Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

криптирани файлове .odin

stefarata
в Премахване на зловреден софтуер

Featured Replies

Цяла папка в компютъра е засегната, вътре имам някои важни файлове. Всичките са с разширение  .odin.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-08-2017
Ran by 11 (administrator) on 11-PC (18-08-2017 10:47:52)
Running from C:\Users\11\Desktop
Loaded Profiles: 11 (Available Profiles: 11)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) Language: Български (България)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Garmin Ltd. or its subsidiaries) C:\Program Files\Garmin\Device Interaction Service\GarminService.exe
(CANON INC.) C:\Windows\System32\CNAB3RPK.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTAgent.exe
(Viber Media S.à r.l.) C:\Users\11\AppData\Local\Viber\Viber.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files\Garmin\Express Tray\ExpressTray.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\Run: [uTorrent] => C:\Users\11\AppData\Roaming\uTorrent\uTorrent.exe [2150336 2017-08-02] (BitTorrent Inc.)
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3880640 2017-07-03] (Disc Soft Ltd)
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\Run: [Viber] => C:\Users\11\AppData\Local\Viber\Viber.exe [30867536 2017-08-03] (Viber Media S.à r.l.)
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [1421224 2017-08-04] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\MountPoints2: H - H:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\MountPoints2: {888878a9-7777-11e7-b2b3-6470021bcfea} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\MountPoints2: {d48670a0-7cd5-11e7-aebf-6470021bcfea} - F:\setup.exe
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\...\MountPoints2: {ee9fdf7e-7b67-11e7-ad89-6470021bcfea} - F:\HiSuiteDownLoader.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Canon LBP3000 Status Window.lnk [2017-08-15]
ShortcutTarget: Canon LBP3000 Status Window.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\CNAB3LAK.EXE (CANON INC.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SPDriverInstall.lnk [2017-08-16]
ShortcutTarget: SPDriverInstall.lnk -> C:\Program Files\MediaTek\SP Driver\SPDriverInstall (No File)
GroupPolicy: Restriction ? <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 212.39.90.42 8.8.8.8
Tcpip\..\Interfaces\{71902526-8799-4AA6-847E-117D3D8A13E1}: [DhcpNameServer] 212.39.90.42 8.8.8.8

Internet Explorer:
==================
HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

FireFox:
========
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-08-02] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-08-02] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\11\AppData\Local\Google\Chrome\User Data\Default [2017-08-18]
CHR Extension: (Google Презентации) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-08-02]
CHR Extension: (Google Документи) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-08-02]
CHR Extension: (Google Диск) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-08-02]
CHR Extension: (YouTube) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-08-02]
CHR Extension: (Adobe Acrobat) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-08-07]
CHR Extension: (Електронни таблици от Google) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-08-02]
CHR Extension: (Google Документи офлайн) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-08-02]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-02]
CHR Extension: (Gmail) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-08-02]
CHR Extension: (Chrome Media Router) - C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-02]
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276288 2012-08-07] (Intel Corporation)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [2324672 2017-07-03] (Disc Soft Ltd)
R2 Garmin Device Interaction Service; C:\Program Files\Garmin\Device Interaction Service\GarminService.exe [1102352 2017-08-04] (Garmin Ltd. or its subsidiaries)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AR9271; C:\Windows\System32\DRIVERS\athuw.sys [1763584 2013-06-29] (Atheros Communications, Inc.)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [26168 2017-08-09] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [40504 2017-08-09] (Disc Soft Ltd)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-18 10:47 - 2017-08-18 10:47 - 000008299 _____ C:\Users\11\Desktop\FRST.txt
2017-08-18 10:47 - 2017-08-18 10:47 - 000000000 ____D C:\FRST
2017-08-18 10:46 - 2017-08-18 10:46 - 001792512 _____ (Farbar) C:\Users\11\Desktop\FRST.exe
2017-08-18 10:36 - 2017-08-18 10:47 - 000000000 ____D C:\Program Files\Reimage
2017-08-18 10:36 - 2017-08-18 10:46 - 000000140 _____ C:\Windows\Reimage.ini
2017-08-18 10:36 - 2017-08-18 10:36 - 000604928 _____ (Reimage) C:\Users\11\Downloads\ReimageRepair.exe
2017-08-17 17:00 - 2017-08-17 17:00 - 000014731 _____ C:\Users\11\Downloads\HealthStatus.html
2017-08-17 16:50 - 2017-08-17 16:50 - 000062464 _____ C:\Users\11\Downloads\deklaracia_7_zdravnoosig_vnoski (1).xls
2017-08-17 16:44 - 2017-08-17 16:44 - 000062464 _____ C:\Users\11\Downloads\deklaracia_7_zdravnoosig_vnoski.xls
2017-08-17 16:37 - 2017-08-17 16:37 - 000092160 _____ C:\Users\11\Downloads\Deklaracia_1_20177 (1).xls
2017-08-17 16:37 - 2017-08-17 16:37 - 000033134 _____ C:\Users\11\Downloads\Deklaracia_7_2017.xlsx
2017-08-17 16:36 - 2017-08-17 16:36 - 000092160 _____ C:\Users\11\Downloads\Deklaracia_1_20177.xls
2017-08-16 14:37 - 2017-08-16 14:37 - 003732163 _____ C:\Users\11\Desktop\robot.rar
2017-08-16 14:05 - 2017-08-16 14:33 - 000000000 ____D C:\Users\11\Desktop\robot
2017-08-16 14:01 - 2017-08-16 14:06 - 057118257 _____ C:\Users\11\Downloads\MTK Usb Driver v1.0.8.zip
2017-08-16 13:50 - 2017-08-16 14:09 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SP Driver
2017-08-16 13:50 - 2017-08-16 13:50 - 000000000 ____D C:\Users\11\.android
2017-08-16 13:50 - 2017-08-16 13:50 - 000000000 ____D C:\Program Files\MediaTek
2017-08-16 13:49 - 2017-08-16 13:49 - 000000000 ____D C:\Users\11\Desktop\MTK_USB_All_1.0.1
2017-08-16 13:48 - 2017-08-16 13:49 - 057116528 _____ C:\Users\11\Downloads\MTK_USB_All_v1.0.1.zip
2017-08-16 13:20 - 2017-08-16 13:20 - 000012359 _____ C:\Users\11\Downloads\Mature nl Sabrina Jade - Hardcore (04.08.2017) rq.mp4.torrent
2017-08-16 13:07 - 2017-08-16 13:07 - 000016211 _____ C:\Users\11\Downloads\[pornolab.net].t1887011.torrent
2017-08-16 12:39 - 2017-08-16 12:39 - 000013351 _____ C:\Users\11\Downloads\[pornolab.net].t1887010.torrent
2017-08-15 16:32 - 2017-08-15 16:32 - 000223558 _____ C:\Users\11\Desktop\machine8.bmp
2017-08-15 16:27 - 2017-08-15 16:27 - 000000000 ____D C:\ProgramData\GRETECH
2017-08-15 16:26 - 2017-08-15 16:26 - 000002033 _____ C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\GOM Player.lnk
2017-08-15 16:26 - 2017-08-15 16:26 - 000001133 _____ C:\Users\Public\Desktop\GOM Player.lnk
2017-08-15 16:26 - 2017-08-15 16:26 - 000000000 ____D C:\Users\11\AppData\Roaming\GRETECH
2017-08-15 16:26 - 2017-08-15 16:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM
2017-08-15 16:26 - 2017-08-15 16:26 - 000000000 ____D C:\Program Files\GRETECH
2017-08-15 16:26 - 2017-08-15 16:26 - 000000000 _____ C:\end
2017-08-15 16:25 - 2017-08-15 16:25 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Printer Uninstaller
2017-08-15 16:25 - 2017-08-15 16:25 - 000000000 ____D C:\Program Files\Canon
2017-08-15 16:25 - 2012-12-28 06:01 - 000075136 _____ C:\Users\11\Downloads\Windows 8_Notice.pdf
2017-08-15 16:25 - 2012-10-27 18:00 - 000192512 _____ (CANON INC.) C:\Windows\system32\CNAB3EMU.DLL
2017-08-15 16:25 - 2012-10-27 18:00 - 000163840 _____ (CANON INC.) C:\Windows\system32\CNAB3SMK.DLL
2017-08-15 16:25 - 2012-10-27 18:00 - 000113856 _____ (CANON INC.) C:\Windows\system32\CNAB3RPK.EXE
2017-08-15 16:25 - 2012-10-27 18:00 - 000106496 _____ (CANON INC.) C:\Windows\system32\CNAB3LMK.DLL
2017-08-15 16:25 - 2012-10-27 18:00 - 000057344 _____ (CANON INC.) C:\Windows\system32\CNAB3PTU.DLL
2017-08-15 16:24 - 2017-08-15 16:24 - 027679768 _____ (GOM & Company) C:\Users\11\Downloads\GOMPLAYERGLOBALSETUP_CHROME.EXE
2017-08-15 16:24 - 2017-08-15 16:24 - 000000000 ____D C:\Users\11\Downloads\LBP3000_R150_V330_W32_uk_EN_1
2017-08-15 16:23 - 2017-08-15 16:24 - 009616960 _____ C:\Users\11\Downloads\LBP3000_R150_V330_W32_uk_EN_1.exe
2017-08-14 15:51 - 2017-08-14 15:51 - 000048690 _____ C:\Users\11\Downloads\Primo_BG_Speedcam.zip
2017-08-14 14:48 - 2017-08-14 14:54 - 000000000 ____D C:\Users\11\Desktop\igo8 -4
2017-08-14 14:26 - 2011-12-06 10:55 - 000053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\system32\CSVer.dll
2017-08-14 12:37 - 2017-08-14 13:20 - 251892247 _____ C:\Users\11\Downloads\Intel_Chipset_XPVistaWin7_V9301019.zip
2017-08-14 12:37 - 2017-08-14 12:37 - 003119651 _____ C:\Users\11\Downloads\P8H61-M-ASUS-4801.zip
2017-08-14 12:35 - 2017-08-14 12:35 - 000000941 _____ C:\Users\Public\Desktop\AIDA64 Engineer Edition.lnk
2017-08-14 12:35 - 2017-08-14 12:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AIDA64 Engineer Edition
2017-08-14 12:34 - 2017-08-14 12:35 - 000000000 ____D C:\Program Files\AIDA64
2017-08-14 11:49 - 2017-08-14 11:49 - 000000000 ____D C:\Users\11\Documents\Garmin
2017-08-14 11:36 - 2017-08-14 11:37 - 069999448 _____ (Microsoft Corporation) C:\Users\11\Downloads\NDP452-KB2901907-x86-x64-AllOS-ENU.exe
2017-08-14 11:36 - 2017-04-28 01:50 - 003550208 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-08-14 11:30 - 2017-08-14 14:05 - 000000000 ____D C:\ProgramData\Garmin
2017-08-14 11:30 - 2017-08-14 11:43 - 000000000 ____D C:\Users\11\AppData\Local\Garmin_Ltd._or_its_subsid
2017-08-14 11:30 - 2017-08-14 11:30 - 000001860 _____ C:\Users\Public\Desktop\Garmin Express.lnk
2017-08-14 11:30 - 2017-08-14 11:30 - 000000000 ____D C:\Users\11\AppData\Roaming\Garmin
2017-08-14 11:30 - 2017-08-14 11:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2017-08-14 11:30 - 2017-08-14 11:30 - 000000000 ____D C:\Program Files\Garmin
2017-08-14 11:30 - 2017-08-14 11:30 - 000000000 ____D C:\Program Files\DIFX
2017-08-14 11:29 - 2017-08-14 11:29 - 000000000 ____D C:\ProgramData\Package Cache
2017-08-10 14:18 - 2017-08-10 14:18 - 000000981 _____ C:\Users\Public\Desktop\Fotosizer.lnk
2017-08-10 14:18 - 2017-08-10 14:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fotosizer
2017-08-10 14:18 - 2017-08-10 14:18 - 000000000 ____D C:\Program Files\Fotosizer
2017-08-10 14:11 - 2017-08-10 14:17 - 000000000 ____D C:\Users\11\Desktop\Карина
2017-08-10 14:07 - 2017-08-10 14:07 - 000001067 _____ C:\Users\Public\Desktop\FastStone Image Viewer.lnk
2017-08-10 14:07 - 2017-08-10 14:07 - 000000000 ____D C:\Users\11\AppData\Roaming\FastStone
2017-08-10 14:07 - 2017-08-10 14:07 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Image Viewer
2017-08-10 14:07 - 2017-08-10 14:07 - 000000000 ____D C:\Program Files\FastStone Image Viewer
2017-08-10 14:02 - 2017-08-18 08:48 - 000000000 ____D C:\Users\11\AppData\Roaming\ViberPC
2017-08-10 14:02 - 2017-08-11 12:17 - 000000000 ____D C:\Users\11\Documents\ViberDownloads
2017-08-10 14:02 - 2017-08-10 14:02 - 000000903 _____ C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\Viber.lnk
2017-08-10 14:02 - 2017-08-10 14:02 - 000000901 _____ C:\Users\11\Desktop\Viber.lnk
2017-08-10 14:02 - 2017-08-10 14:02 - 000000000 ____D C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Viber
2017-08-10 14:02 - 2017-08-10 14:02 - 000000000 ____D C:\Users\11\AppData\Local\Viber Media S.à r.l
2017-08-10 14:01 - 2017-08-10 14:02 - 000000000 ____D C:\Users\11\AppData\Local\Viber
2017-08-10 14:01 - 2017-08-10 14:01 - 000000000 ____D C:\Users\11\AppData\Local\Package Cache
2017-08-09 13:48 - 2017-08-09 13:48 - 000002217 _____ C:\Users\11\Desktop\Counter-Strike 1.6 CSS Edition.lnk
2017-08-09 13:47 - 2017-08-09 13:47 - 000000000 ____D C:\Program Files\Valve
2017-08-09 12:13 - 2017-08-09 13:38 - 000000472 __RSH C:\ProgramData\ntuser.pol
2017-08-09 12:13 - 2017-08-09 12:13 - 000000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2017-08-09 12:13 - 2017-08-09 12:13 - 000000000 ____D C:\Users\11\AppData\Local\Disc_Soft_Ltd
2017-08-09 11:56 - 2017-08-09 11:56 - 000040504 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtliteusbbus.sys
2017-08-09 11:55 - 2017-08-09 12:13 - 000000000 ____D C:\Users\11\AppData\Roaming\DAEMON Tools Lite
2017-08-09 11:55 - 2017-08-09 12:13 - 000000000 ____D C:\Program Files\DAEMON Tools Lite
2017-08-09 11:55 - 2017-08-09 11:55 - 000026168 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys
2017-08-09 11:55 - 2017-08-09 11:55 - 000001930 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2017-08-09 11:55 - 2017-08-09 11:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2017-08-09 11:55 - 2017-08-09 11:55 - 000000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-08-07 14:55 - 2017-08-07 14:55 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-08-07 14:55 - 2017-08-07 14:55 - 000000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2017-08-07 14:40 - 2010-05-26 11:41 - 002106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2017-08-07 14:40 - 2010-05-26 11:41 - 001998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2017-08-07 13:38 - 2017-08-07 13:38 - 000000000 ____D C:\tts
2017-08-07 09:20 - 2017-08-07 09:20 - 000000000 ____D C:\Users\11\AppData\Roaming\Adobe
2017-08-07 09:20 - 2017-08-07 09:20 - 000000000 ____D C:\Users\11\AppData\LocalLow\Adobe
2017-08-07 09:20 - 2017-08-07 09:20 - 000000000 ____D C:\Users\11\AppData\Local\CEF
2017-08-07 09:16 - 2017-08-14 11:37 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-08-07 09:16 - 2017-08-07 09:16 - 000002017 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2017-08-07 09:16 - 2017-08-07 09:16 - 000000000 ____D C:\Program Files\Common Files\Adobe
2017-08-07 09:16 - 2017-08-07 09:16 - 000000000 ____D C:\Program Files\Adobe
2017-08-07 09:15 - 2017-08-07 15:12 - 000000000 ____D C:\ProgramData\Adobe
2017-08-07 09:14 - 2017-08-07 09:20 - 000000000 ____D C:\Users\11\AppData\Local\Adobe
2017-08-07 09:01 - 2017-08-07 09:01 - 000000000 ____D C:\Windows\PCHEALTH
2017-08-07 09:01 - 2017-08-07 09:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2017-08-07 09:01 - 2017-08-07 09:01 - 000000000 ____D C:\Program Files\Microsoft Works
2017-08-07 09:01 - 2017-08-07 09:01 - 000000000 ____D C:\Program Files\Microsoft Visual Studio
2017-08-07 09:01 - 2017-08-07 09:01 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2017-08-07 08:59 - 2017-08-07 09:01 - 000000000 ____D C:\Program Files\Microsoft Office
2017-08-07 08:59 - 2017-08-07 08:59 - 000000000 __RHD C:\MSOCache
2017-08-07 08:59 - 2017-08-07 08:59 - 000000000 ____D C:\Users\11\AppData\Local\Microsoft Help
2017-08-02 16:46 - 2017-08-02 16:46 - 000000000 ____D C:\Users\11\AppData\Roaming\WinRAR
2017-08-02 16:46 - 2017-08-02 16:46 - 000000000 ____D C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-08-02 16:46 - 2017-08-02 16:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-08-02 16:46 - 2017-08-02 16:46 - 000000000 ____D C:\Program Files\WinRAR
2017-08-02 16:33 - 2017-08-18 08:47 - 000000340 _____ C:\Windows\Tasks\DriverToolkit Autorun.job
2017-08-02 15:57 - 2017-08-02 15:57 - 000000000 ____D C:\Users\11\Documents\Virtual Machines
2017-08-02 15:47 - 2017-08-07 08:53 - 000000000 ____D C:\Users\11\AppData\Roaming\VMware
2017-08-02 15:47 - 2017-08-02 16:41 - 000000000 ____D C:\Users\11\AppData\Local\VMware
2017-08-02 15:45 - 2017-08-02 15:45 - 000001024 _____ C:\Windows\system32\%TMP%
2017-08-02 15:44 - 2017-08-07 08:54 - 000000000 ____D C:\ProgramData\VMware
2017-08-02 15:31 - 2017-08-02 15:31 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2017-08-02 15:19 - 2017-08-02 15:19 - 000002419 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
2017-08-02 15:18 - 2017-08-02 15:19 - 000000000 ____D C:\Windows\WindowsMobile
2017-08-02 15:05 - 2017-08-02 14:10 - 000000000 ____D C:\Windows\Panther
2017-08-02 14:57 - 2017-08-02 14:58 - 000000000 ____D C:\ProgramData\DriverGenius
2017-08-02 14:57 - 2017-08-02 14:57 - 000000000 ___SD C:\Users\11\AppData\LocalLow\Temp
2017-08-02 14:56 - 2017-08-02 14:57 - 000000000 ____D C:\DriverGenius-Downloads
2017-08-02 14:52 - 2017-08-18 09:05 - 000000000 ____D C:\Users\11\AppData\Roaming\uTorrent
2017-08-02 14:52 - 2017-08-02 14:52 - 000000810 _____ C:\Users\11\Desktop\µTorrent.lnk
2017-08-02 14:52 - 2017-08-02 14:52 - 000000790 _____ C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2017-08-02 14:48 - 2017-08-02 16:48 - 000000000 ____D C:\Program Files\DriverToolkit
2017-08-02 14:48 - 2017-08-02 14:48 - 000000000 ____D C:\Users\11\AppData\Local\DriverToolkit
2017-08-02 14:46 - 2017-08-18 08:51 - 000002139 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-08-02 14:46 - 2017-08-18 08:51 - 000002127 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-08-02 14:45 - 2017-08-07 14:38 - 000084896 _____ C:\Users\11\AppData\Local\GDIPFONTCACHEV1.DAT
2017-08-02 14:45 - 2017-08-02 14:56 - 000000000 ____D C:\Users\11\AppData\Local\Google
2017-08-02 14:45 - 2017-08-02 14:45 - 000000000 ____D C:\Users\11\AppData\Local\Deployment
2017-08-02 14:45 - 2017-08-02 14:45 - 000000000 ____D C:\Users\11\AppData\Local\Apps\2.0
2017-08-02 14:45 - 2017-08-02 14:45 - 000000000 ____D C:\Program Files\Google
2017-08-02 14:42 - 2017-08-02 14:42 - 000015384 _____ C:\Windows\system32\results.xml
2017-08-02 14:30 - 2017-08-14 14:26 - 000000000 ____D C:\Program Files\Intel
2017-08-02 14:30 - 2017-08-02 14:30 - 000000000 ____D C:\ProgramData\Intel
2017-08-02 14:30 - 2017-08-02 14:30 - 000000000 ____D C:\Program Files\Common Files\Intel
2017-08-02 14:30 - 2012-08-03 09:34 - 000056320 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2017-08-02 14:29 - 2017-08-02 14:29 - 000001769 _____ C:\Windows\Language_trs.ini
2017-08-02 14:29 - 2017-08-02 14:29 - 000000000 ____D C:\Intel
2017-08-02 14:21 - 2017-08-02 14:21 - 000000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2017-08-02 14:11 - 2017-08-02 14:11 - 000001401 _____ C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-08-02 14:10 - 2017-08-16 13:50 - 000000000 ____D C:\Users\11
2017-08-02 14:10 - 2017-08-09 13:49 - 000000000 ____D C:\Users\11\AppData\Local\VirtualStore
2017-08-02 14:10 - 2017-08-02 14:10 - 000000020 ___SH C:\Users\11\ntuser.ini
2017-08-02 14:10 - 2011-04-12 04:36 - 000000000 ____D C:\Users\11\AppData\Roaming\Media Center Programs
2017-08-02 14:08 - 2017-08-02 14:08 - 000001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2017-08-02 14:08 - 2017-08-02 14:08 - 000001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-18 09:50 - 2009-07-14 07:34 - 000016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-08-18 09:50 - 2009-07-14 07:34 - 000016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-08-18 08:52 - 2010-11-21 00:01 - 000781298 _____ C:\Windows\system32\PerfStringBackup.INI
2017-08-18 08:52 - 2009-07-14 05:37 - 000000000 ____D C:\Windows\inf
2017-08-18 08:47 - 2009-07-14 07:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-08-09 12:13 - 2009-07-14 05:37 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2017-08-07 15:00 - 2009-07-14 07:33 - 000343200 _____ C:\Windows\system32\FNTCACHE.DAT
2017-08-07 09:01 - 2009-07-14 05:37 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2017-08-07 09:00 - 2011-04-12 04:37 - 000000000 ____D C:\Windows\ShellNew
2017-08-02 15:04 - 2009-07-14 07:52 - 000028672 _____ C:\Windows\system32\config\BCD-Template
2017-08-02 14:10 - 2009-07-14 05:37 - 000000000 ____D C:\Windows\rescache
2017-08-02 14:08 - 2009-07-14 07:52 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-08-02 14:07 - 2009-07-14 05:37 - 000000000 ____D C:\Windows\system32\sysprep
2017-08-02 14:06 - 2011-04-12 04:37 - 000000000 ____D C:\Windows\CSC

Some files in TEMP:
====================
2017-06-20 04:59 - 2017-06-20 04:59 - 000164424 _____ (Microsoft Corporation) C:\Users\11\AppData\Local\Temp\atl110.dll
2017-08-09 11:53 - 2017-08-09 11:54 - 026624872 _____ (Disc Soft Ltd) C:\Users\11\AppData\Local\Temp\DTLite1060-0275_split.exe
2017-08-09 11:56 - 2017-08-09 11:56 - 001005568 _____ (Microsoft Corporation) C:\Users\11\AppData\Local\Temp\dt_D25F.tmp.exe
2017-06-20 04:59 - 2017-06-20 04:59 - 000069632 _____ () C:\Users\11\AppData\Local\Temp\HwInfo.dll
2017-06-20 04:59 - 2017-06-20 04:59 - 000900096 _____ () C:\Users\11\AppData\Local\Temp\NSISPromotionEx.dll
2017-08-18 10:36 - 2017-08-18 10:36 - 012171856 _____ (Reimage) C:\Users\11\AppData\Local\Temp\ReimagePackage.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-08-11 09:35

==================== End of FRST.txt ============================

Addition.txt

desktop.jpg

преди 12 минути, adersa написа:

Ако нямате стар бекъп на файловете всичко е загубено . Явно това е някакъв нов вид крипт .

Правила на форум: Премахване на зловреден софтуер - HiJackThis логове


2. Забранено е на всички потребители да пишат в чужди теми. Само авторът на темата и екипът на HiJackThis могат да добавят отговори в конкретната тема.

Здравейте.

Доста лошо... Заразен сте с нова версия на криптиращия вирус Locky. Изглежда е минал от .zepto на .odin разширение, вероятно са "зашили" старите пробойни в алгоритъма на Locky.  За съжаление декриптор няма. Нямам представа дали се очаква такъв, но силно се съмнявам.

Файловете са безопасни и могат да се запазят на машината, и да се чака за декриптор. Логовете ми изглеждат чисти, ще направим 1-2 проверки, за да съм сигурен, че системата е напълно чиста.

Видях други проблеми:

  • Проблем с твърдия диск или интерфейсния кабел, трябва да се направи по-дълбока диагностика, за да се разбере кой е виновника:
Цитат

Description: The driver detected a controller error on \Device\Harddisk1\DR13.

  • Липсват 2 драйвера:
Цитат

Name: Ethernet Controller
Description: Ethernet Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

Първото е драйвер за LAN карата, второто вероятно е драйвера + софтуера за управление на Energy Management-а. Трябват хардуерни идентификатори, за да се намерят драйвери.

 

 

Стъпка 1

Изтеглете: MKLLMRQ.png Malwarebytes Anti-Malware.

  • Стартирайте инсталационния файл и следвайте съветника за инсталация.
  • Преди края на инсталацията премахнете отметката от: "Enable free trial of Malwarebytes Anti-Malware Premium" и се уверете че има отметка пред "Launch Malwarebytes Anti-Malware".
  • Отидете до табът Settings => Detection and Protection => сложете отметка на "Scan for rootkits".
  • Отидете до табът Dashboard => натиснете бутона "SCAN NOW".
  • Програмата автоматично ще провери за актуализации и ще започне сканирането.

Забележка: Ако видите съобщението "Could not load DDA driver" натиснете бутона "YES". След което разрешете на системата да се рестартира.

  • След като проверката приключи натиснете бутона "Remove Selected".
  • Системата ще поиска рестарт, съгласете се.
  • След като системата зареди MBAB ще зареди.
  • Отидете до табът History => Applications Logs.
  • Потърсете лог с име "SCAN LOG" с последната дата и час и натиснете върху него.
  • Натиснете бутона EXPORT => Copy to Clipboard.
  • Поставете съдържанието на лога с клавишната комбинация CTRL+V към следващия Ви коментар.

 

Стъпка 2

 

Изтеглете: QlYrtp7.jpg HitmanPro.

  • Запазете файла на вашия десктоп.
  • Стартирайте програмата.

Забележка: Програмата ще се актуализира, след актуализацията HitmanPro ще се рестартира.

  • Натиснете бутона "Напред".
  • Сложете отметка на лицензионното споразумение и натиснете отново бутона "Напред".
  • Кликнете върху "Не, искам да извърша еднократно сканиране на компютъра" и натиснете бутона "Напред".
  • Програмата ще започне да сканира. Сканирането ще отнеме ~2 минути.
  • След като сканирането приключи от списъка с намерените обекти(ако има такива) изберете Apply to all => Ignore.
  • Натиснете бутона "Next" и след това бутона "Изнеси резултатите от сканирането в XML файл" и запазете лог файла на десктопа.
  • Отворете лог файла, копирайте съдържанието му и го поставете в следващия Ви коментар.

Забележка: Ако от падащото меню няма Ignore тогава просто затворете програмата след края на проверката без да премахвате нищо!

От My Computer => Tools => Folder Options => View => Сложете отметка пред "Show hidden files, folders and drives".
Натиснете Apply.

Влезте в C:\Programdata\HitmanPro\Logs прикачете лога към следващия Ви коментар.

 

  • Автор

Malwarebytes Anti-Malware
www.malwarebytes.org

Дата на сканиране: 22.8.2017 г.
Час на сканиране: 12:16 ч.
Дневник: 
Администратор: Да

Версия: 2.2.1.1043
База от данни за злонамерен софтуер: v2017.08.22.03
База от данни за рууткити: v2017.08.02.01
Лиценз: Безплатен
Защита от злонамерен софтуер: Забранено
Защита от злонамерени страници: Забранено
Самозащита: Забранено

ОС: Windows 7 Service Pack 1
Процесор: x86
Файлова система: NTFS
Потребител: 11

Тип сканиране: Сканиране за заплахи
Резултат: Завършено
Сканиране обекти: 211283
Изминало време: 6 мин. 47 сек.

Памет: Разрешено
Начално стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
Рууткити: Разрешено
Евристика: Разрешено
ПНП: Разрешено
ПНИ: Разрешено

Процеси: 0
(Не бяха открити злонамерени обекти)

Модули: 0
(Не бяха открити злонамерени обекти)

Ключове в системния регистър: 15
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\APPID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}, Поставен под карантина, [c19a40508d1c92a462e637047e82d52b], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\TYPELIB\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\REI_AxControl.ReiEngine.1, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\REI_AxControl.ReiEngine, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{10ECCE17-29B5-4880-A8F5-EAD298611484}, Поставен под карантина, [d388355b3178fc3aedb20925d9278779], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}, Поставен под карантина, [5cff00901297b284cdb761ca41bfc13f], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\APPID\REI_AxControl.DLL, Поставен под карантина, [91caff919c0d5adce0d758d230d04db3], 
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\TYPELIB\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}\1.0, Поставен под карантина, [7cdf4f414b5ed95ddca1d06cb947ff01], 
PUP.Optional.Reimage, HKLM\SOFTWARE\REIMAGE\Reimage Repair, Поставен под карантина, [e47769277e2bcc6ae04dfd46ce328a76], 
PUP.Optional.Reimage, HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\SOFTWARE\Reimage, Поставен под карантина, [a3b867292f7a261004e936270af68f71], 
PUP.Optional.Reimage, HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\SOFTWARE\LOCAL APPWIZARD-GENERATED APPLICATIONS\Reimage - Windows Problem Relief., Поставен под карантина, [5704d7b93376989e15344fe81ce4f40c], 
PUP.Optional.Reimage, HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\SOFTWARE\REIMAGE\PC REPAIR, Поставен под карантина, [92c9aae65356eb4bf0622d019070738d], 

Стойности в системния регистър: 2
PUP.Optional.Reimage, HKLM\SOFTWARE\CLASSES\TYPELIB\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}\1.0, REI_AxControl 1.0 Type Library, Поставен под карантина, [7cdf4f414b5ed95ddca1d06cb947ff01]
PUP.Optional.Reimage, HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\SOFTWARE\REIMAGE\PC REPAIR|QuitMessage,  , Поставен под карантина, [92c9aae65356eb4bf0622d019070738d]

Данни в системния регистър: 0
(Не бяха открити злонамерени обекти)

Папки: 0
(Не бяха открити злонамерени обекти)

Файлове: 5
PUP.Optional.Reimage, C:\Users\11\AppData\Local\Temp\ReimagePackage.exe, Поставен под карантина, [2338543c3b6e2610f037939929d79868], 
PUP.Optional.Reimage, C:\Users\11\Downloads\ReimageRepair.exe, Поставен под карантина, [8ad17e126e3b93a34fd859d3f20e50b0], 
PUP.Optional.Reimage, C:\Users\11\AppData\Local\Temp\Reimage.log, Поставен под карантина, [5605ff91951476c074db1629a8580ff1], 
PUP.Optional.Reimage, C:\Windows\Temp\reimage.log, Поставен под карантина, [f7641977862386b0282799a658a8c838], 
PUP.Optional.Reimage, C:\Windows\Reimage.ini, Поставен под карантина, [db80731df3b6f83e1c63404cab56f60a], 

Физически сектори: 0
(Не бяха открити злонамерени обекти)


(end)

  

HitmanPro 3.7.20.286
www.hitmanpro.com
	   Computer name . . . . : 11-PC
   Windows . . . . . . . : 6.1.1.7601.X86/2
   User name . . . . . . : 11-PC\11
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free
	   Scan date . . . . . . : 2017-08-22 12:33:24
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 2m 3s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No
	   Threats . . . . . . . : 3
   Traces  . . . . . . . : 170
	   Objects scanned . . . : 574 969
   Files scanned . . . . : 17 064
   Remnants scanned  . . : 112 313 files / 445 592 keys
	Malware _____________________________________________________________________
	   C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916.exe
      Size . . . . . . . : 2 150 336 bytes
      Age  . . . . . . . : 19.9 days (2017-08-02 14:52:47)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : 5B35C658221EAD9E675241FA10B10FFC0A650BF64E78DE6C0A69FCDE1EE89401
      Product  . . . . . : µTorrent
      Publisher  . . . . : BitTorrent Inc.
      Description  . . . : µTorrent
      Version  . . . . . : 3.5.0.43916
      Copyright  . . . . : ©2016 BitTorrent, Inc. All Rights Reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
    > HitmanPro  . . . . : Malware
      Fuzzy  . . . . . . : 102.0
      Forensic Cluster
         -5.7s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\1f91d2d17ea675d4c2c3192e241743f9_28003e65-26c7-4c2d-b07d-dce19e5b60f3
         -1.5s C:\Users\11\AppData\Roaming\uTorrent\
         -1.5s C:\Users\11\AppData\Roaming\uTorrent\utorrent.lng
         -1.4s C:\Users\11\AppData\Roaming\uTorrent\settings.dat.old
         -1.4s C:\Users\11\AppData\Roaming\uTorrent\apps\
         -1.4s C:\Users\11\AppData\Roaming\uTorrent\uTorrent.exe
         -1.4s C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
         -1.4s C:\Users\11\Desktop\µTorrent.lnk
         -1.4s C:\Users\11\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
         -1.4s C:\Users\11\AppData\Roaming\uTorrent\maindoc.ico
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\plus.btapp
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\player.btapp
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\btapp
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\main.css
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\icon.bmp
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.html
         -1.0s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.js
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\welcome-upsell.btapp
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\btapp
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\empty_movie.gif
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\index.html
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\info_icon.png
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\main.css
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\vid_thumb.jpg
         -0.8s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\x.png
         -0.7s C:\Users\11\AppData\Roaming\uTorrent\apps\featuredContent.btapp
         -0.0s C:\Users\11\AppData\Roaming\uTorrent\share\
         -0.0s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\5a028b3ab4059d1387a874c7ce4285d7_28003e65-26c7-4c2d-b07d-dce19e5b60f3
          0.0s C:\Users\11\AppData\Roaming\uTorrent\updates\
          0.0s C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916.exe
          0.0s C:\Users\11\AppData\Roaming\uTorrent\updates.dat
          0.2s C:\Users\11\AppData\Roaming\uTorrent\dlimagecache\
          0.2s C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916\
          0.2s C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916\utorrentie.exe
          2.2s C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@bitmedianetwork[1].txt
          5.6s C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@quantserve[2].txt
         11.2s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\3f2c3b609b68513f1897e6a1467feab1_28003e65-26c7-4c2d-b07d-dce19e5b60f3
         14.7s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\b5f3c5e06cb7c5f56a48ecbe7b73d002_28003e65-26c7-4c2d-b07d-dce19e5b60f3
         22.1s C:\Users\11\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
         23.2s C:\Users\11\AppData\Roaming\uTorrent\dht_feed.dat.old
         23.2s C:\Users\11\AppData\Roaming\uTorrent\rss.dat.old
         23.2s C:\Users\11\AppData\Roaming\uTorrent\dht.dat.old
         23.3s C:\Users\11\AppData\Roaming\uTorrent\resume.dat.old
         24.4s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\5dedb91a784c2876f36643589e6b28f5_28003e65-26c7-4c2d-b07d-dce19e5b60f3
	   C:\Users\11\AppData\Roaming\uTorrent\uTorrent.exe
      Size . . . . . . . : 2 150 336 bytes
      Age  . . . . . . . : 19.9 days (2017-08-02 14:52:45)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : 5B35C658221EAD9E675241FA10B10FFC0A650BF64E78DE6C0A69FCDE1EE89401
      Product  . . . . . : µTorrent
      Publisher  . . . . : BitTorrent Inc.
      Description  . . . : µTorrent
      Version  . . . . . : 3.5.0.43916
      Copyright  . . . . : ©2016 BitTorrent, Inc. All Rights Reserved.
      RSA Key Size . . . : 2048
      Desktop  . . . . . : Default
      Parent Name  . . . : C:\Windows\Explorer.EXE
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Running processes  : 2664
    > HitmanPro  . . . . : Malware
      Fuzzy  . . . . . . : 109.0
      Startup
         HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uTorrent
      References
         C:\Users\11\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
         C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
         C:\Users\11\Desktop\µTorrent.lnk
      Network Ports
         0.0.0.0:60865    
         127.0.0.1:10000    
         192.168.1.5:60865    89.215.245.126:55724
      Forensic Cluster
         -4.3s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\1f91d2d17ea675d4c2c3192e241743f9_28003e65-26c7-4c2d-b07d-dce19e5b60f3
         -0.0s C:\Users\11\AppData\Roaming\uTorrent\
         -0.0s C:\Users\11\AppData\Roaming\uTorrent\utorrent.lng
         -0.0s C:\Users\11\AppData\Roaming\uTorrent\settings.dat.old
         -0.0s C:\Users\11\AppData\Roaming\uTorrent\apps\
          0.0s C:\Users\11\AppData\Roaming\uTorrent\uTorrent.exe
          0.0s C:\Users\11\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
          0.0s C:\Users\11\Desktop\µTorrent.lnk
          0.0s C:\Users\11\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
          0.0s C:\Users\11\AppData\Roaming\uTorrent\maindoc.ico
          0.4s C:\Users\11\AppData\Roaming\uTorrent\apps\plus.btapp
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\player.btapp
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\btapp
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\main.css
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\icon.bmp
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.html
          0.5s C:\Users\11\AppData\Roaming\uTorrent\apps\72F0D3E2141065DACF6134D07A06A2DF20590748\index.js
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\welcome-upsell.btapp
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\btapp
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\empty_movie.gif
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\index.html
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\info_icon.png
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\main.css
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\vid_thumb.jpg
          0.6s C:\Users\11\AppData\Roaming\uTorrent\apps\D944B3378FAB35793B7951FA53E41B2AB9CC462B\x.png
          0.7s C:\Users\11\AppData\Roaming\uTorrent\apps\featuredContent.btapp
          1.4s C:\Users\11\AppData\Roaming\uTorrent\share\
          1.4s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\5a028b3ab4059d1387a874c7ce4285d7_28003e65-26c7-4c2d-b07d-dce19e5b60f3
          1.4s C:\Users\11\AppData\Roaming\uTorrent\updates\
          1.4s C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916.exe
          1.4s C:\Users\11\AppData\Roaming\uTorrent\updates.dat
          1.6s C:\Users\11\AppData\Roaming\uTorrent\dlimagecache\
          1.6s C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916\
          1.6s C:\Users\11\AppData\Roaming\uTorrent\updates\3.5.0_43916\utorrentie.exe
          3.6s C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@bitmedianetwork[1].txt
          7.0s C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@quantserve[2].txt
         12.6s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\3f2c3b609b68513f1897e6a1467feab1_28003e65-26c7-4c2d-b07d-dce19e5b60f3
         16.1s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\b5f3c5e06cb7c5f56a48ecbe7b73d002_28003e65-26c7-4c2d-b07d-dce19e5b60f3
         23.5s C:\Users\11\AppData\Roaming\uTorrent\dlimagecache\165F6EF40A81DD175FFAEA69E77ABFD30B27E71C
         24.6s C:\Users\11\AppData\Roaming\uTorrent\dht_feed.dat.old
         24.6s C:\Users\11\AppData\Roaming\uTorrent\rss.dat.old
         24.6s C:\Users\11\AppData\Roaming\uTorrent\dht.dat.old
         24.7s C:\Users\11\AppData\Roaming\uTorrent\resume.dat.old
         25.9s C:\Users\11\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1762113390-2743852867-4213644173-1000\5dedb91a784c2876f36643589e6b28f5_28003e65-26c7-4c2d-b07d-dce19e5b60f3
	   C:\Users\11\Desktop\FRST.exe
      Size . . . . . . . : 1 792 512 bytes
      Age  . . . . . . . : 4.1 days (2017-08-18 10:46:43)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : B79569168938B404599AB383EC2DABCE08DE93781F44F8CB70E29950A12189A7
      Needs elevation  . : Yes
    > HitmanPro  . . . . : Malware
      Fuzzy  . . . . . . : 124.0
      Forensic Cluster
         -7.0s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000ac
         -5.9s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000ad
         -3.2s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000ae
          0.0s C:\Users\11\Desktop\FRST.exe
          6.2s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000af
          9.6s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000b0
         13.9s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000b1
         13.9s C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Media Cache\f_0000b2
         24.1s C:\Users\11\AppData\Local\Temp\ProtectorPackage.log
         35.7s C:\Users\11\AppData\Local\Temp\ack2.txt
         36.2s C:\Users\11\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3SI11M84\events[1].php
         66.2s C:\FRST\
         66.2s C:\FRST\Hives\
         66.2s C:\FRST\Logs\
         66.2s C:\FRST\Quarantine\
         66.3s C:\FRST\Hives\ERDNT.INF
         66.3s C:\FRST\Hives\ERDNT.CON
         66.3s C:\FRST\Hives\BCD
         66.3s C:\FRST\Hives\SYSTEM
         66.5s C:\FRST\Hives\SOFTWARE
         68.1s C:\FRST\Hives\DEFAULT
         68.1s C:\FRST\Hives\SECURITY
         68.2s C:\FRST\Hives\SAM
         68.2s C:\FRST\Hives\Users\
         68.2s C:\FRST\Hives\Users\00000001\
         68.2s C:\FRST\Hives\Users\00000001\NTUSER.DAT
         68.3s C:\FRST\Hives\Users\00000002\
         68.3s C:\FRST\Hives\Users\00000002\UsrClass.dat
         68.3s C:\FRST\Hives\ERDNT.EXE
         68.3s C:\FRST\Hives\ERDNTWIN.LOC
         68.3s C:\FRST\Hives\ERDNTDOS.LOC
         68.8s C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\11@bleepingcomputer[1].txt
         68.8s C:\Users\11\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y4Z0SL6K\up32[1]
         68.9s C:\Users\11\Desktop\FRST.txt
         82.6s C:\Users\11\Desktop\Addition.txt
         90.7s C:\FRST\Logs\Addition_18-08-2017 10.48.14.txt
         90.7s C:\FRST\Logs\FRST_18-08-2017 10.48.14.txt
	
Potential Unwanted Programs _________________________________________________
	   HKLM\SOFTWARE\Microsoft\Tracing\ProtectorUpdater_RASAPI32\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\ProtectorUpdater_RASMANCS\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\Reimage_RASAPI32\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\Reimage_RASMANCS\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\ReimagePackage_RASAPI32\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\ReimagePackage_RASMANCS\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\ReimageRepair_RASAPI32\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\ReimageRepair_RASMANCS\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\UniProtectorPackage_RASAPI32\ (ReimageRepair)
   HKLM\SOFTWARE\Microsoft\Tracing\UniProtectorPackage_RASMANCS\ (ReimageRepair)
   HKLM\SOFTWARE\Reimage\ (ReimageRepair)
	Cookies _____________________________________________________________________
	   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:254a.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:2o7.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:abmr.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:acuityplatform.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.moreto.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adaptv.advertising.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adbrn.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:addthis.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adfarm1.adition.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adform.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adformdsp.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adgrx.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adhigh.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adingo.jp
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:admized.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adnxs.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.avocet.io
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.betweendigital.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.creative-serving.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.kaldata.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.kiosked.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.linkedin.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.servebom.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.stickyadstv.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.trafficjunky.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.vwclub.bg
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.yieldmo.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adscale.de
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserver.bta.bg
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserving.ancoraplatform.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adsrvr.org
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adsymptotic.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtechjp.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtechus.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertere.***
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:agkn.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:amgdgt.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:angsrvr.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:atemda.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:basebanner.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:bidr.io
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:bidswitch.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:bluekai.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:c.appier.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:connexity.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:contextweb.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:crwdcntrl.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ctnsnet.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:cw.addthis.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:demdex.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:dh.serving-sys.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:diff3.smartadserver.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:dotomi.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:dpm.demdex.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:erne.co
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ero-advertising.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:everesttech.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:exoclick.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:eyereturn.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:eyeviewads.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:fastclick.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:go.sonobi.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:googleadservices.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:gssprt.jp
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:gwallet.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ibillboard.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ih.adscale.de
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:imrworldwide.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:in.getclicky.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ipredictive.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:krxd.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:legolas-media.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:lijit.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:match.adsby.bidtheatre.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:match.rundsp.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:mathtag.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:metrigo.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ml314.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:mmstat.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:mookie1.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:mxptint.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:nexac.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:openx.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:optimatic.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:outbrain.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:owneriq.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:pixel.rubiconproject.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:pixxxels.org
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:pool.admedo.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:porn-xnick.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:pornleech.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:pornolab.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:postrelease.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:pubmatic.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:rfihub.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:rlcdn.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:rubiconproject.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:sandbox.bidswitch.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:schoolgirlfuck.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:scorecardresearch.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:server.adformdsp.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:simpli.fi
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:sitescout.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:skimresources.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:sonypanasia.112.2o7.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:switchadhub.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:sxp.smartclip.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:sync.go.sonobi.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:syndication.exoclick.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:taboola.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tap-secure.rubiconproject.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tap-t.rubiconproject.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tap.rubiconproject.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tap2-cdn.rubiconproject.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tapad.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tidaltv.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tremorhub.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:turn.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:u3s.mathtag.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:virool.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:w55c.net
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:ww1097.smartadserver.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.googleadservices.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:www3.smartadserver.com
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:yadro.ru
   C:\Users\11\AppData\Local\Google\Chrome\User Data\Default\Cookies:yieldlab.net
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@adnxs[1].txt
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@advertising[1].txt
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@atwola[1].txt
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@doubleclick[2].txt
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\11@scorecardresearch[2].txt
   C:\Users\11\AppData\Roaming\Microsoft\Windows\Cookies\Low\[email protected][1].txt


 

Изтеглете: 8864097u.png ADWCleaner.

  • Затворете всички браузъри и стартирайте AdwCleaner.exe.
  • Натиснете бутона SCAN.
  • След като приключи проверката натиснете бутона CLEAN.
  • Програмата ще затвори излишния софтуер и ще започне почистването.
  • След като приключи почистването ADWCleaner ще поиска рестарт. Съгласете се.
  • След зареждането на системата отидете до: C:\AdwCleaner и потърсете лог файл с името AdwCleaner[C0].txt.
  • Публикувайте съдържанието на "AdwCleaner[C0]" в следващия Ви коментар.
  • 2 седмици по-късно...
  • 2 седмици по-късно...
  • Автор

# AdwCleaner 7.0.2.1 - Logfile created on Mon Sep 11 11:29:58 2017
# Updated on 2017/29/08 by Malwarebytes 
# Running on Windows 7 Ultimate (X86)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

Deleted: C:\Program Files\DriverToolkit
Deleted: C:\Users\11\AppData\Local\DriverToolkit


***** [ Files ] *****

Deleted: C:\Users\11\Desktop\Goodgame Empire.lnk
Deleted: C:\END


***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted: DRIVERTOOLKIT AUTORUN


***** [ Registry ] *****

Deleted: [Key] - HKU\S-1-5-21-1762113390-2743852867-4213644173-1000\Software\DriverToolkit
Deleted: [Key] - HKCU\Software\DriverToolkit
Deleted: [Key] - HKLM\SOFTWARE\Reimage


***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [1300 B] - [2017/9/11 11:29:27]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

Изтеглете: P6YS34D.png Delfix.

  • Стартирайте Delfix.exе.
  • По подразбиране трябва да има 2 отметки на "Remove disinfection tools" и "Purge system restore ". Ако липсват, ги сложете.
  • Натиснете бутона "Run". 
  • Инструмента ще се самоизтрие след като приключи своята задача.
  • Изтрийте лог файла от Delfix.
  • Ако има останали програми, които сме използвали и не са се изтрили, ги изтрийте ръчно.

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.