Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Redirect-ва ме когато цъкна линк на PC-то; други проблеми

Димитър Кунчев
в Премахване на зловреден софтуер

Featured Replies

Драги компютърни експерти,

не знам как да опиша нещата с точната терминология, но имам сериозни проблеми в интернет пространството и Уеб браузването.

Искрено моля и ще съм благодарен за вашата помощ.

Проблемът е следният:

1. Когато цъкна да отворя някой линк или страница на лаптопа/pc-то ме редиректва към някакви рекламни сайтове. Отваря ми желаната страница на нов таб и старият/текущият го редиректва към разни рекламни/секс/спорт/"лъжливи" сайтове..

Това нещо искрено започна да ме дразни и се надявам вкрай на сметка да се намери решение.

2. Току-виж (с Chrome съм) когато си отворя началната страница ме праща на самотек на страница, която не съм задавал - http://swapgame.net/search/ ; И не мога да си върна Google от настройките на браузъра; и съответно отдолу табовете със страници, в които най-често съм влизал.

3. И сега, точно преди 5 минутки започнаха да ми излизат facebook ads (Recommended) както никога преди, под всеки пет поста??! За този случай не искам да използвам AddBlocker, защото имам проблем с фейсбук когато го ползвам.

 

Моля за помощ :)

FRST: 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-09-2017 01
Ran by User (administrator) on PC (26-09-2017 22:00:01)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 8.1 Enterprise N (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Badoo) C:\ProgramData\Badoo\Badoo Desktop\1.6.58.1220\Badoo.Desktop.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-10-08] (TOSHIBA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-07-14] (Apple Inc.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3486520 2017-08-04] (Dropbox, Inc.)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [570880 2013-12-27] (Nikon Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1156824 2016-09-16] (Adobe Systems Incorporated)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21644384 2014-07-02] (Skype Technologies S.A.)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\Run: [Badoo Desktop] => C:\ProgramData\Badoo\Badoo Desktop\1.6.58.1220\Badoo.Desktop.exe [1067280 2014-06-20] (Badoo)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-809340242-2789781825-833888065-1001\...\MountPoints2: {0c6622c1-163b-11e4-9bf4-008cfa934fae} - "F:\autorun.exe" 
GroupPolicy: Restriction - Chrome <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{44E42C01-693C-4663-91E3-8CA97292F6E0}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{972E6317-A933-4ECE-B2A3-BC5C53C5D33A}: [DhcpNameServer] 92.247.168.66 8.8.8.8

Internet Explorer:
==================
HKU\S-1-5-21-809340242-2789781825-833888065-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-809340242-2789781825-833888065-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-809340242-2789781825-833888065-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-809340242-2789781825-833888065-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\5o7xdam5.default [2017-09-18]
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> autoconfig_url", "hxxp://91.121.225.213/"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> backup.ftp", "proxy.uni-sofia.bg"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> backup.ftp_port", 8080
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> backup.socks", "91.121.225.213"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> backup.socks_port", 2
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> backup.ssl", "proxy.uni-sofia.bg"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> backup.ssl_port", 8080
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> ftp", "83.239.108.238"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> ftp_port", 1080
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> http", "83.239.108.238"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> http_port", 1080
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> share_proxy_settings", true
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> socks", "83.239.108.238"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> socks_port", 1080
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> socks_version", 4
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> ssl", "83.239.108.238"
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> ssl_port", 1080
FF NetworkProxy: Mozilla\Firefox\Profiles\5o7xdam5.default -> type", 2
FF Extension: (iCloud Bookmarks) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\5o7xdam5.default\Extensions\[email protected] [2016-10-20]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll [2014-07-28] ()
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll [2014-07-28] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> search-results.com/?gct=hp
CHR DefaultSearchURL: Default -> hxxp://www.search-results.com/web?q={searchTerms}
CHR DefaultSearchKeyword: Default -> search-results.com
CHR DefaultSuggestURL: Default -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-09-26]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Сookies Control) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfkpefbllpconnkfpdgagkifmflckkdp [2017-07-09]
CHR Extension: (Google Търсене) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]
CHR Extension: (Kick Ass Alians) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjcacgdkacalnfdnoafiachfddbcpncp [2017-09-26]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-25]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-26]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2017-09-26]
CHR HKLM\...\Chrome\Extension: [aaaaboojhahjgdjeknnemneiajjhhddi] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-809340242-2789781825-833888065-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aaaaboojhahjgdjeknnemneiajjhhddi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iinglghmhcgdgjjlafobajghjamdchik] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [1128432 2017-09-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [490968 2017-09-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [490968 2017-09-20] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1525240 2017-09-20] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-10-01] (Windows (R) Win 7 DDK provider) [File not signed]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [402768 2017-08-30] (Avira Operations GmbH & Co. KG)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2015-12-15] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2015-12-15] (Dropbox, Inc.)
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [49992 2017-08-04] (Dropbox, Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-23] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [691480 2013-11-20] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-24] (Qualcomm Atheros Communications, Inc.)
R0 avdevprot; C:\Windows\System32\DRIVERS\avdevprot.sys [60920 2017-06-18] (Avira Operations GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [176224 2017-09-20] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [167464 2017-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [44488 2017-03-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [88488 2017-03-02] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2014-07-28] (DT Soft Ltd)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-30] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [33168 2013-11-01] (Windows (R) Win 7 DDK provider)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 WirelessKeyboardFilter; C:\Windows\System32\drivers\WirelessKeyboardFilter.sys [49896 2016-07-22] (Microsoft Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-26 22:00 - 2017-09-26 22:02 - 000018387 _____ C:\Users\User\Desktop\FRST.txt
2017-09-26 21:59 - 2017-09-26 22:00 - 000000000 ____D C:\FRST
2017-09-26 21:59 - 2017-09-26 21:59 - 002399744 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2017-09-26 21:39 - 2017-09-26 21:41 - 000038454 _____ C:\Windows\system32\KMSServer.exe
2017-09-26 21:24 - 2017-09-26 21:24 - 000171907 _____ C:\Users\User\Desktop\adblockpopups-snapshot.xpi
2017-09-25 15:33 - 2017-09-25 15:33 - 006754944 _____ (ESET spol. s r.o.) C:\Users\User\Desktop\esetonlinescanner_enu (1).exe
2017-09-25 15:33 - 2017-09-25 15:33 - 000000000 ____D C:\Users\User\AppData\Local\ESET
2017-09-25 15:32 - 2017-09-25 15:32 - 006754944 _____ (ESET spol. s r.o.) C:\Users\User\Desktop\esetonlinescanner_enu.exe
2017-09-20 17:20 - 2017-09-20 17:20 - 000003316 _____ C:\Windows\System32\Tasks\Avira_Antivirus_Systray
2017-09-20 17:20 - 2017-09-20 17:20 - 000003122 _____ C:\Windows\System32\Tasks\Avira SystrayStartTrigger
2017-09-02 23:04 - 2017-09-03 00:23 - 000000000 ____D C:\Users\User\Desktop\New folder (3)
2017-08-28 21:51 - 2017-08-28 21:55 - 000000000 ____D C:\Users\User\Desktop\iOS new photos

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-26 22:03 - 2014-07-28 14:03 - 000003898 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D4E0590-D213-42B8-9177-8573053EC7D3}
2017-09-26 21:49 - 2014-07-28 12:54 - 000003594 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-809340242-2789781825-833888065-1001
2017-09-26 21:47 - 2015-12-15 01:05 - 000000000 ____D C:\Program Files (x86)\Dropbox
2017-09-26 21:45 - 2015-11-01 23:41 - 000000000 ___RD C:\Users\User\iCloudDrive
2017-09-26 21:44 - 2015-12-15 01:05 - 000000906 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2017-09-26 21:39 - 2013-08-22 17:45 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-26 21:38 - 2013-08-22 16:25 - 000262144 ___SH C:\Windows\system32\config\BBI
2017-09-26 21:30 - 2015-12-15 01:05 - 000000910 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2017-09-26 17:42 - 2014-07-28 14:52 - 000000000 ____D C:\Users\User\AppData\Roaming\Skype
2017-09-26 11:05 - 2014-07-28 14:41 - 000002215 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-25 18:43 - 2014-08-08 12:43 - 045682688 ___SH C:\Users\User\Desktop\Thumbs.db
2017-09-23 12:43 - 2013-08-22 18:36 - 000000000 ___HD C:\Program Files\WindowsApps
2017-09-23 12:43 - 2013-08-22 18:36 - 000000000 ____D C:\Windows\AppReadiness
2017-09-22 12:35 - 2014-08-20 02:09 - 000000000 ____D C:\Users\User\Desktop\Музика
2017-09-22 12:21 - 2014-07-29 19:54 - 004825088 ___SH C:\Users\User\Downloads\Thumbs.db
2017-09-21 22:21 - 2013-08-22 18:36 - 000000000 ____D C:\Windows\system32\NDF
2017-09-21 19:46 - 2013-08-22 16:36 - 000000000 ____D C:\Windows\Inf
2017-09-20 22:24 - 2014-08-13 08:39 - 000000000 ____D C:\ProgramData\Package Cache
2017-09-20 17:20 - 2014-07-28 14:47 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-09-20 17:17 - 2014-07-28 14:46 - 000176224 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2017-09-18 02:33 - 2016-12-07 12:36 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla
2017-09-10 12:33 - 2013-08-22 18:36 - 000000000 ____D C:\Windows\LiveKernelReports
2017-09-06 14:26 - 2014-10-03 14:22 - 000023552 ___SH C:\Users\User\Documents\Thumbs.db
2017-09-02 22:55 - 2014-07-28 12:47 - 000818732 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-02 12:20 - 2014-07-28 14:46 - 000167464 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

==================== Files in the root of some directories =======

2016-04-18 10:21 - 2016-04-18 10:21 - 000000268 ___RH () C:\Users\User\AppData\Roaming\Rule Actions
2016-04-18 10:22 - 2016-04-18 10:22 - 000000268 ___RH () C:\Users\User\AppData\Roaming\Sample Delay
2016-04-18 10:21 - 2016-04-18 10:21 - 000000268 ___RH () C:\Users\User\AppData\Roaming\Sampler
2016-04-18 10:20 - 2016-04-18 10:20 - 000000268 ___RH () C:\Users\User\AppData\Roaming\Sound Effects
2014-08-15 18:49 - 2015-07-31 01:10 - 000003584 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-07-11 11:17 - 2016-07-11 11:17 - 000000000 _____ () C:\Users\User\AppData\Local\{30CA4045-0752-4851-9FFE-164C86A692C7}
2016-07-25 10:19 - 2016-07-25 10:19 - 000000000 _____ () C:\Users\User\AppData\Local\{87C3BD25-DD5B-472C-9739-C0873ABC23AA}
2016-07-25 10:19 - 2016-07-25 10:19 - 000000000 _____ () C:\Users\User\AppData\Local\{8CB53016-578B-484F-8BCC-FBC3151BDC36}
2016-07-11 11:17 - 2016-07-11 11:17 - 000000000 _____ () C:\Users\User\AppData\Local\{B4D44BD0-5255-4CA7-9D28-C5348D851E9F}
2016-07-16 21:16 - 2016-07-16 21:16 - 000000000 _____ () C:\Users\User\AppData\Local\{D512D0D2-7A65-4318-B7D9-40A06C46AE3C}
2016-04-18 10:20 - 2016-04-18 10:20 - 000000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2016-04-18 10:22 - 2016-04-18 10:22 - 000000020 ____H () C:\ProgramData\PKP_DLes.DAT
2016-04-18 10:21 - 2016-05-05 19:30 - 000000020 ____H () C:\ProgramData\PKP_DLet.DAT
2016-04-18 10:21 - 2016-05-05 19:33 - 000000020 ____H () C:\ProgramData\PKP_DLev.DAT
2016-04-18 10:21 - 2016-04-18 10:21 - 000000268 ___RH () C:\ProgramData\Sampler Instruments
2016-04-18 10:22 - 2016-04-18 10:22 - 000000268 ___RH () C:\ProgramData\Sci-Fi
2016-04-18 10:21 - 2016-04-18 10:21 - 000000268 ___RH () C:\ProgramData\Screen Saver
2016-04-18 10:20 - 2016-04-18 10:21 - 000000012 ___RH () C:\ProgramData\Spacious
2016-04-18 10:22 - 2016-04-18 10:22 - 000000012 ___RH () C:\ProgramData\Speech Enhancer
2016-04-18 10:21 - 2016-04-18 10:21 - 000000012 ___RH () C:\ProgramData\Standard
2016-04-18 10:20 - 2016-04-18 10:20 - 000000012 ___RH () C:\ProgramData\Textures

Some files in TEMP:
====================
2014-07-28 14:48 - 2014-08-13 08:40 - 000000000 ____D () C:\Users\User\AppData\Local\Temp\avgnt.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-20 23:29

==================== End of FRST.txt ============================

Addition.txt

Здравейте,

Направете следното:

 

СТЪПКА 1

 

  • Изтеглете и стартирайте 6sv1DN9.jpgAdwCleaner.exe
  • Натиснете бутона Scan.
  • AdwCleaner ще започне да проверява компютъра.
  • След като проверката приключи натиснете бутона Clean.
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.
  • Ще се появи автоматично лог файл с името (AdwCleaner[S0].txt и AdwCleaner[С0].txt) в C:\Adwcleaner
  • Публикувайте съдържанието на  AdwCleaner[С0].txt в следващия си коментар.

 

СТЪПКА 2

 

Моля изтеглете Malwarebytes Anti-Malware 3.2.2.2018 Final и я запазете на вашия десктоп.

  • Стартирайте файла mb3-setup-consumer-3.2.2.2018.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи програмата ще стартира автоматично.
  • Отидете до табът Settings => Protection > и под категорията Scan Options включете опцията "Scan for rootkits" като преместите плъзгача надясно.

xTvORSF.png

  • Отидете до табът Scan, и изберете Threat Scan и след това натиснете бутона Start Scan.

RUSrqgW.png

  • Ще започне проверка за зловреден софтуер.

4CJ90KI.png

  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи ще се появи списъка с резултатите (ако има намерени обекти). Ако програмата е минимизирана докато сканира ще се появи следното съобщение ако има открити заплахи. Натиснете бутона View Scan Results.

37b.png

  • . Натиснете бутона Quarantine Selected.

2CfXEk1.png

  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.

8Jc9dl9.png

  • След рестарта, стартирайте отново Malwarebytes Anti-Malware.
  • Отидете то табът Reports и отворете лог файла с името Scan Report.

X0ha4sd.png

  • Натиснете бутона Export и след това =>  "Copy to Clipboard"

fE9qzai.png

  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

СТЪПКА 3

 

Направете нова проверка с FRST (Farbar Recovery Scan Tool) и публикувайте новите логове - FRST.txt и Addition.txt.

 

Поздрави!

  • Автор

Благодаря ви.

Впрочем,  вчера след като публикувах поста, си изтеглих един читав Eset (Попринцип съм с Avira, фабрично) и след един хубав скан нещата се оправиха.

Няма вече редиректове, Гугъл с най-посещаваните табове отново е на първата/текущата страница и отново имам защити/катинарчето на страничките Facebook/Google/... 

Заформи се само един проблем, който е по-повърхностен и отново ще ви помоля за съдействие.

Фейсбука ми си върви с нормалната скорост. Само че известията (лайковете) не ми излизат и съобщенията/месинджъра не се рефрешват; смисъл някой ми е писал, но не ми показва. Или ми показва след рефреш. В прозорчето на чата си ми стои числото "20" (на линия), а те варират между 450-500 онлайн при сумати приятели.

Пробвах с рестарт - същият ефект. Не е от браузърът, нито от сайта. Пак повтарям, скороста си е същата. Но не ми рефрешва чата, съобщенията и известията. :)

 

Здравейте,

Радвам се, че се е оправил проблема.

Други проблеми не решаваме тук. Отворете си тема в подходящия за целта раздел => https://www.kaldata.com/forums/forum/275-facebook-проблеми-въпроси-вируси/

Тази тема се маркира като приключена!

Поздрави и лека вечер!

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.