EB-B0B3-DF90618FB371}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{0522D9A4-4D57-437D-978D-E5B3B6C9005D}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{07F41522-AF7D-4F26-B394-094F059FDB8A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{0C40F472-7407-4467-8914-1DEA7C326972}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{212E6D43-6062-492A-B8CC-144669FF11ED}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{224FE662-1E6D-4BC0-AEBB-9E2FB4057BE9}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{3A807417-B46D-4D37-8C9A-19AC6DE204F9}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{3CC60715-D6C5-429D-830E-43FA3F86C61D}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{4517D94C-19BA-46FA-BE66-2A30CEAC4A85}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{555D7146-94A8-4C94-AE76-C39CDC7F7705}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{59D188FA-757A-424E-8C93-F58FFD896BD7}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8120D9D6-785C-4413-9C0C-DF2028C56FAD}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{823AE2EB-E62C-4847-B192-C99B91B92416}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{9B4F7CFE-987D-410E-A8E4-20182E0B3C24}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{9B9A45F4-18FC-484A-BACA-076D78273D8E}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{A6D54287-7939-466A-8579-92546D946C8C}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{A78EDAFB-926F-4D93-AB13-8232D7378EB1}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved [{2097A1B6-E86A-4072-A32D-2249A3ECBC5A}]
[-] Key deleted: HKU\S-1-5-19\Software\bProtector
[-] Key deleted: HKU\S-1-5-20\Software\bProtector
[-] Value deleted: HKU\S-1-5-21-299244719-1399796724-3294634451-500\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[#] Value deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\ForeceRemove


***** [ Web browsers ] *****

[-] [C:\Users\Visitor\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: yahoo! search
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: dts.search.ask.com
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: dsrlte.com
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: fcfenmboojpjinhpgggodefccipikbpd
[-] [C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Profile 1\Web data] [Search Provider] Deleted: ask.com


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [5316 Bytes] - [26/05/2017 11:24:27]
C:\AdwCleaner\AdwCleaner[S0].txt - [5516 Bytes] - [26/05/2017 11:22:47]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [5462 Bytes] ##########
 

Untitled.jpg

преди 10 минути, valyo_93 написа:

С втората програма не ми дава да сканирам като натисна произволен бутон не се маха дос,снимах го

Рестартирайте компютъра си и вижте дали всичко по системата ви е наред...! Премахнахме всички остатъци от заразата..! След това ако всичко е наред:

 

7k2Zu73R.png.0a6a6ba63fa68fb3917cffc81bf0ccab.png Изтеглете DelFix и го стартирайте. Сложете отметка пред:

  • Remove disinfection tools <----- това ще премахне инструментите които сме използвали
  • Create registry backup <----- тази опция ще създадете резервно копие от регистъра на Windows
  • Purge system restore <---  това ще премахне всички предишни точки за възстановяване, ще бъде създадена нова точка  на състоянието на системата в момента.
  • Reset system settings <--- това ще нулира всички настройки на системата и по подразбиране, които са били променени или от нас по време на почистването или от зловреден софтуер / инфекция

DelFix.png.6f92057f93286acd2741e87aeb5876d9.png

..и след това натиснете бутона Run

  • След като операцията е завърши,ще се създаде дневник
  • Копирате го и го поставите в следващия си отговор

Инструмента ще се самоизтрие след като приключи своята задача!

Ако има нещо което използвахме в лечението до тук и не се е премахнало след последните инструкции го премахнете ръчно ,по стандартните методи..!

 

i_arrow-r.gif Деинсатлирайте Zemana AntiMalware по стандартния метод...!

 

pfNZP4A.png  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • DelFix
  • Автор

# DelFix v1.013 - Logfile created 26/05/2017 at 13:13:43
# Updated 17/04/2016 by Xplode
# Username : Administrator - GLBG1543PC02
# Operating System : Windows 7 Enterprise Service Pack 1 (32 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : D:\Users\Administrator\Desktop\Addition.txt
Deleted : D:\Users\Administrator\Desktop\AdwCleaner[C0].txt
Deleted : D:\Users\Administrator\Desktop\AdwCleaner[S0].txt
Deleted : D:\Users\Administrator\Desktop\adwcleaner_6.047.exe
Deleted : D:\Users\Administrator\Desktop\Fixlog.txt
Deleted : D:\Users\Administrator\Desktop\FRST.exe
Deleted : D:\Users\Administrator\Desktop\FRST.txt
Deleted : D:\Users\Administrator\Desktop\JRT.exe
Deleted : HKLM\SOFTWARE\AdwCleaner

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #787 [Windows Update | 05/17/2017 06:43:23]
Deleted : RP #788 [Windows Update | 05/20/2017 14:33:52]
Deleted : RP #789 [Windows Update | 05/23/2017 21:53:25]
Deleted : RP #790 [Windows Update | 05/24/2017 06:00:10]
Deleted : RP #792 [Restore Point Created by FRST | 05/26/2017 06:34:16]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########
 

Това е ..! :) Ако нямате други проблеми и въпроси да приключваме...Маркирам случая за "Решен"...! Пожелавам лек ден и безопасен интернет..! :)

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.