Здравейте!!! Проблема с лаптопа е следния. Още от самото зареждане лаптопа включва много бавно, някъде около 5 мин му трябва за пълно зареждане. Също така вентилатора постоянно работи на 90-100 % дори и да няма нищо включено на него. Също така при стартиране на Chromе постоянно излизат някакви страници. Затворя едната, заредят се още няколко и така няколко минути докато успея да затворя всичките!!! Благодаря!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-06-2017
Ran by User (administrator) on ADMIN (02-06-2017 18:08:27)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 8 (X64) Language: Английски (Великобритания)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
(Aztec Media Inc) C:\Program Files (x86)\Assets Manager\smdmf\SmdmFService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
() C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe
(Chris Pietschmann (hxxp://pietschsoft.com)) C:\Program Files (x86)\Virtual Router\VirtualRouterService.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2864016 2012-08-10] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] => "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-10-13] (Apple Inc.)
HKLM-x32\...\Run: [BakupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [533056 2012-07-31] (NTI Corporation)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-10-14] (AVAST Software)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2087264 2014-09-11] (Wondershare)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [2144448 2017-05-16] (BitTorrent Inc.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Viber] => C:\Users\User\AppData\Local\Viber\Viber.exe [69268048 2016-04-13] (Viber Media S.à r.l.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53729824 2015-08-07] (Skype Technologies S.A.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {0cbb58ed-85f7-11e4-beda-083e8e298a92} - "E:\Lenovo_Suite.exe" 
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {594b45e6-3da5-11e4-bea9-083e8e298a92} - "E:\Autorun.exe" 
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {92606a33-1e4f-11e4-be85-083e8e298a92} - "F:\SETUP.EXE" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Users\User\AppData\Local\Linkey\IEEXTE~1\iedll64.dll => C:\Users\User\AppData\Local\Linkey\IEExtension\iedll64.dll [202256 2014-08-31] (Aztec Media Inc)
AppInit_DLLs:  C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => No File
AppInit_DLLs-x32: C:\Users\User\AppData\Local\Linkey\IEEXTE~1\iedll.dll => C:\Users\User\AppData\Local\Linkey\IEExtension\iedll.dll [175632 2014-08-31] (Aztec Media Inc)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2014-10-14] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Virtual Router Manager.lnk [2015-02-17]
ShortcutTarget: Virtual Router Manager.lnk -> C:\Windows\Installer\{BE905C46-2B34-4D73-AEE1-769ED138E0FF}\_118D1A4EFFA6998C3492EB.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54841;https=127.0.0.1:54841
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{06F1E4B9-9631-4C9B-B37A-1B2BC33E1255}: [DhcpNameServer] 46.40.72.9 46.40.72.13
Tcpip\..\Interfaces\{98A8C6A8-AA5E-46BE-96AD-8A46F61843A9}: [NameServer] 85.118.197.4 85.118.197.68
Tcpip\..\Interfaces\{E9F2B73D-E145-4B45-8212-E6A4C558D43C}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{FD6DA41D-3D53-4EB2-A4EE-0431FF427753}: [DhcpNameServer] 192.168.43.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6IO1ST166yqKQPgvBBhJetwXR21_ePPyP3Viy5ZUQ8H81oA7t7VZor8RRJ7ywcj5HiWkaU9Y7T-DLCw8j1ciqXa3C-hLy1GHFblj16uivs1fXYTk8YA3ONEcceB3lVPU56Esx8jPTOcVj5PKVK79acETLBHtQCT0RhkFuHq5yyUCw,,&q={searchTerms}
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.default-search.net?sid=503&aid=112&itype=a&ver=15511&tm=500&src=hmp
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://services.freshy.com/general/newhometab.php?hometab=home&partner=10513&guid={CF45166C-F6A2-41F3-84A1-0BBCEB6F9406}&i=
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2503} URL = hxxp://www.default-search.net/search?sid=503&aid=112&itype=a&ver=15511&tm=500&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRwwZO5P6aXKzTCkc_DpK-Oom3IuOOhjy_YxTU2wCcWuAKBtpXg4reBypsU9we34mt8GnfsGWnG9onLvscvK4lRWtZyu-kYwgA,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRwwZO5P6aXKzTCkc_DpK-Oom3IuOOhjy_YxTU2wCcWuAKBtpXg4reBypsU9we34mt8GnfsGWnG9onLvscvK4lRWtZyu-kYwgA,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2503} URL = hxxp://www.default-search.net/search?sid=503&aid=112&itype=a&ver=15511&tm=500&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> DefaultScope {ACC04A0C-61A5-4A08-B1DD-843867EC4869} URL = hxxp://search.us.com/serp?guid={1DF711F6-29CD-4BCC-B7C6-F5123FB754CE}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6IO1ST166yqKQPgvBBhJetwXR21_ePPyP3Viy5ZUQ8H81oA7t7VZor8RRJ7ywcj5HiWkaU9Y7T-DLCw8j1ciqXa3C-hLy1GHFblj16uivs1fXYTk8YA3ONEcceB3lVPU56Esx8jPTOcVj5PKVK79acETLBHtQCT0RhkFuHq5yyUCw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325860&octid=EB_ORIGINAL_CTID&ISID=41e4ffa0-2789-4ca1-87ef-c61b2aab790b&SearchSource=58&CUI=&UM=6&UP=SPC5B0C7C1-99BA-416A-95BF-A7544025CBC4&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {092ACBE8-9A8F-41E4-B96B-6F129956D2F8} URL = hxxp://search.us.com/serp?guid={CF45166C-F6A2-41F3-84A1-0BBCEB6F9406}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {60DD6759-03E1-435C-B1B0-BF47F5772777} URL = hxxps://uk.search.yahoo.com/search?fr=mcafee&type=A011GB662&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {8486C030-9F4A-40DE-A16B-C31A1B514712} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10513
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2503} URL = hxxp://www.default-search.net/search?sid=503&aid=112&itype=a&ver=15511&tm=500&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {ACC04A0C-61A5-4A08-B1DD-843867EC4869} URL = hxxp://search.us.com/serp?guid={1DF711F6-29CD-4BCC-B7C6-F5123FB754CE}&action=default_search&k={searchTerms}
BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)
BHO: Linkey -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> C:\Users\User\AppData\Local\Linkey\IEExtension\iedll64.dll [2014-08-31] (Aztec Media Inc)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-10-14] (AVAST Software)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Framed Display -> {05b5ef3f-4c6a-426e-b77e-48ebb3e721f1} -> C:\Program Files (x86)\Framed Display\FramedDisplaybho.dll [2014-10-10] (Framed Display)
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)
BHO-x32: Linkey -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> C:\Users\User\AppData\Local\Linkey\IEExtension\iedll.dll [2014-08-31] (Aztec Media Inc)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-10-14] (AVAST Software)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 0ojs1dk1.default
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0ojs1dk1.default [2017-06-02]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (avast! Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-14] [not signed]
FF HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff => not found
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-02-17] (VideoLAN)

Chrome: 
=======
CHR HomePage: Default -> hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRw8tAruqDdf2MPpin8M3bOBfRa4ofC9Zpx6Yn43xYXKdFkuxLcbCMuNhEp0cHiaheW5Dsx0XXjqu46FbyHNFG29_TXUAe0ZfQ,,
CHR StartupUrls: Default -> "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRw8tAruqDdf2MPpin8M3bOBfRa4ofC9Zpx6Yn43xYXKdFkuxLcbCMuNhEp0cHiaheW5Dsx0XXjqu46FbyHNFG29_TXUAe0ZfQ,,","hxxps://www.google.com/"
CHR NewTab: Default ->  Active:"chrome-extension://nngdfnnnkccipoglcgppagpgjkkbfclo/index.html"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-06-02]
CHR Extension: (Google Документи) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-05-16]
CHR Extension: (Golden) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\clbpamihokmeaiockbfmfoaflpcbkheb [2016-10-19]
CHR Extension: (Google Търсене) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (Linkey) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmeembnagmagppkgghhfjfdfajdfcah [2015-02-09]
CHR Extension: (Google Документи офлайн) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]
CHR Extension: (TelevisionFanatic) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhfhkgkmljpbkafmkljgfmaokgcaiiee [2015-02-14]
CHR Extension: (Allin1Convert) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmabjcmofdemkaaekcmpocognlfonepb [2015-02-14]
CHR Extension: (Skype) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-03-22]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-22]
CHR Extension: (goMovix Start) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nngdfnnnkccipoglcgppagpgjkkbfclo [2015-10-17]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-22]
CHR HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [fpmeembnagmagppkgghhfjfdfajdfcah] - C:\Users\User\AppData\Local\Linkey\ChromeExtension\ChromeExtension.crx [2014-10-14]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-14]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-14] (AVAST Software)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2415760 2012-07-27] (Acer Incorporated)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-07-31] (NTI Corporation)
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [7953776 2016-09-28] (Reimage®)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-20] (Dritek System INC.)
R2 SmdmFService; C:\Program Files (x86)\Assets Manager\smdmf\SmdmFService.exe [3570704 2015-01-28] (Aztec Media Inc)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
R2 Update Framed Display; C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe [522488 2014-10-10] ()
R2 Virtual Router; C:\Program Files (x86)\Virtual Router\VirtualRouterService.exe [12288 2013-02-10] (Chris Pietschmann (hxxp://pietschsoft.com)) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-14] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-10-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-14] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-10-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-10-14] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-10-14] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-10-14] ()
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R1 F06DEFF2-5B9C-490D-910F-35D3A91196222; C:\Program Files (x86)\Assets Manager\smdmf\x64\smdmfmgrc3.cfg [45968 2015-01-28] (Aztec Media Inc)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-20] (Dritek System Inc.)
S3 ssudobex; C:\Windows\system32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)
S3 AthBTPort; \SystemRoot\system32\DRIVERS\btath_flt.sys [X]
S3 BTATH_A2DP; \SystemRoot\system32\drivers\btath_a2dp.sys [X]
S3 btath_avdt; \SystemRoot\system32\drivers\btath_avdt.sys [X]
S3 BTATH_BUS; \SystemRoot\System32\drivers\btath_bus.sys [X]
S3 BTATH_HCRP; \SystemRoot\System32\drivers\btath_hcrp.sys [X]
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]
S3 BTATH_RCP; \SystemRoot\System32\drivers\btath_rcp.sys [X]
S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-02 18:08 - 2017-06-02 18:09 - 00024935 _____ C:\Users\User\Downloads\FRST.txt
2017-06-02 18:08 - 2017-06-02 18:08 - 00000000 ____D C:\FRST
2017-06-02 18:06 - 2017-06-02 18:07 - 00000000 ____D C:\Users\User\AppData\Roaming\Geek Uninstaller
2017-06-02 18:05 - 2017-06-02 18:05 - 02433536 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2017-06-02 18:05 - 2017-05-15 10:40 - 06914496 _____ (Geek Unіnstaller) C:\Users\User\Desktop\geek.exe
2017-06-02 17:56 - 2017-06-02 17:57 - 02777872 _____ C:\Users\User\Desktop\geek.zip
2017-05-19 17:47 - 2017-05-19 17:47 - 00085999 _____ C:\Users\User\Desktop\CV.pdf
2017-05-16 20:15 - 2017-05-22 11:33 - 00000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
2017-05-16 19:42 - 2017-05-16 19:55 - 1488202030 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.avi
2017-05-16 19:42 - 2017-05-16 19:42 - 00000687 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.nfo
2017-05-16 19:40 - 2017-05-16 19:41 - 00015067 _____ C:\Users\User\Downloads\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.torrent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-02 18:07 - 2015-03-08 20:15 - 00000000 ____D C:\ProgramData\smdmf
2017-06-02 17:55 - 2014-07-20 19:37 - 00000141 _____ C:\Windows\Reimage.ini
2017-06-02 17:53 - 2015-06-01 09:49 - 00000000 ____D C:\Users\User\AppData\Roaming\Foxit Software
2017-06-02 17:52 - 2014-08-07 18:53 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2017-06-02 17:52 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\Inf
2017-06-02 17:51 - 2014-07-20 12:00 - 00002159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-02 17:51 - 2014-07-20 12:00 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-06-02 17:48 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-06-02 17:48 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Acer
2017-06-02 17:48 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files (x86)\Acer
2017-05-29 08:14 - 2012-07-26 08:28 - 00848230 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-29 08:10 - 2016-04-15 22:33 - 00000000 ____D C:\Users\User\AppData\Roaming\ViberPC
2017-05-29 08:10 - 2014-10-14 16:33 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2017-05-29 08:07 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-22 11:33 - 2014-10-02 17:55 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2017-05-19 19:06 - 2014-10-14 23:08 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2017-05-16 19:44 - 2017-01-26 19:40 - 24944640 ____R C:\Users\User\Desktop\sample.avi
2017-05-16 19:40 - 2014-07-20 11:58 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-16 19:40 - 2014-07-20 11:58 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-09-15 19:34 - 2015-09-15 19:34 - 0000000 _____ () C:\Users\User\AppData\Local\{0ED07D18-B92D-4D56-AAE8-CEFE829952C9}
2012-08-20 02:12 - 2012-08-20 02:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
2014-08-07 18:51 - 2014-08-07 18:52 - 0038480 _____ () C:\Users\User\AppData\Local\Temp\bitool.dll
2014-10-14 19:37 - 2014-10-14 19:37 - 5600000 _____ () C:\Users\User\AppData\Local\Temp\CloudBackup6729.exe
2014-10-10 21:23 - 2014-10-10 21:23 - 5601864 _____ () C:\Users\User\AppData\Local\Temp\CloudBackup8104.exe
2014-04-13 16:07 - 2014-04-13 16:07 - 0204656 _____ (Conduit) C:\Users\User\AppData\Local\Temp\dlLogic.exe
2014-10-14 16:52 - 2014-10-14 16:52 - 0041984 _____ () C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsuc93v.dll
2014-01-31 04:29 - 2014-01-31 04:29 - 0341120 _____ (Gretech Corporation) C:\Users\User\AppData\Local\Temp\ExPromo.exe
2017-06-02 17:53 - 2015-04-22 14:53 - 4881120 _____ (Foxit Corporation) C:\Users\User\AppData\Local\Temp\FoxitUpdater.exe
2017-06-02 18:06 - 2017-06-02 18:06 - 3932096 _____ (Geek Unіnstaller) C:\Users\User\AppData\Local\Temp\geek64.exe
2015-09-06 16:16 - 2015-09-06 16:16 - 0010240 _____ () C:\Users\User\AppData\Local\Temp\GrLauncherTempSetup.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nsa8867.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nsfD4B5.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nso847E.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nsxD9A8.exe
2014-11-12 20:49 - 2010-06-17 15:09 - 0149352 ____R (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\ose00000.exe
2015-05-10 21:27 - 2007-04-17 01:05 - 0145184 ____R (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\ose00001.exe
2014-07-20 19:39 - 2016-11-05 12:42 - 13416528 _____ (Reimage) C:\Users\User\AppData\Local\Temp\ReimagePackage.exe
2015-07-09 21:34 - 2015-09-20 14:02 - 40693792 _____ (Skype Technologies S.A.) C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
2014-10-10 21:39 - 2014-10-10 21:39 - 28436968 _____ () C:\Users\User\AppData\Local\Temp\Softonic_EN_1-5-11_EN-Production_10_CleanRelease.exe
2014-07-22 06:28 - 2014-07-22 06:28 - 6824512 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\SPSetup.exe
2014-09-18 21:04 - 2014-09-18 21:54 - 74675720 _____ () C:\Users\User\AppData\Local\Temp\tmd_34015648.exe
2014-07-23 19:26 - 2014-07-23 19:28 - 2211057 _____ () C:\Users\User\AppData\Local\Temp\{10FA3292-8EE4-48ED-AD18-CDD9F2052305}-38.0.2101.0_chrome64_installer.exe
2014-08-06 21:23 - 2014-08-06 21:49 - 0000503 _____ () C:\Users\User\AppData\Local\Temp\{2E313E6B-BBA0-4EC8-86DB-4EE24032657E}-38.0.2114.2_chrome64_installer.exe
2016-01-02 20:40 - 2016-01-02 23:49 - 0000000 _____ () C:\Users\User\AppData\Local\Temp\{4355F74C-5714-4237-B1CF-2814B1F26A12}-49.0.2593.0_chrome_installer_win64.exe
2014-08-07 19:52 - 2014-08-07 20:09 - 6648841 _____ () C:\Users\User\AppData\Local\Temp\{48953895-8D39-4E0B-8EC2-78315F01D740}-38.0.2114.2_chrome64_installer.exe
2016-01-08 21:12 - 2016-01-08 23:02 - 0000000 _____ () C:\Users\User\AppData\Local\Temp\{70D8BBD5-006F-42ED-8B42-C295D738EE54}-49.0.2612.0_chrome_installer_win64.exe
2014-08-11 18:29 - 2014-08-11 22:00 - 0000503 _____ () C:\Users\User\AppData\Local\Temp\{8C163A21-2AD1-41E7-9242-11348CCA6D8C}-38.0.2114.2_chrome64_installer.exe
2016-01-05 00:39 - 2016-01-05 00:41 - 0000000 _____ () C:\Users\User\AppData\Local\Temp\{8DE476FD-32E0-4B35-889C-A854C3182941}-49.0.2593.0_chrome_installer_win64.exe
2014-09-18 03:42 - 2014-09-18 11:33 - 0000503 _____ () C:\Users\User\AppData\Local\Temp\{994C8945-2EF5-4665-86BA-84CF8AFB5D63}-39.0.2159.4_chrome64_installer.exe
2015-11-11 17:44 - 2015-11-11 17:44 - 0253560 _____ () C:\Users\User\AppData\Local\Temp\{AA558608-7D30-4DCA-A530-FEDBED8153FA}-48.0.2560.0_48.0.2552.0_chrome64_updater.exe
2016-01-06 18:00 - 2016-01-08 18:52 - 1785925 _____ () C:\Users\User\AppData\Local\Temp\{EE841DCB-91C1-43AB-8629-C99EFAC46B71}-49.0.2612.0_chrome_installer_win64.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-29 20:39

==================== End of FRST.txt ============================

 

 

 

Addition.txt

Здравейте.

Като за начало деинсталирайте следния софтуер от контролния панел(ако не го намирате или дава грешка при деинсталиране ме уведомете):

Framed Display 
free-4-pc bundle 
Linkey 
Reimage Repair 
Search Protect 
Settings Manager 
Yahoo Community Smartbar
TuneUp Utilities 2014

Когато приключите - създайте нови логове с FRST и ги прикачете към следващия Ви коментар.

Здравейте!!! Деинсталирах 

Framed Display 

free-4-pc bundle 

Linkey 

Reimage Repair

Search Protect

 

TuneUp и Settings manager не ми ги дава като инсталирни т.е. няма ги налични за uninstall, a щом почна да деинсталирам 

Yahoo Community Smartbar , се включва Аваст и изписва Файлов щит блокира заплаха и изброява нещо 18/18 и не се деинсталира

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-06-2017
Ran by User (administrator) on ADMIN (02-06-2017 19:03:27)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 8 (X64) Language: Английски (Великобритания)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Aztec Media Inc) C:\Program Files (x86)\Assets Manager\smdmf\SmdmFService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Chris Pietschmann (hxxp://pietschsoft.com)) C:\Program Files (x86)\Virtual Router\VirtualRouterClient.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Chris Pietschmann (hxxp://pietschsoft.com)) C:\Program Files (x86)\Virtual Router\VirtualRouterService.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Geek Unіnstaller) C:\Users\User\Desktop\geek.exe
(Geek Unіnstaller) C:\Users\User\AppData\Local\Temp\geek64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2864016 2012-08-10] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] => "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-10-13] (Apple Inc.)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-10-14] (AVAST Software)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2087264 2014-09-11] (Wondershare)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [2144448 2017-05-16] (BitTorrent Inc.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Viber] => C:\Users\User\AppData\Local\Viber\Viber.exe [69268048 2016-04-13] (Viber Media S.à r.l.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53729824 2015-08-07] (Skype Technologies S.A.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {0cbb58ed-85f7-11e4-beda-083e8e298a92} - "E:\Lenovo_Suite.exe" 
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {594b45e6-3da5-11e4-bea9-083e8e298a92} - "E:\Autorun.exe" 
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {92606a33-1e4f-11e4-be85-083e8e298a92} - "F:\SETUP.EXE" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs-x32: C:\Users\User\AppData\Local\Linkey\IEEXTE~1\iedll.dll => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2014-10-14] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Virtual Router Manager.lnk [2015-02-17]
ShortcutTarget: Virtual Router Manager.lnk -> C:\Windows\Installer\{BE905C46-2B34-4D73-AEE1-769ED138E0FF}\_118D1A4EFFA6998C3492EB.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54841;https=127.0.0.1:54841
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{06F1E4B9-9631-4C9B-B37A-1B2BC33E1255}: [DhcpNameServer] 46.40.72.9 46.40.72.13
Tcpip\..\Interfaces\{98A8C6A8-AA5E-46BE-96AD-8A46F61843A9}: [NameServer] 85.118.197.4 85.118.197.68
Tcpip\..\Interfaces\{E9F2B73D-E145-4B45-8212-E6A4C558D43C}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{FD6DA41D-3D53-4EB2-A4EE-0431FF427753}: [DhcpNameServer] 192.168.43.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6IO1ST166yqKQPgvBBhJetwXR21_ePPyP3Viy5ZUQ8H81oA7t7VZor8RRJ7ywcj5HiWkaU9Y7T-DLCw8j1ciqXa3C-hLy1GHFblj16uivs1fXYTk8YA3ONEcceB3lVPU56Esx8jPTOcVj5PKVK79acETLBHtQCT0RhkFuHq5yyUCw,,&q={searchTerms}
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.default-search.net?sid=503&aid=112&itype=a&ver=15511&tm=500&src=hmp
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://services.freshy.com/general/newhometab.php?hometab=home&partner=10513&guid={CF45166C-F6A2-41F3-84A1-0BBCEB6F9406}&i=
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2503} URL = hxxp://www.default-search.net/search?sid=503&aid=112&itype=a&ver=15511&tm=500&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRwwZO5P6aXKzTCkc_DpK-Oom3IuOOhjy_YxTU2wCcWuAKBtpXg4reBypsU9we34mt8GnfsGWnG9onLvscvK4lRWtZyu-kYwgA,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRwwZO5P6aXKzTCkc_DpK-Oom3IuOOhjy_YxTU2wCcWuAKBtpXg4reBypsU9we34mt8GnfsGWnG9onLvscvK4lRWtZyu-kYwgA,,&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2503} URL = hxxp://www.default-search.net/search?sid=503&aid=112&itype=a&ver=15511&tm=500&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> DefaultScope {ACC04A0C-61A5-4A08-B1DD-843867EC4869} URL = hxxp://search.us.com/serp?guid={1DF711F6-29CD-4BCC-B7C6-F5123FB754CE}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6IO1ST166yqKQPgvBBhJetwXR21_ePPyP3Viy5ZUQ8H81oA7t7VZor8RRJ7ywcj5HiWkaU9Y7T-DLCw8j1ciqXa3C-hLy1GHFblj16uivs1fXYTk8YA3ONEcceB3lVPU56Esx8jPTOcVj5PKVK79acETLBHtQCT0RhkFuHq5yyUCw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325860&octid=EB_ORIGINAL_CTID&ISID=41e4ffa0-2789-4ca1-87ef-c61b2aab790b&SearchSource=58&CUI=&UM=6&UP=SPC5B0C7C1-99BA-416A-95BF-A7544025CBC4&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {092ACBE8-9A8F-41E4-B96B-6F129956D2F8} URL = hxxp://search.us.com/serp?guid={CF45166C-F6A2-41F3-84A1-0BBCEB6F9406}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {60DD6759-03E1-435C-B1B0-BF47F5772777} URL = hxxps://uk.search.yahoo.com/search?fr=mcafee&type=A011GB662&p={SearchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {8486C030-9F4A-40DE-A16B-C31A1B514712} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10513
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2503} URL = hxxp://www.default-search.net/search?sid=503&aid=112&itype=a&ver=15511&tm=500&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {ACC04A0C-61A5-4A08-B1DD-843867EC4869} URL = hxxp://search.us.com/serp?guid={1DF711F6-29CD-4BCC-B7C6-F5123FB754CE}&action=default_search&k={searchTerms}
BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)
BHO: No Name -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-10-14] (AVAST Software)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)
BHO-x32: Linkey -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> C:\Users\User\AppData\Local\Linkey\IEExtension\iedll.dll => No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-10-14] (AVAST Software)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll [2012-06-02] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 0ojs1dk1.default
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0ojs1dk1.default [2017-06-02]
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0ojs1dk1.default\user.js [2017-06-02]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (avast! Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-14] [not signed]
FF HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff => not found
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-02-17] (VideoLAN)

Chrome: 
=======
CHR HomePage: Default -> hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRw8tAruqDdf2MPpin8M3bOBfRa4ofC9Zpx6Yn43xYXKdFkuxLcbCMuNhEp0cHiaheW5Dsx0XXjqu46FbyHNFG29_TXUAe0ZfQ,,
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR NewTab: Default ->  Not-active:"chrome-extension://nngdfnnnkccipoglcgppagpgjkkbfclo/index.html"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-06-02]
CHR Extension: (Google Документи) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (uBlock Origin) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-06-02]
CHR Extension: (Golden) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\clbpamihokmeaiockbfmfoaflpcbkheb [2016-10-19]
CHR Extension: (Google Търсене) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (Linkey) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmeembnagmagppkgghhfjfdfajdfcah [2015-02-09]
CHR Extension: (Google Документи офлайн) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]
CHR Extension: (Allin1Convert) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmabjcmofdemkaaekcmpocognlfonepb [2015-02-14]
CHR Extension: (Skype) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-03-22]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-22]
CHR Extension: (goMovix Start) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nngdfnnnkccipoglcgppagpgjkkbfclo [2015-10-17]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-22]
CHR HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [fpmeembnagmagppkgghhfjfdfajdfcah] - C:\Users\User\AppData\Local\Linkey\ChromeExtension\ChromeExtension.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-14]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-14] (AVAST Software)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-20] (Dritek System INC.)
R2 SmdmFService; C:\Program Files (x86)\Assets Manager\smdmf\SmdmFService.exe [3570704 2015-01-28] (Aztec Media Inc)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
R2 Virtual Router; C:\Program Files (x86)\Virtual Router\VirtualRouterService.exe [12288 2013-02-10] (Chris Pietschmann (hxxp://pietschsoft.com)) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [X]
S2 Update Framed Display; "C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-14] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-10-14] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-14] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-14] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-10-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-10-14] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-10-14] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-10-14] ()
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R1 F06DEFF2-5B9C-490D-910F-35D3A91196222; C:\Program Files (x86)\Assets Manager\smdmf\x64\smdmfmgrc3.cfg [45968 2015-01-28] (Aztec Media Inc)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-20] (Dritek System Inc.)
S3 ssudobex; C:\Windows\system32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)
S3 AthBTPort; \SystemRoot\system32\DRIVERS\btath_flt.sys [X]
S3 BTATH_A2DP; \SystemRoot\system32\drivers\btath_a2dp.sys [X]
S3 btath_avdt; \SystemRoot\system32\drivers\btath_avdt.sys [X]
S3 BTATH_BUS; \SystemRoot\System32\drivers\btath_bus.sys [X]
S3 BTATH_HCRP; \SystemRoot\System32\drivers\btath_hcrp.sys [X]
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]
S3 BTATH_RCP; \SystemRoot\System32\drivers\btath_rcp.sys [X]
S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-02 18:51 - 2017-06-02 18:53 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-02 18:51 - 2017-06-02 18:51 - 00001070 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-06-02 18:51 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-06-02 18:51 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-06-02 18:51 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-06-02 18:43 - 2017-06-02 18:47 - 00000000 ____D C:\AdwCleaner
2017-06-02 18:43 - 2017-06-02 18:43 - 04110280 _____ C:\Users\User\Desktop\adwcleaner_6.047.exe
2017-06-02 18:10 - 2017-06-02 18:10 - 00034979 _____ C:\Users\User\Downloads\Addition.txt
2017-06-02 18:08 - 2017-06-02 19:03 - 00023227 _____ C:\Users\User\Downloads\FRST.txt
2017-06-02 18:08 - 2017-06-02 19:03 - 00000000 ____D C:\FRST
2017-06-02 18:06 - 2017-06-02 18:07 - 00000000 ____D C:\Users\User\AppData\Roaming\Geek Uninstaller
2017-06-02 18:05 - 2017-06-02 18:05 - 02433536 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2017-06-02 18:05 - 2017-05-15 10:40 - 06914496 _____ (Geek Unіnstaller) C:\Users\User\Desktop\geek.exe
2017-05-19 17:47 - 2017-05-19 17:47 - 00085999 _____ C:\Users\User\Desktop\CV.pdf
2017-05-16 20:15 - 2017-05-22 11:33 - 00000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
2017-05-16 19:42 - 2017-05-16 19:55 - 1488202030 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.avi
2017-05-16 19:42 - 2017-05-16 19:42 - 00000687 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.nfo
2017-05-16 19:40 - 2017-05-16 19:41 - 00015067 _____ C:\Users\User\Downloads\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.torrent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-02 18:56 - 2014-07-20 19:37 - 00000141 _____ C:\Windows\Reimage.ini
2017-06-02 18:53 - 2014-10-10 21:24 - 00000000 ____D C:\Program Files (x86)\Framed Display
2017-06-02 18:46 - 2014-07-14 15:15 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3835505473-1799193542-3545088410-1001
2017-06-02 18:39 - 2014-10-14 16:33 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2017-06-02 18:37 - 2012-07-26 08:28 - 00848230 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-02 18:37 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\Inf
2017-06-02 18:34 - 2016-04-15 22:33 - 00000000 ____D C:\Users\User\AppData\Roaming\ViberPC
2017-06-02 18:32 - 2015-03-08 20:15 - 00000000 ____D C:\ProgramData\smdmf
2017-06-02 18:32 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-02 18:31 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-06-02 18:30 - 2012-08-20 02:35 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll
2017-06-02 18:30 - 2012-08-03 03:28 - 00000000 ____D C:\Program Files (x86)\NTI
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files\Acer
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files (x86)\Acer
2017-06-02 18:24 - 2012-08-03 03:28 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-06-02 18:19 - 2014-10-14 19:41 - 00000000 ____D C:\Program Files (x86)\Settings Manager
2017-06-02 18:16 - 2016-02-27 01:42 - 00000000 ____D C:\Users\User\AppData\Roaming\BSplayer
2017-06-02 18:16 - 2016-02-27 01:42 - 00000000 ____D C:\Program Files (x86)\Webteh
2017-06-02 17:53 - 2015-06-01 09:49 - 00000000 ____D C:\Users\User\AppData\Roaming\Foxit Software
2017-06-02 17:52 - 2014-08-07 18:53 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2017-06-02 17:51 - 2014-07-20 12:00 - 00002159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-02 17:51 - 2014-07-20 12:00 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-06-02 17:48 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Acer
2017-05-22 11:33 - 2014-10-02 17:55 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2017-05-19 19:06 - 2014-10-14 23:08 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2017-05-16 19:44 - 2017-01-26 19:40 - 24944640 ____R C:\Users\User\Desktop\sample.avi
2017-05-16 19:40 - 2014-07-20 11:58 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-16 19:40 - 2014-07-20 11:58 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-09-15 19:34 - 2015-09-15 19:34 - 0000000 _____ () C:\Users\User\AppData\Local\{0ED07D18-B92D-4D56-AAE8-CEFE829952C9}
2012-08-20 02:12 - 2012-08-20 02:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
2014-08-07 18:51 - 2014-08-07 18:52 - 0038480 _____ () C:\Users\User\AppData\Local\Temp\bitool.dll
2014-10-14 19:37 - 2014-10-14 19:37 - 5600000 _____ () C:\Users\User\AppData\Local\Temp\CloudBackup6729.exe
2014-10-10 21:23 - 2014-10-10 21:23 - 5601864 _____ () C:\Users\User\AppData\Local\Temp\CloudBackup8104.exe
2014-04-13 16:07 - 2014-04-13 16:07 - 0204656 _____ (Conduit) C:\Users\User\AppData\Local\Temp\dlLogic.exe
2014-10-14 16:52 - 2014-10-14 16:52 - 0041984 _____ () C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsuc93v.dll
2014-01-31 04:29 - 2014-01-31 04:29 - 0341120 _____ (Gretech Corporation) C:\Users\User\AppData\Local\Temp\ExPromo.exe
2017-06-02 17:53 - 2015-04-22 14:53 - 4881120 _____ (Foxit Corporation) C:\Users\User\AppData\Local\Temp\FoxitUpdater.exe
2017-06-02 18:06 - 2017-06-02 18:06 - 3932096 _____ (Geek Unіnstaller) C:\Users\User\AppData\Local\Temp\geek64.exe
2015-09-06 16:16 - 2015-09-06 16:16 - 0010240 _____ () C:\Users\User\AppData\Local\Temp\GrLauncherTempSetup.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nsa8867.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nsfD4B5.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nso847E.exe
2014-07-16 13:01 - 2014-07-16 13:01 - 0156061 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\nsxD9A8.exe
2014-11-12 20:49 - 2010-06-17 15:09 - 0149352 ____R (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\ose00000.exe
2015-05-10 21:27 - 2007-04-17 01:05 - 0145184 ____R (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\ose00001.exe
2014-07-20 19:39 - 2016-11-05 12:42 - 13416528 _____ (Reimage) C:\Users\User\AppData\Local\Temp\ReimagePackage.exe
2015-07-09 21:34 - 2015-09-20 14:02 - 40693792 _____ (Skype Technologies S.A.) C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
2014-10-10 21:39 - 2014-10-10 21:39 - 28436968 _____ () C:\Users\User\AppData\Local\Temp\Softonic_EN_1-5-11_EN-Production_10_CleanRelease.exe
2014-07-22 06:28 - 2014-07-22 06:28 - 6824512 _____ (Client Connect LTD) C:\Users\User\AppData\Local\Temp\SPSetup.exe
2014-09-18 21:04 - 2014-09-18 21:54 - 74675720 _____ () C:\Users\User\AppData\Local\Temp\tmd_34015648.exe
2014-07-23 19:26 - 2014-07-23 19:28 - 2211057 _____ () C:\Users\User\AppData\Local\Temp\{10FA3292-8EE4-48ED-AD18-CDD9F2052305}-38.0.2101.0_chrome64_installer.exe
2014-08-06 21:23 - 2014-08-06 21:49 - 0000503 _____ () C:\Users\User\AppData\Local\Temp\{2E313E6B-BBA0-4EC8-86DB-4EE24032657E}-38.0.2114.2_chrome64_installer.exe
2016-01-02 20:40 - 2016-01-02 23:49 - 0000000 _____ () C:\Users\User\AppData\Local\Temp\{4355F74C-5714-4237-B1CF-2814B1F26A12}-49.0.2593.0_chrome_installer_win64.exe
2014-08-07 19:52 - 2014-08-07 20:09 - 6648841 _____ () C:\Users\User\AppData\Local\Temp\{48953895-8D39-4E0B-8EC2-78315F01D740}-38.0.2114.2_chrome64_installer.exe
2016-01-08 21:12 - 2016-01-08 23:02 - 0000000 _____ () C:\Users\User\AppData\Local\Temp\{70D8BBD5-006F-42ED-8B42-C295D738EE54}-49.0.2612.0_chrome_installer_win64.exe
2014-08-11 18:29 - 2014-08-11 22:00 - 0000503 _____ () C:\Users\User\AppData\Local\Temp\{8C163A21-2AD1-41E7-9242-11348CCA6D8C}-38.0.2114.2_chrome64_installer.exe
2016-01-05 00:39 - 2016-01-05 00:41 - 0000000 _____ () C:\Users\User\AppData\Local\Temp\{8DE476FD-32E0-4B35-889C-A854C3182941}-49.0.2593.0_chrome_installer_win64.exe
2014-09-18 03:42 - 2014-09-18 11:33 - 0000503 _____ () C:\Users\User\AppData\Local\Temp\{994C8945-2EF5-4665-86BA-84CF8AFB5D63}-39.0.2159.4_chrome64_installer.exe
2015-11-11 17:44 - 2015-11-11 17:44 - 0253560 _____ () C:\Users\User\AppData\Local\Temp\{AA558608-7D30-4DCA-A530-FEDBED8153FA}-48.0.2560.0_48.0.2552.0_chrome64_updater.exe
2016-01-06 18:00 - 2016-01-08 18:52 - 1785925 _____ () C:\Users\User\AppData\Local\Temp\{EE841DCB-91C1-43AB-8629-C99EFAC46B71}-49.0.2612.0_chrome_installer_win64.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-05-29 20:39

==================== End of FRST.txt ============================

 

 

Addition.txt

Стъпка 1

Изтеглете файла fixlist и го запазете на вашия десктоп.

• Стартирайте FRST.exe и натиснете бутона FIX веднъж!
• Почистването ще започне, не използвайте системата!
• След като приключи, ако ви поиска рестартиране, съгласете се.
• След като зареди системата публикувайте лог файла с име fixlog.txt, който се намира на десктопа Ви.

Забележка: Текущия фикс да не се използва на други системи!

 

Стъпка 2

Изтеглете GeekUnistaller.

• Разархивирайте файла.
• Стартирайте geek.exe.
• От списъка намерете софтуера, който не успяхте да деинсталирате/намерите. 
• Кликнете с десен бутон на него => Force Removal.

 

Стъпка 3

Изтеглете:  ADWCleaner.

• Затворете всички браузъри и стартирайте AdwCleaner.exe.
• Натиснете бутона SCAN.
• След като приключи проверката натиснете бутона CLEAN.
• Програмата ще затвори излишния софтуер и ще започне почистването.
• След като приключи почистването ADWCleaner ще поиска рестарт. Съгласете се.
• След зареждането на системата отидете до: C:\AdwCleaner и потърсете лог файл с името AdwCleaner[C0].txt.
• Публикувайте съдържанието на "AdwCleaner[C0]" в следващия Ви коментар.

 

Стъпка 4

Изтеглете:  JRT.

• Запазете файла на вашия десктоп.
• Затворете всички браузъри.
• Стартирайте JRT.exe.
• След като се появи съобщението "Press any key to continue . . .". Натиснете което и да е копче от клавиатурата.
• Програмата ще започне почистването. Не прекъсвайте работата и, и не използвайте системата докато протича почистването.
• След като приключи почистването ще се отвори лог файл, който се намира на десктопа с име JRT.txt.
• Копирайте съдържанието му и го поставете към следващия Ви коментар.

 

Стъпка 5

• Направете нови логове с FRST и ги прикачете към следващия Ви коментар.

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-06-2017
Ran by User (02-06-2017 21:06:19) Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
TuneUp Utilities 2014 (en-US) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
end
*****************

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{14C8CE46-C68C-461B-BCA9-E276A85851C6}\\SystemComponent => value removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}\\SystemComponent => value removed successfully

==== End of Fixlog 21:06:19 ====

# AdwCleaner v6.047 - Logfile created 02/06/2017 at 21:20:29
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-06-02.1 [Local]
# Operating System : Windows 8  (X64)
# Username : User - ADMIN
# Running from : C:\Users\User\Desktop\adwcleaner_6.047.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

[-] Service deleted: Update Framed Display
[-] Service deleted: SmdmFService

***** [ Folders ] *****

[-] Folder deleted: C:\Users\User\AppData\Local\iLivid
[-] Folder deleted: C:\Users\User\AppData\Roaming\OpenCandy
[-] Folder deleted: C:\Users\User\AppData\Roaming\RHEng
[#] Folder deleted on reboot: C:\ProgramData\smdmf
[#] Folder deleted on reboot: C:\ProgramData\Application Data\smdmf
[#] Folder deleted on reboot: C:\Program Files (x86)\Assets Manager
[-] Folder deleted: C:\Program Files (x86)\Settings Manager
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpmeembnagmagppkgghhfjfdfajdfcah
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fpmeembnagmagppkgghhfjfdfajdfcah
[-] Folder deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmabjcmofdemkaaekcmpocognlfonepb

***** [ Files ] *****

[-] File deleted: C:\Users\User\Downloads\ReimageRepair.exe
[-] File deleted: C:\Users\Public\Desktop\eBay.lnk
[-] File deleted: C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb
[-] File deleted: C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb
[-] File deleted: C:\Windows\Reimage.ini
[-] File deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kmabjcmofdemkaaekcmpocognlfonepb_0.localstorage
[-] File deleted: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_kmabjcmofdemkaaekcmpocognlfonepb_0.localstorage-journal

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

[-] Shortcut disinfected: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

***** [ Scheduled Tasks ] *****

[-] Task deleted: LaunchSignup
[-] Task deleted: launchsignup

***** [ Registry ] *****

[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\services\smdmfservice
[-] Key deleted: HKLM\SOFTWARE\Classes\Applications\iLividSetup-r1873-n-bc.exe
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Classes\softonic
[#] Key deleted on reboot: HKCU\Software\Classes\softonic
[-] Key deleted: HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
[-] Key deleted: HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
[-] Key deleted: HKLM\SOFTWARE\Classes\speedupmypc
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\softonic
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\speedupmypc
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Classes\TypeLib\{ABB8A8A5-FF98-40F6-B573-5841B063EA37}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{6A7CD9EC-D8BD-4340-BCD0-77C09A282921}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
[-] Key deleted: HKCU\Software\Classes\CLSID\{554EBE31-AEC1-4E34-BCE3-606467760D88}
[-] Key deleted: HKCU\Software\Classes\CLSID\{0FEB2313-F89B-4AC6-8153-84025604A06A}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[#] Key deleted on reboot: HKCU\Software\Classes\TypeLib\{ABB8A8A5-FF98-40F6-B573-5841B063EA37}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{726E90BE-DC22-4965-B215-E0784DC26F47}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DEDAF650-12B8-48F5-A843-BBA100716106}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Conduit
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\InstallCore
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Reimage
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\reimagerepair
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\SmdmF
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Softonic
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\SweetIM
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\TNT2
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[#] Key deleted on reboot: HKCU\Software\Conduit
[#] Key deleted on reboot: HKCU\Software\InstallCore
[#] Key deleted on reboot: HKCU\Software\Reimage
[#] Key deleted on reboot: HKCU\Software\reimagerepair
[#] Key deleted on reboot: HKCU\Software\SmdmF
[#] Key deleted on reboot: HKCU\Software\Softonic
[#] Key deleted on reboot: HKCU\Software\SweetIM
[#] Key deleted on reboot: HKCU\Software\TNT2
[#] Key deleted on reboot: HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[-] Key deleted: HKLM\SOFTWARE\Conduit
[-] Key deleted: HKLM\SOFTWARE\Linkey
[-] Key deleted: HKLM\SOFTWARE\SmdmF
[-] Key deleted: HKLM\SOFTWARE\SweetIM
[-] Key deleted: HKLM\SOFTWARE\Uniblue
[#] Key deleted on reboot: [x64] HKCU\Software\Conduit
[#] Key deleted on reboot: [x64] HKCU\Software\InstallCore
[#] Key deleted on reboot: [x64] HKCU\Software\Reimage
[#] Key deleted on reboot: [x64] HKCU\Software\reimagerepair
[#] Key deleted on reboot: [x64] HKCU\Software\SmdmF
[#] Key deleted on reboot: [x64] HKCU\Software\Softonic
[#] Key deleted on reboot: [x64] HKCU\Software\SweetIM
[#] Key deleted on reboot: [x64] HKCU\Software\TNT2
[#] Key deleted on reboot: [x64] HKCU\Software\Local AppWizard-Generated Applications\Reimage - Windows Problem Relief.
[-] Key deleted: [x64] HKLM\SOFTWARE\Reimage
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main [Search Page] 
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main [Start Page] 
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] 
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main [Search Bar] 
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Search [Default_Search_URL] 
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Search [SearchAssistant] 
[-] Data restored: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\SearchUrl [Default] 
[-] Data restored: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant] 
[-] Data restored: HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant] 
[-] Data restored: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] 
[-] Data restored: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default] 
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[-] Key deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
[-] Data restored: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2503}
[-] Data restored: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs]  
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\cmptch.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\deals-way.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\default-search.net
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\tlscdn.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\cmptch.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\deals-way.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\default-search.net
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\tlscdn.com
[-] Value deleted: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [Browser Infrastructure Helper]
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\iedll.dll
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\Record\{425E7597-03A2-338D-B72A-0E51FFE77A7E}
[-] Key deleted: HKLM\SOFTWARE\Classes\Record\{915BB7D5-082E-3B91-B1E0-45B5FDE01F24}
[-] Key deleted: HKLM\SOFTWARE\Classes\Record\{2009AF2F-5786-3067-8799-B97F7832FDD6}
[-] Key deleted: HKLM\SOFTWARE\Classes\Record\{FB2E65F4-5687-33EF-9BBF-4E3C9C98D3B9}
[-] Key deleted: HKLM\SOFTWARE\Classes\Record\{181480C8-90AC-3430-B39A-CD121E034A1A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Record\{8F54FA54-1DF8-3B20-890C-CDD95364BC95}
[-] Value deleted: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[#] Value deleted on reboot: [x64] HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]
[-] Key deleted: HKLM\SOFTWARE\Google\Chrome\Extensions\fpmeembnagmagppkgghhfjfdfajdfcah
[-] Key deleted: HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
[#] Key deleted on reboot: [x64] HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

***** [ Web browsers ] *****

[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: uk.ask.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: en.softonic.com
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: fpmeembnagmagppkgghhfjfdfajdfcah
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: kmabjcmofdemkaaekcmpocognlfonepb
[-] [C:\Users\User\AppData\Local\Google\Chrome\User Data\Default] [homepage] Deleted: hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6dnG4YA4YYZwVDtALk_LvsrV3QKdf7gclxC-xMgJRUYr5XV2fdNFXobHeA6UneMwpWgTjJeOY37IRw8tAruqDdf2MPpin8M3bOBfRa4ofC9Zpx6Yn43xYXKdFkuxLcbCMuNhEp0cHiaheW5Dsx0XXjqu46FbyHNFG29_TXUAe0ZfQ,,

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [16423 Bytes] - [02/06/2017 21:20:29]
C:\AdwCleaner\AdwCleaner[S0].txt - [23122 Bytes] - [02/06/2017 18:47:53]
C:\AdwCleaner\AdwCleaner[S1].txt - [18358 Bytes] - [02/06/2017 21:19:39]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [16645 Bytes] ##########
 

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-06-2017
Ran by User (02-06-2017 21:06:19) Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
TuneUp Utilities 2014 (en-US) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
end
*****************

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{14C8CE46-C68C-461B-BCA9-E276A85851C6}\\SystemComponent => value removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}\\SystemComponent => value removed successfully

==== End of Fixlog 21:06:19 ====

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 8 x64 
Ran by User (Administrator) on ??? 02.06.2017 ?. at 21:27:32,75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 22 

Successfully deleted: C:\ProgramData\smdmf (Folder) 
Successfully deleted: C:\ProgramData\Start Menu\Programs\tuneup utilities 2014.lnk (Shortcut) 
Successfully deleted: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\search.lnk (Shortcut) 
Successfully deleted: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0ojs1dk1.default\user.js (File) 
Successfully deleted: C:\Users\User\AppData\Roaming\new version available (Folder) 
Successfully deleted: C:\Windows\system32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 (Task)
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AJMXSGV (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5TNPQGY6 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7X5MIBGU (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8NNF47O5 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADP7YKLD (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GP60REJX (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LHPI8K11 (Temporary Internet Files Folder) 
Successfully deleted: C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLE5236U (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AJMXSGV (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5TNPQGY6 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7X5MIBGU (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8NNF47O5 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ADP7YKLD (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GP60REJX (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LHPI8K11 (Temporary Internet Files Folder) 
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XLE5236U (Temporary Internet Files Folder) 

Registry: 6 

Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\F06DEFF2-5B9C-490D-910F-35D3A91196222 (Registry Key) 
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{092ACBE8-9A8F-41E4-B96B-6F129956D2F8} (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{60DD6759-03E1-435C-B1B0-BF47F5772777} (Registry Key)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ACC04A0C-61A5-4A08-B1DD-843867EC4869} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} (Registry Key)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ??? 02.06.2017 ?. at 21:29:34,28
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

пп.Settings manager пак  го няма за да го деинсталирам

Стъпка 5?

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-06-2017
Ran by User (administrator) on ADMIN (03-06-2017 17:08:59)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 8 (X64) Language: Английски (Великобритания)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2864016 2012-08-10] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] => "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-10-13] (Apple Inc.)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [LManager] => [X]
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2087264 2014-09-11] (Wondershare)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [2144448 2017-05-16] (BitTorrent Inc.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Viber] => C:\Users\User\AppData\Local\Viber\Viber.exe [69268048 2016-04-13] (Viber Media S.à r.l.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53729824 2015-08-07] (Skype Technologies S.A.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {0cbb58ed-85f7-11e4-beda-083e8e298a92} - "E:\Lenovo_Suite.exe" 
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {594b45e6-3da5-11e4-bea9-083e8e298a92} - "E:\Autorun.exe" 
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\MountPoints2: {92606a33-1e4f-11e4-be85-083e8e298a92} - "F:\SETUP.EXE" 
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54841;https=127.0.0.1:54841
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{06F1E4B9-9631-4C9B-B37A-1B2BC33E1255}: [DhcpNameServer] 46.40.72.9 46.40.72.13
Tcpip\..\Interfaces\{98A8C6A8-AA5E-46BE-96AD-8A46F61843A9}: [NameServer] 85.118.197.4 85.118.197.68
Tcpip\..\Interfaces\{E9F2B73D-E145-4B45-8212-E6A4C558D43C}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{FD6DA41D-3D53-4EB2-A4EE-0431FF427753}: [DhcpNameServer] 192.168.43.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Start Page = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> DefaultScope {ACC04A0C-61A5-4A08-B1DD-843867EC4869} URL = 
SearchScopes: HKU\S-1-5-21-3835505473-1799193542-3545088410-1001 -> {8486C030-9F4A-40DE-A16B-C31A1B514712} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10513
BHO: No Name -> {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} -> No File
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File

FireFox:
========
FF DefaultProfile: 0ojs1dk1.default
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0ojs1dk1.default [2017-06-02]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-02-17] (VideoLAN)

Chrome: 
=======
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR NewTab: Default ->  Not-active:"chrome-extension://nngdfnnnkccipoglcgppagpgjkkbfclo/index.html"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-06-03]
CHR Extension: (Google Документи) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (uBlock Origin) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-06-02]
CHR Extension: (Golden) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\clbpamihokmeaiockbfmfoaflpcbkheb [2016-10-19]
CHR Extension: (Google Търсене) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (Google Документи офлайн) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]
CHR Extension: (Skype) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-03-22]
CHR Extension: (Ghostery) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2017-06-02]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-22]
CHR Extension: (goMovix Start) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nngdfnnnkccipoglcgppagpgjkkbfclo [2015-10-17]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-22]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2017-06-02]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-20] (Dritek System INC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]
S2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-20] (Dritek System Inc.)
S3 ssudobex; C:\Windows\system32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)
S3 AthBTPort; \SystemRoot\system32\DRIVERS\btath_flt.sys [X]
S3 BTATH_A2DP; \SystemRoot\system32\drivers\btath_a2dp.sys [X]
S3 btath_avdt; \SystemRoot\system32\drivers\btath_avdt.sys [X]
S3 BTATH_BUS; \SystemRoot\System32\drivers\btath_bus.sys [X]
S3 BTATH_HCRP; \SystemRoot\System32\drivers\btath_hcrp.sys [X]
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]
S3 BTATH_RCP; \SystemRoot\System32\drivers\btath_rcp.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-03 17:08 - 2017-06-03 17:08 - 00013914 _____ C:\Users\User\Desktop\FRST.txt
2017-06-02 21:29 - 2017-06-02 21:29 - 00004565 _____ C:\Users\User\Desktop\JRT.txt
2017-06-02 21:26 - 2017-06-02 21:26 - 01663672 _____ (Malwarebytes) C:\Users\User\Desktop\JRT.exe
2017-06-02 21:08 - 2017-05-15 10:40 - 06914496 _____ (Geek Unіnstaller) C:\Users\User\Desktop\geek.exe
2017-06-02 21:06 - 2017-06-02 21:06 - 00000841 _____ C:\Users\User\Desktop\Fixlog.txt
2017-06-02 20:36 - 2017-06-02 20:36 - 00000000 ____D C:\Windows\pss
2017-06-02 20:07 - 2017-06-02 20:09 - 49529576 _____ (FinalWire Ltd. ) C:\Users\User\Downloads\aida64extreme590.exe
2017-06-02 19:16 - 2017-06-02 19:16 - 00033946 _____ C:\Users\User\Downloads\Addition.txt
2017-06-02 18:51 - 2017-06-02 18:53 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-02 18:51 - 2017-06-02 18:51 - 00001070 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-06-02 18:51 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-06-02 18:51 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-06-02 18:51 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-06-02 18:43 - 2017-06-02 21:43 - 00000000 ____D C:\AdwCleaner
2017-06-02 18:43 - 2017-06-02 18:43 - 04110280 _____ C:\Users\User\Desktop\adwcleaner_6.047.exe
2017-06-02 18:08 - 2017-06-03 17:08 - 00000000 ____D C:\FRST
2017-06-02 18:06 - 2017-06-02 18:07 - 00000000 ____D C:\Users\User\AppData\Roaming\Geek Uninstaller
2017-06-02 18:05 - 2017-06-02 18:05 - 02433536 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2017-05-19 17:47 - 2017-05-19 17:47 - 00085999 _____ C:\Users\User\Desktop\CV.pdf
2017-05-16 20:15 - 2017-05-22 11:33 - 00000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
2017-05-16 19:42 - 2017-05-16 19:55 - 1488202030 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.avi
2017-05-16 19:42 - 2017-05-16 19:42 - 00000687 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.nfo
2017-05-16 19:40 - 2017-05-16 19:41 - 00015067 _____ C:\Users\User\Downloads\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.torrent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-03 17:04 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-02 22:10 - 2014-07-14 15:15 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3835505473-1799193542-3545088410-1001
2017-06-02 20:56 - 2014-12-20 01:36 - 00000000 ____D C:\Windows\Minidump
2017-06-02 20:45 - 2014-10-14 23:08 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-06-02 20:03 - 2012-07-26 08:28 - 00848230 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-02 20:03 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\Inf
2017-06-02 19:37 - 2016-04-15 22:33 - 00000000 ____D C:\Users\User\AppData\Roaming\ViberPC
2017-06-02 18:31 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-06-02 18:30 - 2012-08-20 02:35 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll
2017-06-02 18:30 - 2012-08-03 03:28 - 00000000 ____D C:\Program Files (x86)\NTI
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files\Acer
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files (x86)\Acer
2017-06-02 18:24 - 2012-08-03 03:28 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-06-02 18:16 - 2016-02-27 01:42 - 00000000 ____D C:\Users\User\AppData\Roaming\BSplayer
2017-06-02 18:16 - 2016-02-27 01:42 - 00000000 ____D C:\Program Files (x86)\Webteh
2017-06-02 17:53 - 2015-06-01 09:49 - 00000000 ____D C:\Users\User\AppData\Roaming\Foxit Software
2017-06-02 17:52 - 2014-08-07 18:53 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2017-06-02 17:51 - 2014-07-20 12:00 - 00002159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-02 17:51 - 2014-07-20 12:00 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-06-02 17:48 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Acer
2017-05-22 11:33 - 2014-10-02 17:55 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2017-05-16 19:44 - 2017-01-26 19:40 - 24944640 ____R C:\Users\User\Desktop\sample.avi
2017-05-16 19:40 - 2014-07-20 11:58 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-16 19:40 - 2014-07-20 11:58 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-09-15 19:34 - 2015-09-15 19:34 - 0000000 _____ () C:\Users\User\AppData\Local\{0ED07D18-B92D-4D56-AAE8-CEFE829952C9}
2012-08-20 02:12 - 2012-08-20 02:12 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
2017-06-02 17:53 - 2015-04-22 14:53 - 4881120 _____ (Foxit Corporation) C:\Users\User\AppData\Local\Temp\FoxitUpdater.exe
2017-06-02 18:06 - 2017-06-02 18:06 - 3932096 _____ (Geek Unіnstaller) C:\Users\User\AppData\Local\Temp\geek64.exe
2014-11-12 20:49 - 2010-06-17 15:09 - 0149352 ____R (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\ose00000.exe
2015-05-10 21:27 - 2007-04-17 01:05 - 0145184 ____R (Microsoft Corporation) C:\Users\User\AppData\Local\Temp\ose00001.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-06-02 19:23

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2017
Ran by User (03-06-2017 17:10:04)
Running from C:\Users\User\Desktop
Windows 8 (X64) (2014-07-14 14:09:16)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3835505473-1799193542-3545088410-500 - Administrator - Disabled)
Guest (S-1-5-21-3835505473-1799193542-3545088410-501 - Limited - Disabled)
User (S-1-5-21-3835505473-1799193542-3545088410-1001 - Administrator - Enabled) => C:\Users\User

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\uTorrent) (Version: 3.5.0.43580 - BitTorrent Inc.)
Acer Device Fast-lane (HKLM\...\{3F62D2FD-13C1-49A2-8B5D-47623D9460D7}) (Version: 1.00.3003 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.3003 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.3006 - Acer Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{F2871C89-C8A5-42EE-8D45-0F02506385A6}) (Version: 5.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{9BC93467-75D1-4AA4-BD58-D9C51D88DFAB}) (Version: 5.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{55BB2110-FB43-49B3-93F4-945A0CFB0A6C}) (Version: 10.0.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Broadcom Card Reader Driver Installer (HKLM\...\{F0A7DF2F-0BE0-470F-B137-D7A19F977189}) (Version: 15.4.4.2 - Broadcom Corporation)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.01.3107 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.01.3107 - Acer Incorporated)
clear.fi SDK - Video 2 (x32 Version: 2.1.1910 - CyberLink Corp.) Hidden
clear.fi SDK- Movie 2 (x32 Version: 2.1.1910 - CyberLink Corp.) Hidden
eBay Worldwide (HKLM-x32\...\{A694AF57-9891-4D62-824C-7E55A1361A14}) (Version: 2.3.0630 - OEM)
ETDWare PS/2-X64 11.6.4.001_WHQL (HKLM\...\Elantech) (Version: 11.6.4.001 - ELAN Microelectronic Corp.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.10 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden
HU 2011 (HKLM-x32\...\HU 2011_is1) (Version: RePack - Ultra)
Identity Card (HKLM-x32\...\{3D9CB654-99AD-4301-89C6-0D12A790767C}) (Version: 2.00.3002 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2828 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
iTunes (HKLM\...\{F11677B7-0D8E-4F34-BEBB-6869FE861CDF}) (Version: 12.5.2.36 - Apple Inc.)
KtLauncher (HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Megatonn) (Version:  - )
Launch Manager (HKLM-x32\...\LManager) (Version: 7.0.2 - Acer Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Excel 2007 Help Àêòóàëèçàöèÿ (KB963678) (HKLM-x32\...\{90120000-0016-0402-0000-0000000FF1CE}_ENTERPRISE_{B3B0B5D0-371D-4211-A43A-B4E70B563756}) (Version:  - Microsoft)
Microsoft Office Powerpoint 2007 Help Àêòóàëèçàöèÿ (KB963669) (HKLM-x32\...\{90120000-0018-0402-0000-0000000FF1CE}_ENTERPRISE_{C64A08BB-59AC-4ACE-AF1D-D5225DF9CE2D}) (Version:  - Microsoft)
Microsoft Office Word 2007 Help Àêòóàëèçàöèÿ (KB963665) (HKLM-x32\...\{90120000-001B-0402-0000-0000000FF1CE}_ENTERPRISE_{6BECE490-EB24-47FB-B6C9-91724C0B0E6E}) (Version:  - Microsoft)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version:  - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 49.0.2 (x86 bg) (HKLM-x32\...\Mozilla Firefox 49.0.2 (x86 bg)) (Version: 49.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 49.0.2.6136 - Mozilla)
Need for Speed -  Most Wanted v1.3 ( RE ) (HKLM-x32\...\{7CD9421E-4FDF-4833-A5F0-1F0FAB476629}) (Version: 1.3 - Relentless Technologies)
NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.01.3102 - Acer)
Office Addin 2003 (HKLM-x32\...\{1FCC073B-CC01-4443-AD20-E559F66E6E83}) (Version: 2.01.3102 - Acer)
Origin (HKLM-x32\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.05 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.8 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Viber (HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\{acc83058-83b0-41e2-b372-266672a1af16}) (Version: 6.0.1.5 - Viber Media Inc.)
Viber (x32 Version: 6.0.1.5 - Viber Media Inc.) Hidden
VirtualDJ 8 (HKLM-x32\...\{B29DEFF3-258A-416E-BDBB-27B326B4FE71}) (Version: 8.0.2362.0 - Atomix Productions)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version:  - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player 2.0.0 (HKLM-x32\...\VLC media player) (Version: 2.0.0 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinRAR 5.20 Бета 1 (64-битова версия) (HKLM\...\WinRAR archiver) (Version: 5.20.1 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {062E9EEC-E5BE-40EA-86ED-94881029F79F} - System32\Tasks\Opera scheduled Autoupdate 1413311943 => C:\Program Files (x86)\Opera\launcher.exe [2014-09-25] (Opera Software)
Task: {510F71F1-0423-4AD4-BB04-F9ECAC478800} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2012-07-31] (Acer Incorporated)
Task: {77965278-90CB-48FA-ABAC-60DC0C2ABEE1} - System32\Tasks\{B91C55BD-B338-430B-A806-65B2258B4039} => Chrome.exe hxxp://ui.skype.com/ui/0/7.5.0.102/bg/abandoninstall?page=tsProgressBar
Task: {7FBACE87-DF4E-44D2-BA24-C9C422E21214} - System32\Tasks\Microsoft\Windows\Setup\EOSNotify => C:\Windows\system32\EOSNotify.exe [2016-06-25] (Microsoft Corporation)
Task: {BD4997B8-ECE0-42DA-A1C0-1FF438EED5F8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {C6D749F4-62AB-4E74-A77F-59DBC0125105} - System32\Tasks\{3BA669F2-72BF-4C0E-9785-2E549675BDB9} => Firefox.exe hxxps://ui.skype.com/ui/0/7.30.80.105/bg/abandoninstall?page=tsProgressBar
Task: {F539D806-DFB2-4635-AC77-6ABB478CF495} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {FEF39060-B1D5-43F5-B4C1-1B2BA3572C04} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\User\Favorites\Acer\Acer.lnk -> hxxp://www.acer.com
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Какво е новото в последната версия.lnk -> C:\Program Files\WinRAR\WhatsNew.txt () <===== Cyrillic
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Помощен файл на WinRAR.lnk -> C:\Program Files\WinRAR\WinRAR.chm () <===== Cyrillic
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Ръководство за конзолната версия на RAR.lnk -> C:\Program Files\WinRAR\Rar.txt () <===== Cyrillic
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ\Online Help.lnk -> hxxp://www.virtualdj.com/wiki
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ\www.virtualdj.com.lnk -> hxxp://www.virtualdj.com
Shortcut: C:\Users\User\AppData\Roaming\Microsoft\Windows\SendTo\Прехвърляне на файлове с Bluetooth.LNK -> C:\Windows\System32\fsquirt.exe (Microsoft Corporation) <===== Cyrillic

ShortcutWithArgument: C:\Users\Public\Desktop\LOVEFiLM.lnk -> C:\Program Files\Preload\LoveFilm\StartURL.exe () -> hxxp://Lovefilm.com/acer

==================== Loaded Modules (Whitelisted) ==============

2016-10-05 18:17 - 2016-10-05 18:17 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-10-05 18:17 - 2016-10-05 18:17 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-08-10 09:54 - 2012-08-08 16:48 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2017-06-02 17:51 - 2017-06-01 08:30 - 03824472 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.10\libglesv2.dll
2017-06-02 17:51 - 2017-06-01 08:30 - 00100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.10\libegl.dll
2012-08-20 02:13 - 2012-06-25 18:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-10-14 19:39 - 2014-09-25 09:37 - 01543800 _____ () C:\Program Files (x86)\Opera\24.0.1558.64\launcher_lib.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\User\AppData\Roaming\Microsoft\Windows Photo Viewer\Тапет от програмата за преглед на снимки на Windows.jpg
DNS Servers: 192.168.43.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "BtPreLoad"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "mcui_exe"
HKLM\...\StartupApproved\Run32: => "GrooveMonitor"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\StartupApproved\Run: => "DAEMON Tools Lite"
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\StartupApproved\Run: => "uTorrent"
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\StartupApproved\Run: => "Viber"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{C493EAE8-ACF7-4D44-AF9D-38E92861C275}] => (Allow) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManager.exe
FirewallRules: [{92D4EB48-EF5E-4121-81FD-8F4290040FF0}] => (Allow) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
FirewallRules: [{D072D69F-BB06-41C6-8939-C75C07F915E7}] => (Allow) C:\Program Files (x86)\NTI\Acer Backup Manager\FileExplorer.exe
FirewallRules: [{B86D828F-6546-4D5E-A498-2A2D830B52CE}] => (Allow) C:\Program Files (x86)\Bluetooth Suite\Btvstack.exe
FirewallRules: [{D72D5B3A-28FB-4022-AC6B-5EDABD9C01CB}] => (Allow) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
FirewallRules: [{93024095-CB35-4CA0-BA70-F58EE98507CD}] => (Allow) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
FirewallRules: [{A5D1CD26-45D1-4A72-A156-8A8016EB4262}] => (Allow) C:\Program Files (x86)\Bluetooth Suite\Win7Ui.exe
FirewallRules: [{80779ED2-6F01-4825-8830-9A264AA3B85A}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{C0C32E92-5F49-4439-8D57-E76CDD783432}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{435E9B45-3FE5-4E4A-B6E5-1BA2941901A4}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{7344087D-0B82-40E4-A7DD-2C42FF5D3723}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{EDC10DC3-0E86-4CC8-9763-5C6CE999C990}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\DMCDaemon.exe
FirewallRules: [{DA1179CE-E650-4611-AB79-6A3AA324139A}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\DMCDaemon.exe
FirewallRules: [{E35BAD27-5554-48F4-A6A9-1D9DDD35092A}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\WindowsUpnpMV.exe
FirewallRules: [{941DCF98-01AB-42EB-B730-9BAF8DA83A56}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Media\WindowsUpnpMV.exe
FirewallRules: [{6032A916-2A64-46F8-9FF8-EDC6B2B28C60}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\VideoPlayer.exe
FirewallRules: [{347B1BDB-B44D-4894-93AE-0FC341021704}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Video\MusicPlayer.exe
FirewallRules: [{3088737F-9659-421F-A9B3-18605956FF30}] => (Allow) C:\Program Files (x86)\Acer\clear.fi SDK21\Movie\PlayMovie.exe
FirewallRules: [{878963E5-A3E5-4C4D-A0CB-FC4D696767F3}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\DMCDaemon.exe
FirewallRules: [{11CFDEC6-04FF-401F-A68A-D2F84A80AB7D}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\DMCDaemon.exe
FirewallRules: [{4AE2C114-6729-4A1A-B514-A3F10E1C6ECA}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\WindowsUpnp.exe
FirewallRules: [{C7551743-A316-4B70-AA34-8F2B7FA29888}] => (Allow) C:\Program Files (x86)\Acer\clear.fi Photo\WindowsUpnp.exe
FirewallRules: [{9CA90CFC-0CBB-4FDE-8590-EA0B70CEEB73}] => (Allow) C:\Program Files (x86)\Acer\Acer Cloud\ccd.exe
FirewallRules: [{38F2FC9E-42D5-4164-8C6B-CB961029EBF2}] => (Allow) C:\Program Files (x86)\Acer\Acer Cloud\ccd.exe
FirewallRules: [{23453473-B997-426E-BE99-26785102586C}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{2BF6CBEC-5041-4783-A771-FEE2F0731FCD}] => (Allow) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{14CEFFD1-6BB8-47E5-B166-EC4D4982B1A3}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{EFE719B8-3579-45F6-9A2D-DCF760B79DCE}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{DF77123D-C339-4CE9-806A-8DD7A0E43A25}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{C3BBB190-D4FD-4B50-80FE-3E5CB13E46B9}] => (Allow) C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{EBFB0CE7-9550-4365-A8D5-0DC006AFF13B}] => (Allow) C:\Users\User\AppData\Local\TNT2\2.0.0.1868\TNT2User.exe
FirewallRules: [{6B826031-FFB2-4601-8257-3D58165D1B27}] => (Allow) C:\Users\User\AppData\Local\TNT2\2.0.0.1868\TNT2User.exe
FirewallRules: [TCP Query User{4CCCD22B-09C5-4B86-AF96-A1F8C1A90F56}C:\program files (x86)\bluetooth suite\bttray.exe] => (Block) C:\program files (x86)\bluetooth suite\bttray.exe
FirewallRules: [UDP Query User{145036B4-8C19-44C6-8522-C74FFD69163D}C:\program files (x86)\bluetooth suite\bttray.exe] => (Block) C:\program files (x86)\bluetooth suite\bttray.exe
FirewallRules: [TCP Query User{87F090AC-65DC-4967-8DFF-DD1CE6633009}C:\program files (x86)\bluetooth suite\btvstack.exe] => (Allow) C:\program files (x86)\bluetooth suite\btvstack.exe
FirewallRules: [UDP Query User{918BCEED-159C-435D-9936-C5BC00F98454}C:\program files (x86)\bluetooth suite\btvstack.exe] => (Allow) C:\program files (x86)\bluetooth suite\btvstack.exe
FirewallRules: [TCP Query User{B5EFC42F-A42B-41A4-B45D-174A6FBC95E5}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{3E7BD5A3-CA43-4FE4-9C97-827E1EDDE573}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [TCP Query User{111978D5-9B55-4749-B24E-221B258A61CE}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{986ACEC9-DB07-46EA-A1D7-382E41CD90F0}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{B68B2F54-41B2-407F-A60E-FABCFCB891D1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{6DD84171-3FCE-4404-8BBA-B1C5915FCB04}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{760BA062-5FA7-4C16-9DA5-302A5D3717F5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D9A1A3EE-93CF-4DA5-BC39-7EC403A04863}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{7EFE4AE2-A811-4063-82D2-9C0643FD3377}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{6DA40E20-6EEC-49E6-AA53-6F040EB79407}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F78BBE49-7B56-4442-9A2D-5881DBFC1CAB}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2DC46D83-2CE3-4C9B-A40B-7932CACFD928}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (06/02/2017 09:27:33 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Неуспешно създаване на точка на възстановяване (Процес = C:\Users\User\AppData\Local\Temp\jrt\CreateRestorePoint.exe  "JRT Pre-Junkware Removal"; Описание = JRT Pre-Junkware Removal; Грешка= 0x80070422).

Error: (06/02/2017 09:25:07 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Неуспешно създаване на точка на възстановяване (Процес = C:\Windows\system32\msiexec.exe /V; Описание = Removed Virtual Router v1.0; Грешка= 0x80070422).

Error: (06/02/2017 09:25:00 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Неуспешно създаване на точка на възстановяване (Процес = C:\Windows\system32\msiexec.exe /V; Описание = Removed Virtual Router v1.0; Грешка= 0x80070422).

Error: (06/02/2017 09:14:14 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Admin)
Description: Application or service 'TuneUp Utilities Service' could not be restarted.

Error: (06/02/2017 09:14:08 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Неуспешно създаване на точка на възстановяване (Процес = C:\Windows\system32\msiexec.exe /V; Описание = TuneUp Utilities 2014 е премахнат; Грешка= 0x80070422).

Error: (06/02/2017 09:13:35 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Неуспешно създаване на точка на възстановяване (Процес = C:\Windows\system32\msiexec.exe /V; Описание = TuneUp Utilities 2014 е премахнат; Грешка= 0x80070422).

Error: (06/02/2017 09:12:43 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Admin)
Description: Активирането на приложението Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance е неуспешно с грешка: -2144927142 Вж. регистрационния файл Microsoft-Windows-TWinUI/Operational за допълнителна информация.

Error: (06/02/2017 09:12:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: Admin)
Description: Приложението Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance не се стартира в рамките на отреденото за целта време.

Error: (06/02/2017 09:10:47 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Admin)
Description: Application or service 'TuneUp Utilities' could not be shut down.

Error: (06/02/2017 09:10:47 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Неуспешно създаване на точка на възстановяване (Процес = C:\Windows\system32\msiexec.exe /V; Описание = Removed TuneUp Utilities 2014 (en-US); Грешка= 0x80070422).

System errors:
=============
Error: (06/03/2017 05:04:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга CCDMonitorService не може да бъде стартирана поради следната грешка: 
Системата не може да намери указания файл.

Error: (06/02/2017 09:44:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Услуга CCDMonitorService не може да бъде стартирана поради следната грешка: 
Системата не може да намери указания файл.

Error: (06/02/2017 09:44:02 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module неочаквано спря.

Път до модула: C:\Program Files (x86)\Qualcomm Atheros\AthIhvWlanExt.dll

Error: (06/02/2017 09:44:02 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module неочаквано спря.

Път до модула: C:\Program Files (x86)\Qualcomm Atheros\AthIhvWlanExt.dll

Error: (06/02/2017 09:44:01 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module неочаквано спря.

Път до модула: C:\Program Files (x86)\Qualcomm Atheros\AthIhvWlanExt.dll

Error: (06/02/2017 09:43:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Услуга Intel(R) Management and Security Application User Notification Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

Error: (06/02/2017 09:43:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Услуга ePower Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и).

Error: (06/02/2017 09:43:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Услуга Windows Presentation Foundation Font Cache 3.0.0.0 беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 0 милисекунди ще бъде предприето следното коригиращо действие: Restart the service.

Error: (06/02/2017 09:43:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Услуга Windows Search беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 30000 милисекунди ще бъде предприето следното коригиращо действие: Restart the service.

Error: (06/02/2017 09:43:51 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Услуга Dritek RF Button Command Service беше прекъсната неочаквано. Това се е случвало с нея 1 път(и). След 3000 милисекунди ще бъде предприето следното коригиращо действие: Restart the service.

==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU B960 @ 2.20GHz
Percentage of memory in use: 59%
Total physical RAM: 3909.27 MB
Available physical RAM: 1570.73 MB
Total Virtual: 5061.27 MB
Available Virtual: 2557.19 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:445.71 GB) (Free:232.95 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 8B680A0E)

Partition: GPT.

==================== End of Addition.txt ============================

Стъпка 1

Изтеглете файла fixlist и го запазете на вашия десктоп.

• Стартирайте FRST.exe и натиснете бутона FIX веднъж!
• Почистването ще започне, не използвайте системата!
• След като приключи, ако ви поиска рестартиране, съгласете се.
• След като зареди системата публикувайте лог файла с име fixlog.txt, който се намира на десктопа Ви.

Забележка: Текущия фикс да не се използва на други системи!

 

Стъпка 2

Изтеглете:  Malwarebytes Anti-Malware.

• Стартирайте инсталационния файл и следвайте съветника за инсталация.
• Преди края на инсталацията премахнете отметката от: "Enable free trial of Malwarebytes Anti-Malware Premium" и се уверете че има отметка пред "Launch Malwarebytes Anti-Malware".
• Отидете до табът Settings => Detection and Protection => сложете отметка на "Scan for rootkits".
• Отидете до табът Dashboard => натиснете бутона "SCAN NOW".
• Програмата автоматично ще провери за актуализации и ще започне сканирането.

Забележка: Ако видите съобщението "Could not load DDA driver" натиснете бутона "YES". След което разрешете на системата да се рестартира.

• След като проверката приключи натиснете бутона "Remove Selected".
• Системата ще поиска рестарт, съгласете се.
• След като системата зареди MBAB ще зареди.
• Отидете до табът History => Applications Logs.
• Потърсете лог с име "SCAN LOG" с последната дата и час и натиснете върху него.
• Натиснете бутона EXPORT => Copy to Clipboard.
• Поставете съдържанието на лога с клавишната комбинация CTRL+V към следващия Ви коментар.

 

Стъпка 3

Изтеглете:  HitmanPro.

• Запазете файла на вашия десктоп.
• Стартирайте програмата.

Забележка: Програмата ще се актуализира, след актуализацията HitmanPro ще се рестартира.

• Натиснете бутона "Напред".
• Сложете отметка на лицензионното споразумение и натиснете отново бутона "Напред".
• Кликнете върху "Не, искам да извърша еднократно сканиране на компютъра" и натиснете бутона "Напред".
• Програмата ще започне да сканира. Сканирането ще отнеме ~2 минути.
• След като сканирането приключи от списъка с намерените обекти(ако има такива) изберете Apply to all => Ignore.
• Натиснете бутона "Next" и след това бутона "Изнеси резултатите от сканирането в XML файл" и запазете лог файла на десктопа.
• Отворете лог файла, копирайте съдържанието му и го поставете в следващия Ви коментар.

Забележка: Ако от падащото меню няма Ignore тогава просто затворете програмата след края на проверката без да премахвате нищо!

От My Computer => Tools => Folder Options => View => Сложете отметка пред "Show hidden files, folders and drives".
Натиснете Apply.

Влезте в C:\Programdata\HitmanPro\Logs прикачете лога към следващия Ви коментар.

 

Стъпка 4

Изтеглете:  Emsissoft Emergency Kit

• Стартирайте файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
• Стартирайте файла Start Emsisoft Emergency Kit от десктопа за да стартирате програмата.
• Натиснете бутона "Yes", когато бъдете подканени да обновите дефинициите на програмата.
• След като обновяването на дефинициите приключи натиснете бутона "Scan".
• Програмата ще Ви попита дали искате да включите засичането на Potentially Unwanted Applications,  натиснете бутона "Yes".
• Натиснете бутона "Custom Scan". Премахнете от списъка оставете само дял C:\.
• Натиснете "Next" за да започне проверката.
• Когато проверката приключи натиснете бутона "View Report".
• Копирайте съдържанието на лог файла в следващия Ви коментар.

 

Стъпка 5

Изтеглете  Глиф.

• Запазете файла на десктопа.
• Стартирайте програмата и натиснете "Напред".
• Сложете отметка на: "Всички налични действия..." и натиснете "Напред".
• На десктопа Ви ще се появи архив, прикачете архива в dox.bg и дайте линк за изтеглянето му.

 

C:\Users\User\Desktop\Fixlog.txt => moved successfully
C:\Users\User\Downloads\Addition.txt => moved successfully
C:\AdwCleaner => moved successfully
C:\Users\User\Desktop\adwcleaner_6.047.exe => moved successfully
C:\Users\User\AppData\Roaming\Geek Uninstaller => moved successfully

========================= Folder: C:\Windows\Minidump ========================

====== End of Folder: ======

C:\Users\User\AppData\Local\{0ED07D18-B92D-4D56-AAE8-CEFE829952C9} => moved successfully
C:\ProgramData\DP45977C.lfl => moved successfully
C:\Users\User\AppData\Local\Temp\FoxitUpdater.exe => moved successfully
C:\Users\User\AppData\Local\Temp\geek64.exe => moved successfully
C:\Users\User\AppData\Local\Temp\ose00000.exe => moved successfully
C:\Users\User\AppData\Local\Temp\ose00001.exe => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{062E9EEC-E5BE-40EA-86ED-94881029F79F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{062E9EEC-E5BE-40EA-86ED-94881029F79F} => key removed successfully
C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1413311943 => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Opera scheduled Autoupdate 1413311943 => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{77965278-90CB-48FA-ABAC-60DC0C2ABEE1} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77965278-90CB-48FA-ABAC-60DC0C2ABEE1} => key removed successfully
C:\Windows\System32\Tasks\{B91C55BD-B338-430B-A806-65B2258B4039} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{B91C55BD-B338-430B-A806-65B2258B4039} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C6D749F4-62AB-4E74-A77F-59DBC0125105} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6D749F4-62AB-4E74-A77F-59DBC0125105} => key removed successfully
C:\Windows\System32\Tasks\{3BA669F2-72BF-4C0E-9785-2E549675BDB9} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{3BA669F2-72BF-4C0E-9785-2E549675BDB9} => key removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{B68B2F54-41B2-407F-A60E-FABCFCB891D1} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{6DD84171-3FCE-4404-8BBA-B1C5915FCB04} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{760BA062-5FA7-4C16-9DA5-302A5D3717F5} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{D9A1A3EE-93CF-4DA5-BC39-7EC403A04863} => value removed successfully

"C:\Users\User\AppData\Local\Temp" folder move:

Could not move "C:\Users\User\AppData\Local\Temp" => Scheduled to move on reboot.

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.6.9200 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {8C9C74FC-D6FF-4631-B1F8-EF7285035E5D}.
0 out of 1 jobs canceled.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 33045107 B
Java, Flash, Steam htmlcache => 19158 B
Windows/system/drivers => 479848589 B
Edge => 0 B
Chrome => 79047355 B
Firefox => 373751064 B
Opera => 8222386 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 479655 B
LocalService => 1687208 B
NetworkService => 5612 B
User => 25548775 B

RecycleBin => 53613 B
EmptyTemp: => 963.3 MB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 04-06-2017 08:06:09)

C:\Users\User\AppData\Local\Temp => moved successfully

==== End of Fixlog 08:06:10 ====

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4.6.2017 г.
Scan Time: 8:11
Logfile: 
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2017.06.04.03
Rootkit Database: v2017.05.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: User

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 289835
Time Elapsed: 19 min, 0 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 14
PUP.Optional.FindWide, HKLM\SOFTWARE\CLASSES\CLSID\{0FEB2313-F89B-4AC6-8153-84025604A06A}, Quarantined, [ee4545f69613979fd20638ecad5543bd], 
PUP.Optional.FindWide, HKLM\SOFTWARE\CLASSES\INTERFACE\{0FEB2313-F89B-4AC6-8153-84025604A06A}, Quarantined, [ee4545f69613979fd20638ecad5543bd], 
PUP.Optional.FindWide, HKU\S-1-5-21-3835505473-1799193542-3545088410-1001_Classes\INTERFACE\{0FEB2313-F89B-4AC6-8153-84025604A06A}, Quarantined, [ee4545f69613979fd20638ecad5543bd], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}, Quarantined, [f34099a29415af87083456dea25e17e9], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}, Quarantined, [50e37cbfcfda36003b653af67b8514ec], 
PUP.Optional.Linkey, HKLM\SOFTWARE\CLASSES\Linkey.Linkey, Quarantined, [c46f02399712a19554b4c55c9d65fd03], 
PUP.Optional.Linkey, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Linkey.Linkey, Quarantined, [f340073483260a2ceb1dbd6408fa1ee2], 
PUP.Optional.Linkey, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Linkey.Linkey, Quarantined, [f340073483260a2ceb1dbd6408fa1ee2], 
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\SPVC32LDR, Quarantined, [48eb94a70a9f62d4f23733ab44be748c], 
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, Quarantined, [a09361da8e1b1422985a26d550b2f907], 
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, Quarantined, [1b188ab1ccdd2e08c1325aa18c769d63], 
PUP.Optional.Yontoo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Update Framed Display, Quarantined, [6bc850eb763376c018c003f97f83718f], 
PUP.Optional.TidyNetwork, HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\DRAGDROP\{70BC1CDB-0744-4172-BDA0-B5A487D00C3A}, Quarantined, [7ab93704f0b9181eb7f44697fa089b65], 
PUP.Optional.TNT, HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}, Quarantined, [be75c675decb78be09b423baf2101be5], 

Registry Values: 8
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130507849115328780, Quarantined, [4de672c99b0e75c11612a23cd929c838]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130507849115328780, Quarantined, [e44fe2599712fc3ab870508e946ea858]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130507849115328780, Quarantined, [d261c07b8227b4820820c11d3ec4946c]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130507849115328780, Quarantined, [fb380d2e4d5c162076b2e9f530d25ca4]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\SPVC32Ldr|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130507849115328780, Quarantined, [48eb94a70a9f62d4f23733ab44be748c]
PUP.Optional.TNT2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EBFB0CE7-9550-4365-A8D5-0DC006AFF13B}, v2.20|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\User\AppData\Local\TNT2\2.0.0.1868\TNT2User.exe|Name=TNT2|, Quarantined, [d3609aa104a5c3734fc464a21ee504fc]
PUP.Optional.TNT2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{6B826031-FFB2-4601-8257-3D58165D1B27}, v2.20|Action=Allow|Active=TRUE|Dir=In|App=C:\Users\User\AppData\Local\TNT2\2.0.0.1868\TNT2User.exe|Name=TNT2|, Quarantined, [eb48cd6eeabf41f5a96a66a01de647b9]
PUP.Optional.TNT, HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{72A6AB0F-2FA8-4C73-9FCB-1E62A608F001}|AppName, TNT2User.exe, Quarantined, [be75c675decb78be09b423baf2101be5]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
PUP.Optional.Reimage, C:\Users\User\Downloads\ReimageRepair (1).exe, Quarantined, [77bcfe3daffa0f27144762cf837de41c], 

Physical Sectors: 0
(No malicious items detected)

(end)

HitmanPro не иска да тръгва да сканира, т.е стартирам програмата и нищо... бутона напред не е активен. Да продължа ли със следващите стъпки?

Прикачи лога от стъпка 1 и продължи към следващите стъпки.

преди 4 часа, Stoyannnov написа:

Прикачи лога от стъпка 1 и продължи към следващите стъпки.

първите два лога съм ги постнал. Продължавам със следващите стъпки

Emsisoft Emergency Kit - Version 2017.4
Last update: 4.6.2017 г. 13:45:00
User account: Admin\User
Computer name: ADMIN
OS version: Windows 8x64 

Scan settings:

Scan type: Custom Scan
Objects: Rootkits, Memory, Traces, C:\

Detect PUPs: On
Scan archives: On
ADS Scan: On
File extension filter: Off
Direct disk access: Off

Scan start:    4.6.2017 г. 13:45:53
Key: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}     detected: Application.AdLink (A) [280795]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\evlmpimtnbpoylrfsitjszrxecvwigiu\smdmf\smdmfmgrc3.cfg     detected: Adware.Linkey.B (B) [krnl.xmd]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\evlmpimtnbpoylrfsitjszrxecvwigiu\smdmf\Helper.dll     detected: Adware.Linkey.B (B) [krnl.xmd]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\evlmpimtnbpoylrfsitjszrxecvwigiu\smdmf\tbicon.exe     detected: Adware.Linkey.B (B) [krnl.xmd]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\evlmpimtnbpoylrfsitjszrxecvwigiu\smdmf\Uninstall.exe     detected: Adware.GenericKD.5186936 (B) [krnl.xmd]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\evlmpimtnbpoylrfsitjszrxecvwigiu\smdmf\x64\smdmfmgrc3.cfg     detected: Adware.Linkey.B (B) [krnl.xmd]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\evlmpimtnbpoylrfsitjszrxecvwigiu\smdmf\SmdmFService.exe     detected: Adware.Linkey.B (B) [krnl.xmd]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\fdwvtzjohfcoqatydhteinaedwuhomas\494E9BD962994C4980781D6C67010F7B\speedupmypcUK.exe     detected: Application.AdSpeed (A) [285390]
C:\FRST\Quarantine\C\AdwCleaner\quarantine\files\fdwvtzjohfcoqatydhteinaedwuhomas\494E9BD962994C4980781D6C67010F7B\speedupmypcUK_p3v1.exe -> (NSIS o) -> zlib_nsis0002     detected: Application.AdSpeed (A) [285390]

Scanned    266914
Found    9

Scan end:    4.6.2017 г. 14:39:44
Scan time:    0:53:51
 

Ето го и архива   

 

  http://dox.bg/files/dw?a=198fc74c13

пп. Да изтрия откритите неща от Емисофт или просто да я затворя?

Изтрий само това:

Цитат

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{4613B1C1-FBC0-43C3-A4B9-B1D6CD360BB3}     detected: Application.AdLink (A) [280795]

 

Лога от стъпка 1 не е целия, затова Ви казах да го прикачите.

 

Изтрих го. Прикачвам 1-ви лог. 

http://dox.bg/files/dw?a=e1d5688756

Логът пак не е целия. Направете нови логове с FRST и ги прикачете.

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-06-2017
Ran by User (administrator) on ADMIN (04-06-2017 21:27:41)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 8 (X64) Language: Английски (Великобритания)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dritek System INC.) C:\Windows\RfBtnSvc64.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1212048 2012-06-07] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2864016 2012-08-10] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BtPreLoad] => "C:\Program Files (x86)\Bluetooth Suite\BtPreLoad.exe"
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-10-13] (Apple Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [2144448 2017-05-16] (BitTorrent Inc.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Viber] => C:\Users\User\AppData\Local\Viber\Viber.exe [69268048 2016-04-13] (Viber Media S.à r.l.)
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53729824 2015-08-07] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:54841;https=127.0.0.1:54841
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1
Tcpip\..\Interfaces\{06F1E4B9-9631-4C9B-B37A-1B2BC33E1255}: [DhcpNameServer] 46.40.72.9 46.40.72.13
Tcpip\..\Interfaces\{98A8C6A8-AA5E-46BE-96AD-8A46F61843A9}: [NameServer] 85.118.197.4 85.118.197.68
Tcpip\..\Interfaces\{E9F2B73D-E145-4B45-8212-E6A4C558D43C}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{FD6DA41D-3D53-4EB2-A4EE-0431FF427753}: [DhcpNameServer] 192.168.43.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3835505473-1799193542-3545088410-1001\Software\Microsoft\Internet Explorer\Main,Start Page = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 0ojs1dk1.default
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\0ojs1dk1.default [2017-06-04]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-02-17] (VideoLAN)

Chrome: 
=======
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-06-04]
CHR Extension: (Google Документи) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-24]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-27]
CHR Extension: (uBlock Origin) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-06-02]
CHR Extension: (Google Търсене) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (Google Документи офлайн) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]
CHR Extension: (Ghostery) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2017-06-02]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-22]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-04]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2017-06-04]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations)
S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [466064 2012-07-31] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [659600 2012-07-31] (Acer Incorporated)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-08-20] (Dritek System INC.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2015-07-06] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) [File not signed]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [5139968 2012-06-02] (Broadcom Corporation)
R1 epp; C:\EEK\bin64\epp.sys [124552 2016-11-23] (Emsisoft Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-08-20] (Dritek System Inc.)
S3 ssudobex; C:\Windows\system32\DRIVERS\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-06] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [281944 2015-07-06] (Microsoft Corporation)
S3 AthBTPort; \SystemRoot\system32\DRIVERS\btath_flt.sys [X]
S3 BTATH_A2DP; \SystemRoot\system32\drivers\btath_a2dp.sys [X]
S3 btath_avdt; \SystemRoot\system32\drivers\btath_avdt.sys [X]
S3 BTATH_BUS; \SystemRoot\System32\drivers\btath_bus.sys [X]
S3 BTATH_HCRP; \SystemRoot\System32\drivers\btath_hcrp.sys [X]
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]
S3 BTATH_RCP; \SystemRoot\System32\drivers\btath_rcp.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-04 21:27 - 2017-06-04 21:28 - 00011989 _____ C:\Users\User\Desktop\FRST.txt
2017-06-04 14:46 - 2017-06-04 14:46 - 00366468 _____ C:\Users\User\Desktop\Logs_User_04.06_14.46.zip
2017-06-04 14:42 - 2017-06-04 14:42 - 04912350 _____ (Rapture Technology ) C:\Users\User\Desktop\Glyph.exe
2017-06-04 13:43 - 2017-06-04 13:43 - 00000000 ____D C:\ProgramData\Emsisoft
2017-06-04 13:40 - 2017-06-04 17:08 - 00000000 ____D C:\EEK
2017-06-04 13:27 - 2017-06-04 13:34 - 304894760 _____ C:\Users\User\Desktop\EmsisoftEmergencyKit.exe
2017-06-04 08:50 - 2017-06-04 08:50 - 11599120 _____ (SurfRight B.V.) C:\Users\User\Desktop\HitmanPro_x64.exe
2017-06-04 08:42 - 2017-06-04 08:42 - 00000000 ____D C:\Program Files\HitmanPro
2017-06-04 08:41 - 2017-06-04 08:41 - 00000000 ____D C:\ProgramData\HitmanPro
2017-06-04 08:25 - 2017-06-04 08:25 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2017-06-04 08:03 - 2017-06-04 08:06 - 00004917 _____ C:\Users\User\Desktop\Fixlog.txt
2017-06-02 20:36 - 2017-06-02 20:36 - 00000000 ____D C:\Windows\pss
2017-06-02 20:07 - 2017-06-02 20:09 - 49529576 _____ (FinalWire Ltd. ) C:\Users\User\Downloads\aida64extreme590.exe
2017-06-02 18:51 - 2017-06-04 08:35 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-02 18:51 - 2017-06-02 18:51 - 00001070 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-06-02 18:51 - 2017-06-02 18:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-06-02 18:51 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-06-02 18:51 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-06-02 18:51 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-06-02 18:08 - 2017-06-04 21:27 - 00000000 ____D C:\FRST
2017-06-02 18:05 - 2017-06-02 18:05 - 02433536 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2017-05-19 17:47 - 2017-05-19 17:47 - 00085999 _____ C:\Users\User\Desktop\CV.pdf
2017-05-16 20:15 - 2017-05-22 11:33 - 00000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
2017-05-16 19:42 - 2017-05-16 19:55 - 1488202030 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.avi
2017-05-16 19:42 - 2017-05-16 19:42 - 00000687 ____R C:\Users\User\Desktop\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.nfo
2017-05-16 19:40 - 2017-05-16 19:41 - 00015067 _____ C:\Users\User\Downloads\Kong.Skull.Island.2017.HC.HDRip.XviD.AC3-EVO.torrent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-06-04 08:31 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-02 22:10 - 2014-07-14 15:15 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3835505473-1799193542-3545088410-1001
2017-06-02 20:56 - 2014-12-20 01:36 - 00000000 ____D C:\Windows\Minidump
2017-06-02 20:45 - 2014-10-14 23:08 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc
2017-06-02 20:03 - 2012-07-26 08:28 - 00848230 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-02 20:03 - 2012-07-26 06:37 - 00000000 ____D C:\Windows\Inf
2017-06-02 19:37 - 2016-04-15 22:33 - 00000000 ____D C:\Users\User\AppData\Roaming\ViberPC
2017-06-02 18:31 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-06-02 18:30 - 2012-08-20 02:35 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll
2017-06-02 18:30 - 2012-08-03 03:28 - 00000000 ____D C:\Program Files (x86)\NTI
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files\Acer
2017-06-02 18:25 - 2012-08-03 03:29 - 00000000 ____D C:\Program Files (x86)\Acer
2017-06-02 18:24 - 2012-08-03 03:28 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-06-02 18:16 - 2016-02-27 01:42 - 00000000 ____D C:\Users\User\AppData\Roaming\BSplayer
2017-06-02 18:16 - 2016-02-27 01:42 - 00000000 ____D C:\Program Files (x86)\Webteh
2017-06-02 17:53 - 2015-06-01 09:49 - 00000000 ____D C:\Users\User\AppData\Roaming\Foxit Software
2017-06-02 17:52 - 2014-08-07 18:53 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Lite
2017-06-02 17:51 - 2014-07-20 12:00 - 00002159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-02 17:51 - 2014-07-20 12:00 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-06-02 17:48 - 2012-08-03 03:29 - 00000000 ____D C:\ProgramData\Acer
2017-05-22 11:33 - 2014-10-02 17:55 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-19 17:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2017-05-16 19:44 - 2017-01-26 19:40 - 24944640 ____R C:\Users\User\Desktop\sample.avi
2017-05-16 19:40 - 2014-07-20 11:58 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-16 19:40 - 2014-07-20 11:58 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2017-06-04 08:25 - 2017-06-04 08:25 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-06-02 19:23

==================== End of FRST.txt ============================

Additional.txt

Има ли някакво подобрение след премахването на толкова неща?

преди 50 минути, Stoyannnov написа:

Има ли някакво подобрение след премахването на толкова неща?

Да значително по-добре е . Благодаря!!! На 1-2 пъти пак ми се отвориха някакви външни страници, ама това е нищо , спрямо това което беше преди.