Заразена система

30 август 20179 г.

Здравейте! Преди няколко дена си занесох лаптопа в сервиз, защото беше много бавничък и ми казаха, че са изтрили 36 вируса. Взех го вчера и забелязвам, че все още е бавен! Благодаря предварително!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2017
Ran by User (administrator) on PC (30-08-2017 12:20:06)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Български (България)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Hewlett-Packard Company) C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe
(Dell Inc.) C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe
(AVAST Software s.r.o.) C:\Program Files\Alwil Software\Avast5\aswidsagent.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [488816 2011-01-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [570664 2008-05-28] (Nero AG)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvLaunch.exe [213824 2017-04-16] (AVAST Software)
HKLM\...\Run: [StatusAlerts] => C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe [330040 2014-02-12] (Hewlett-Packard Company)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2008-01-22] (Nero AG)
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5282584 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [27815896 2017-07-28] (Skype Technologies S.A.)
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\MountPoints2: {c54fd4f3-97a9-11e3-8443-0025644a7ccf} - F:\AutoRun.exe
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\MountPoints2: {c54fd500-97a9-11e3-8443-0025644a7ccf} - G:\AutoRun.exe
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => "C:\Program Files\Garmin\Express Tray\tray.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell System Manager.lnk [2012-11-23]
ShortcutTarget: Dell System Manager.lnk -> C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
GroupPolicy: Restriction ? <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{4F0D9387-60AA-46CC-A545-F4C0A516EA0C}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{DDAEF4EF-0718-4A0A-898E-481BCBE7DAE9}: [DhcpNameServer] 192.168.10.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-533062283-1319507512-3948496807-1000 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-533062283-1319507512-3948496807-1000 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2017-04-16] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2017-06-01] (Skype Technologies)
Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - C:\Program Files\Common Files\A&W\MidRadio.ocx [2003-02-11] (YAMAHA CORPORATION)

FireFox:
========
FF DefaultProfile: 04k4c1sj.default-1495476444165
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\04k4c1sj.default-1495476444165 [2017-08-30]
FF Homepage: Mozilla\Firefox\Profiles\04k4c1sj.default-1495476444165 -> google.bg
FF Extension: (Firefox Screenshots) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\04k4c1sj.default-1495476444165\features\{9d2e852d-caeb-40cd-972f-0baa543745c6}\[email protected] [2017-08-26]
FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2017-06-21] [not signed]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF48
FF Extension: (Avast Online Security) - C:\Program Files\Alwil Software\Avast5\WebRep\FF48 [2017-04-16]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\SafePrice\FF48
FF Extension: (Avast SafePrice) - C:\Program Files\Alwil Software\Avast5\SafePrice\FF48 [2017-04-16]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_151.dll [2017-08-08] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.8.527\npMozillaSpoonPlugin.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://google.bg/
CHR StartupUrls: Default -> "hxxp://google.bg/"
CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
CHR DefaultSearchKeyword: Default -> bing1.com
CHR DefaultSuggestURL: Default -> hxxp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}&FORM=AVASDF&PC=AV01
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-08-30]
CHR Extension: (Google Документи) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-28]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-27]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-04]
CHR Extension: (Google Търсене) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-27]
CHR Extension: (Avast SafePrice) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-08-29]
CHR Extension: (Google Документи офлайн) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-24]
CHR Extension: (AdBlock) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-08-29]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-28]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-28]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-28]
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 alssvc; C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe [382232 2008-06-03] (Dell Inc.)
R3 aswbIDSAgent; C:\Program Files\Alwil Software\Avast5\aswidsagent.exe [5758120 2017-04-16] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [261712 2017-04-16] (AVAST Software)
R2 dcpsysmgrsvc; C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe [390000 2011-07-28] (Dell Inc.)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [176128 2014-06-24] (HP) [File not signed]
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 Unchecky; C:\Program Files\Unchecky\bin\unchecky_svc.exe [302872 2017-08-12] (RaMMicHaeL)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [255184 2017-04-16] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148208 2017-04-16] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [267528 2017-04-16] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41176 2017-04-16] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-04-16] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [31064 2017-04-16] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107928 2017-04-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [90336 2017-04-16] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-04-16] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764064 2017-04-16] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [472760 2017-04-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [118800 2017-04-16] (AVAST Software)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-04-16] (AVAST Software)
R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82168 2013-11-21] (EZB Systems, Inc.)
S3 ssudobex; C:\Windows\System32\DRIVERS\ssudobex.sys [179520 2010-09-17] (DEVGURU Co., LTD.(www.devguru.co.kr))

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-30 12:13 - 2017-08-30 12:20 - 000014792 _____ C:\Users\User\Desktop\FRST.txt
2017-08-30 12:13 - 2017-08-30 12:13 - 000000000 ____D C:\FRST
2017-08-30 12:10 - 2017-08-30 12:10 - 001792512 _____ (Farbar) C:\Users\User\Desktop\FRST.exe
2017-08-30 09:33 - 2017-08-30 09:33 - 000000000 ____D C:\ProgramData\SWCUTemp
2017-08-29 17:30 - 2009-07-30 20:08 - 008418199 _____ C:\Users\User\Desktop\Teст Температури.exe
2017-08-29 16:18 - 2012-03-08 11:55 - 007170657 _____ C:\Users\User\Desktop\Тест хард диск.exe
2017-08-29 16:17 - 2017-08-29 16:17 - 000001164 _____ C:\Users\User\Desktop\Auslogics Disk Defrag.lnk
2017-08-29 16:17 - 2017-08-29 16:17 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
2017-08-29 16:17 - 2017-08-29 16:17 - 000000000 ____D C:\Program Files\Auslogics
2017-08-29 15:56 - 2017-08-29 15:57 - 000000000 ____D C:\Users\User\Desktop\от работен плот
2017-08-29 14:40 - 2017-08-29 14:40 - 000000000 ____D C:\ProgramData\Malwarebytes

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-08-30 12:14 - 2009-07-14 07:34 - 000021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-08-30 12:14 - 2009-07-14 07:34 - 000021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-08-30 11:51 - 2016-02-09 21:35 - 000000000 ____D C:\Users\User\Desktop\Хотел
2017-08-30 09:36 - 2010-11-21 00:01 - 000786558 _____ C:\Windows\system32\PerfStringBackup.INI
2017-08-30 09:36 - 2009-07-14 05:37 - 000000000 ____D C:\Windows\inf
2017-08-30 09:34 - 2012-11-23 08:41 - 000000000 ____D C:\Users\User\AppData\Roaming\Skype
2017-08-30 09:33 - 2013-06-01 18:15 - 000000428 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2017-08-30 09:31 - 2009-07-14 07:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-08-29 17:26 - 2015-03-21 14:49 - 000000432 __RSH C:\ProgramData\ntuser.pol
2017-08-29 15:31 - 2012-12-30 22:30 - 000000000 ____D C:\Program Files\Google
2017-08-29 15:30 - 2015-02-27 23:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2017-08-29 15:28 - 2013-02-21 17:07 - 000000000 ____D C:\Program Files\Scratch
2017-08-29 15:27 - 2016-08-08 11:08 - 000000000 ____D C:\Users\User\AppData\Roaming\iFunbox_UserCache
2017-08-29 15:19 - 2016-09-09 18:05 - 000000000 ____D C:\Users\User\AppData\Roaming\JAM Software
2017-08-29 15:06 - 2011-04-12 04:37 - 000000000 __SHD C:\Windows\BitLockerDiscoveryVolumeContents
2017-08-29 14:35 - 2015-12-31 17:35 - 000000000 ____D C:\AdwCleaner
2017-08-29 14:21 - 2012-12-29 15:57 - 000000000 ____D C:\ProgramData\Kaspersky Lab
2017-08-29 14:21 - 2012-12-29 15:57 - 000000000 ____D C:\Program Files\Kaspersky Lab
2017-08-29 14:18 - 2012-12-29 17:38 - 000262144 _____ C:\Windows\system32\config\elam
2017-08-29 14:17 - 2015-12-04 01:12 - 000000000 ____D C:\Program Files\Common Files\AV
2017-08-29 09:45 - 2014-05-21 23:12 - 000002099 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-08-29 09:45 - 2014-05-21 23:12 - 000002087 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-08-27 08:15 - 2014-05-04 13:41 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-08-26 14:53 - 2017-06-21 12:29 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-08-17 11:06 - 2016-11-18 17:33 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2017-08-08 12:43 - 2012-11-23 16:40 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-08-08 12:43 - 2012-11-23 08:40 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-08-08 12:43 - 2012-11-23 08:40 - 000000000 ____D C:\Windows\system32\Macromed
2017-08-05 17:05 - 2016-03-09 10:09 - 000000984 _____ C:\Users\Public\Desktop\VLC media player.lnk
2017-08-05 17:04 - 2012-11-23 08:38 - 000000000 ____D C:\Program Files\Common Files\Adobe AIR
2017-08-03 23:20 - 2012-11-23 08:41 - 000000000 ____D C:\ProgramData\Skype
2017-08-02 14:11 - 2013-01-13 18:31 - 000000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
2017-08-02 12:18 - 2016-08-15 19:31 - 000012304 _____ C:\Windows\system32\Native.exe

==================== Files in the root of some directories =======

2012-12-25 20:32 - 2012-12-25 20:32 - 000000000 ____H () C:\Users\User\AppData\Roaming\76f77676ff6f.txt
2012-12-25 19:51 - 2012-12-27 10:24 - 000000000 ____H () C:\Users\User\AppData\Roaming\789g979gg.txt
2012-12-25 10:12 - 2012-12-25 10:12 - 000000000 ____H () C:\Users\User\AppData\Roaming\futf6d786d.txt
2013-09-17 09:07 - 2014-03-31 09:51 - 000000175 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2013-03-04 14:58 - 2013-03-04 14:58 - 000003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-06 19:13 - 2013-02-06 19:13 - 000004096 ____H () C:\Users\User\AppData\Local\keyfile3.drm
2014-04-27 11:17 - 2014-04-27 11:17 - 000000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg
2012-11-25 19:22 - 2012-11-25 19:22 - 004446016 ____N () C:\Users\User\AppData\Local\Tempmusic.ogg

Some files in TEMP:
====================
2017-08-29 22:56 - 2017-08-29 22:56 - 000000000 _____ () C:\Users\User\AppData\Local\Temp\iieim70b.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-08-21 09:54

==================== End of FRST.txt ============================

Addition.txt

2 септември 20179 г.

Здравейте,

Съжалявам за бавното отговаряне, но екипа беше в отпуск. Ако имате нужда още от помощ направете нова проверка с FRST и качете новите резултати.

Поздрави!

2 септември 20179 г.

Автор

Добре, но ще ги кача утре. Благодаря!

3 септември 20179 г.

Автор

Заповядайте!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2017
Ran by User (administrator) on PC (03-09-2017 10:53:33)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: Български (България)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe
(Dell Inc.) C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe
(AVAST Software s.r.o.) C:\Program Files\Alwil Software\Avast5\aswidsagent.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
(Nero AG) C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [488816 2011-01-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [570664 2008-05-28] (Nero AG)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvLaunch.exe [213824 2017-04-16] (AVAST Software)
HKLM\...\Run: [StatusAlerts] => C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe [330040 2014-02-12] (Hewlett-Packard Company)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [152872 2008-01-22] (Nero AG)
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [5282584 2014-11-21] (Piriform Ltd)
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [27815896 2017-07-28] (Skype Technologies S.A.)
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\MountPoints2: {c54fd4f3-97a9-11e3-8443-0025644a7ccf} - F:\AutoRun.exe
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\...\MountPoints2: {c54fd500-97a9-11e3-8443-0025644a7ccf} - G:\AutoRun.exe
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => "C:\Program Files\Garmin\Express Tray\tray.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell System Manager.lnk [2012-11-23]
ShortcutTarget: Dell System Manager.lnk -> C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
GroupPolicy: Restriction ? <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0
Tcpip\..\Interfaces\{4F0D9387-60AA-46CC-A545-F4C0A516EA0C}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{DDAEF4EF-0718-4A0A-898E-481BCBE7DAE9}: [DhcpNameServer] 192.168.1.1 0.0.0.0

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKU\S-1-5-21-533062283-1319507512-3948496807-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-533062283-1319507512-3948496807-1000 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-533062283-1319507512-3948496807-1000 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2017-04-16] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2017-06-01] (Skype Technologies)
Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - C:\Program Files\Common Files\A&W\MidRadio.ocx [2003-02-11] (YAMAHA CORPORATION)

FireFox:
========
FF DefaultProfile: 04k4c1sj.default-1495476444165
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\04k4c1sj.default-1495476444165 [2017-09-03]
FF Homepage: Mozilla\Firefox\Profiles\04k4c1sj.default-1495476444165 -> google.bg
FF Extension: (Firefox Screenshots) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\04k4c1sj.default-1495476444165\features\{81f34f7c-bee9-4d33-8e12-b7eaf5768660}\[email protected] [2017-09-02]
FF Extension: (No Name) - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2017-06-21] [not signed]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\WebRep\FF48
FF Extension: (Avast Online Security) - C:\Program Files\Alwil Software\Avast5\WebRep\FF48 [2017-04-16]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Alwil Software\Avast5\SafePrice\FF48
FF Extension: (Avast SafePrice) - C:\Program Files\Alwil Software\Avast5\SafePrice\FF48 [2017-04-16]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_151.dll [2017-08-08] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.8.527\npMozillaSpoonPlugin.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.)