Защита против хакери

25 януари 20188 г.

Линк с резултата от сканирането на screenshoter.exe.

https://www.virustotal.com/#/file/d0ad22172bb6aa530b7ea39e17a86d9384b48c9b8307c18ab8f6d14edcb0f164/detection

В момента почиствам остатъка от AVG, след това започвам да сканирам и поетапно ще пращам резултатите.

25 януари 20188 г.

В момента линка към Malwarebytes Anti-Malware 3.2.2.2018 Final не работи!

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

25 януари 20188 г.

преди 8 минути, еди написа:

В момента линка към Malwarebytes Anti-Malware 3.2.2.2018 Final не работи!

Коригиран линк..! Благодаря ..!

25 януари 20188 г.

Malwarebytes
www.malwarebytes.com

-Детайли за регистъра-
Дата на сканиране: 25.01.18 г.
Час на сканиране: 20:43
Файл на регистъра: a92a6b3a-01ff-11e8-ab56-00ff2e5cbce5.json
Администратор: Да

-Информация за софтуера-
Версия: 3.3.1.2183
Версия на компонентите: 1.0.262
Актуализирай версията на пакета: 1.0.3786
Лиценз: Пробен период

-Системна информация-
OS: Windows 7 Service Pack 1
CPU: x64
Файлова система: NTFS
Потребител: User-PC\User

-Резюме на сканирането-
Тип сканиране: Threat Scan
Резултат: Завършено
Сканирани обекти: 261337
Открити заплахи: 7
Заплахи под карантина: 7
Изтекло време: 22 мин, 57 сек

-Опции за сканиране-
Памет: Разрешено
Стартиране: Разрешено
Файлова система: Разрешено
Архиви: Разрешено
руткитове: Разрешено
Евристика: Разрешено
PUP: Открий
PUM: Открий

-Детайли за сканирането-
Процес: 0
(Не бяха открити зловредни елементи)

Модул: 0
(Не бяха открити зловредни елементи)

Ключ на регистъра: 1
PUP.Optional.Babylon, HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}, Под карантина, [1663], [235650],1.0.3786

Стойност на регистъра: 1
PUP.Optional.Babylon, HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}|URL, Под карантина, [1663], [235650],1.0.3786

Данни на регистъра: 0
(Не бяха открити зловредни елементи)

Поток данни: 0
(Не бяха открити зловредни елементи)

Папка: 0
(Не бяха открити зловредни елементи)

Файл: 5
PUP.Optional.SysTweak, C:\WINDOWS\SYSTEM32\ROBOOT64.EXE, Под карантина, [210], [395666],1.0.3786
PUP.Optional.WinBing, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\DEFAULTS\PREF\DSENGINE.JS, Под карантина, [1520], [474786],1.0.3786
PUP.Optional.WinBing, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\DSENGINE.CFG, Под карантина, [1520], [474787],1.0.3786
PUP.Optional.BabylonToolBar, C:\USERS\USER\APPDATA\ROAMING\SKYPE\MY SKYPE RECEIVED FILES\UNLOCKER1.9.1-X64.EXE, Под карантина, [6015], [76262],1.0.3786
PUP.Optional.ASK, C:\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, Сменен, [462], [454825],1.0.3786

Физически сектор: 0
(Не бяха открити зловредни елементи)

(end)

# AdwCleaner 7.0.7.0 - Logfile created on Thu Jan 25 19:23:20 2018
# Updated on 2018/18/01 by Malwarebytes
# Database: 01-24-2018.2
# Running on Windows 7 Ultimate (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

PUP.Optional.Legacy, WCAssistantService

***** [ Folders ] *****

PUP.Optional.AdvancedSystemCare, C:\Users\User\AppData\LocalLow\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Users\User\AppData\LocalLow\IObit\Advanced SystemCare
PUP.Optional.Legacy, C:\ProgramData\lavasoft\web companion
PUP.Optional.Legacy, C:\ProgramData\Application Data\lavasoft\web companion
PUP.Optional.Legacy, C:\Program Files (x86)\lavasoft\web companion
PUP.Optional.Legacy, C:\Users\All Users\lavasoft\web companion
PUP.Optional.Legacy, C:\Users\User\AppData\Roaming\lavasoft\web companion
PUP.Optional.SpyHunter, C:\Program Files (x86)\SpyHunter Malware Security Suite
PUP.Optional.Mail.Ru, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mail.Ru
PUP.Optional.Mail.Ru, C:\Users\User\AppData\Local\Mail.Ru
PUP.Optional.WebCompanion, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion

***** [ Files ] *****

PUP.Optional.Legacy, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\f5pck2jz.default\searchplugins\yahoo-lavasoft.xml
PUP.Optional.SpyHunter, C:\spyhunter.fix
PUP.Optional.SpyHunter, C:\Users\All Users\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\Users\Public\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\Windows\System32\sh4native.exe
PUP.Optional.SpyHunter, C:\Windows\SysWOW64\sh4native.exe
PUP.Optional.SpyHunter, C:\Users\All Users\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\Users\Public\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\spyhunter.fix
PUP.Optional.SpyHunter, C:\Windows\System32\sh4native.exe
PUP.Optional.SpyHunter, C:\Windows\SysWOW64\sh4native.exe

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

PUP.Optional.SpyHunter, SpyHunter4Startup
PUP.Optional.SpyHunter, SpyHunter4Startup

***** [ Registry ] *****

PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\APN PIP
PUP.Optional.Legacy, [Key] - HKCU\Software\APN PIP
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\PIP
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Lavasoft\Web Companion
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Lavasoft\Web Companion
PUP.Optional.Legacy, [Key] - HKCU\Software\Lavasoft\Web Companion
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
PUP.Optional.Legacy, [Value] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Microsoft\Windows\CurrentVersion\Run | Web Companion
PUP.Optional.Legacy, [Value] - HKCU\Software\Microsoft\Windows\CurrentVersion\Run | Web Companion
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
PUP.Optional.SpyHunter, [Key] - HKLM\SOFTWARE\EnigmaSoftwareGroup
PUP.Optional.SpyHunter, [Key] - HKLM\SOFTWARE\EnigmaSoftwareGroup
PUP.Optional.SpyHunter, [Key] - HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\SpyHunter4.exe
PUP.Optional.Mail.Ru, [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKCU\Software\Mail.Ru

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

# AdwCleaner 7.0.7.0 - Logfile created on Thu Jan 25 19:23:20 2018
# Updated on 2018/18/01 by Malwarebytes
# Database: 01-24-2018.2
# Running on Windows 7 Ultimate (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

PUP.Optional.Legacy, WCAssistantService

***** [ Folders ] *****

PUP.Optional.AdvancedSystemCare, C:\Users\User\AppData\LocalLow\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Users\User\AppData\LocalLow\IObit\Advanced SystemCare
PUP.Optional.Legacy, C:\ProgramData\lavasoft\web companion
PUP.Optional.Legacy, C:\ProgramData\Application Data\lavasoft\web companion
PUP.Optional.Legacy, C:\Program Files (x86)\lavasoft\web companion
PUP.Optional.Legacy, C:\Users\All Users\lavasoft\web companion
PUP.Optional.Legacy, C:\Users\User\AppData\Roaming\lavasoft\web companion
PUP.Optional.SpyHunter, C:\Program Files (x86)\SpyHunter Malware Security Suite
PUP.Optional.Mail.Ru, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mail.Ru
PUP.Optional.Mail.Ru, C:\Users\User\AppData\Local\Mail.Ru
PUP.Optional.WebCompanion, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion

***** [ Files ] *****

PUP.Optional.Legacy, C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\f5pck2jz.default\searchplugins\yahoo-lavasoft.xml
PUP.Optional.SpyHunter, C:\spyhunter.fix
PUP.Optional.SpyHunter, C:\Users\All Users\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\Users\Public\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\Windows\System32\sh4native.exe
PUP.Optional.SpyHunter, C:\Windows\SysWOW64\sh4native.exe
PUP.Optional.SpyHunter, C:\Users\All Users\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\Users\Public\Desktop\SpyHunter.lnk
PUP.Optional.SpyHunter, C:\spyhunter.fix
PUP.Optional.SpyHunter, C:\Windows\System32\sh4native.exe
PUP.Optional.SpyHunter, C:\Windows\SysWOW64\sh4native.exe

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

PUP.Optional.SpyHunter, SpyHunter4Startup
PUP.Optional.SpyHunter, SpyHunter4Startup

***** [ Registry ] *****

PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\APN PIP
PUP.Optional.Legacy, [Key] - HKCU\Software\APN PIP
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\PIP
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Lavasoft\Web Companion
PUP.Optional.Legacy, [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Lavasoft\Web Companion
PUP.Optional.Legacy, [Key] - HKCU\Software\Lavasoft\Web Companion
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}
PUP.Optional.Legacy, [Key] - HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
PUP.Optional.Legacy, [Value] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Microsoft\Windows\CurrentVersion\Run | Web Companion
PUP.Optional.Legacy, [Value] - HKCU\Software\Microsoft\Windows\CurrentVersion\Run | Web Companion
PUP.Optional.Legacy, [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
PUP.Optional.SpyHunter, [Key] - HKLM\SOFTWARE\EnigmaSoftwareGroup
PUP.Optional.SpyHunter, [Key] - HKLM\SOFTWARE\EnigmaSoftwareGroup
PUP.Optional.SpyHunter, [Key] - HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\SpyHunter4.exe
PUP.Optional.Mail.Ru, [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKCU\Software\Mail.Ru

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

# AdwCleaner 7.0.7.0 - Logfile created on Thu Jan 25 19:26:57 2018
# Updated on 2018/18/01 by Malwarebytes
# Running on Windows 7 Ultimate (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

Deleted: WCAssistantService

***** [ Folders ] *****

Deleted: C:\Users\User\AppData\LocalLow\IObit\Advanced SystemCare
Deleted: C:\Users\User\AppData\LocalLow\IObit\Advanced SystemCare
Deleted: C:\ProgramData\lavasoft\web companion
Deleted: C:\ProgramData\Application Data\lavasoft\web companion
Deleted: C:\Program Files (x86)\lavasoft\web companion
Deleted: C:\Users\All Users\lavasoft\web companion
Deleted: C:\Users\User\AppData\Roaming\lavasoft\web companion
Deleted: C:\Program Files (x86)\SpyHunter Malware Security Suite
Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mail.Ru
Deleted: C:\Users\User\AppData\Local\Mail.Ru
Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion

***** [ Files ] *****

Deleted: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\f5pck2jz.default\searchplugins\yahoo-lavasoft.xml
Deleted: C:\spyhunter.fix
Deleted: C:\Users\All Users\Desktop\SpyHunter.lnk
Deleted: C:\Users\Public\Desktop\SpyHunter.lnk
Deleted: C:\Windows\System32\sh4native.exe
Deleted: C:\Windows\SysWOW64\sh4native.exe
Deleted: C:\Users\All Users\Desktop\SpyHunter.lnk
Deleted: C:\Users\Public\Desktop\SpyHunter.lnk
Deleted: C:\spyhunter.fix
Deleted: C:\Windows\System32\sh4native.exe
Deleted: C:\Windows\SysWOW64\sh4native.exe

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

Deleted: SpyHunter4Startup
Deleted: SpyHunter4Startup

***** [ Registry ] *****

Deleted: [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\APN PIP
Deleted: [Key] - HKCU\Software\APN PIP
Deleted: [Key] - HKLM\SOFTWARE\PIP
Deleted: [Key] - HKLM\SOFTWARE\Lavasoft\Web Companion
Deleted: [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Lavasoft\Web Companion
Deleted: [Key] - HKCU\Software\Lavasoft\Web Companion
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}
Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}
Deleted: [Key] - HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}
Deleted: [Value] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted: [Value] - HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted: [Key] - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted: [Key] - HKLM\SOFTWARE\EnigmaSoftwareGroup
Deleted: [Key] - HKLM\SOFTWARE\EnigmaSoftwareGroup
Deleted: [Key] - HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications\SpyHunter4.exe
Deleted: [Key] - HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Mail.Ru
Deleted: [Key] - HKCU\Software\Mail.Ru

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries deleted.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0

*************************

C:/AdwCleaner/AdwCleaner[S0].txt - [4347 B] - [2018/1/25 19:23:20]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ##########

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 януари 20188 г.

Отлично..! До тук всичко е наред ...Премахнати са много гадории които не трябва да бъдат във системата ви..! Продължаваме напред..!

Моля за нова ,свежа проверка с:

Сканиране с Farbar Recovery Scan

Моля изтеглете Farbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете надесктопа.
Стартирайте файла FRST.exe (или FRST64.exe)
Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
Натиснете бутона .
Изчакайте търпеливо проверката да приключи.
Ще се създадат два лог файла с името - FRST.txt и Addition.txt надесктопа.
Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение).

Дневници

В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

FRST.txt (копирате цялото съдържание)
Addition.txt (прикачате..)

26 януари 20188 г.

на 24.01.2018 г. в 16:56, Gregory House написа:

Не съм казвал да си купете рутер а да се смени администраторската парола !

За женския мозък това е едно и също. Имам си тамън две такива вкъщи и редовно ме изумяват с женската си логика. Все едно си ѝ казал да направи това:

https://www.vbox7.com/play:262b91e71a

26 януари 20188 г.

преди 5 часа, rado84 написа:

За женския мозък това е едно и също. Имам си тамън две такива вкъщи и редовно ме изумяват с женската си логика. Все едно си ѝ казал да направи това:

https://www.vbox7.com/play:262b91e71a

Помолих да спрат да пишат хора с надменно отношение, това не помага и ако си мислите, че е много мъжко, ще ви кажа, че не е.

Думите: Ако рутерът е компрометиран, нищо не може да помогне, ме наведоха на мисълта, че трябва нов рутер.

Ицо, до 2 часа ще успея да направя новото сканиране, благодаря!

Редактирано 26 януари 20188 г. от Гост (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 януари 20188 г.

преди 1 минута, vesever написа:

Ицо, до 2 часа ще успея да направя новото сканиране, благодаря!

Добър вечер @vesever......!

Прекрасно..! Очаквам дневниците за да ги прегледам и ще приключим с първия етап ..! Ако сте забелязали темата ви е прехвърлена в друг раздел...В него по вашата тема пишем аз и ти..Всички други коментари са извън правилата и ще аз лично ще трия директно..! Така че вече няма да се пишат глупости..!

Приятна вечер за сега..!

26 януари 20188 г.

преди 2 минути, icotonev написа:

Добър вечер @vesever......!

Прекрасно..! Очаквам дневниците за да ги прегледам и ще приключим с първия етап ..! Ако сте забелязали темата ви е прехвърлена в друг раздел...В него по вашата тема пишем аз и ти..Всички други коментари са извън правилата и ще аз лично ще трия директно..! Така че вече няма да се пишат глупости..!

Приятна вечер за сега..!

Благодаря! Аз още не съм свикнала с интерфейса на сайта и не бях забелязала, че темата в в друг раздел. Ок, до после, ще се постарая да не се бавя!

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 януари 20188 г.

Пропуснах само един въпрос ...Не е спешен но все пак трябва да го знам.....Марка и модел на рутера ви и година на производство..!?!

26 януари 20188 г.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21.01.2018
Ran by User (administrator) on USER-PC (26-01-2018 20:11:14)
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Български (България)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Alexandr Irza) C:\Program Files (x86)\Volume2\Volume2.exe
() C:\ProgramData\VIVACOM 3G USB Modem\OnlineUpdate\ouc.exe
(Българска асоциация за компютърна лингвистика) C:\Program Files (x86)\BACL\SpeechLab\TTSProfileDlg.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\OIS.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\OIS.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\User\Downloads\FRST64 (1).exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-04] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [8887688 2018-01-03] (Emsisoft Ltd)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Bonus.SSR.FR12] => C:\Program Files (x86)\ABBYY FineReader 12\Bonus.ScreenshotReader.exe [1517088 2014-12-15] (ABBYY Production LLC.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-12] (Oracle Corporation)
HKLM-x32\...\Run: [Volume2] => C:\Program Files (x86)\Volume2\Volume2.exe [4781056 2015-08-10] (Alexandr Irza)
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27832264 2017-10-06] (Skype Technologies S.A.)
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\Policies\Explorer: [HideSCAVolume] 0
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\MountPoints2: {8fad6e42-f648-11e7-9646-d07e353f3229} - F:\AutoRun.exe
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\MountPoints2: {dc0a1d5b-b244-11e7-a6f5-68f7284731e0} - E:\AutoRun.exe
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\MountPoints2: {dc0a1d83-b244-11e7-a6f5-d07e353f3229} - E:\AutoRun.exe
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Configure Bulgarian Speech.lnk [2018-01-02]
ShortcutTarget: Configure Bulgarian Speech.lnk -> C:\Users\User\AppData\Roaming\Microsoft\Installer\{319A3CA9-DA63-4D65-8B25-403CF9CBF087}\_5af141bb.exe ()
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Screenshoter Mail.Ru.lnk [2017-10-30]
ShortcutTarget: Screenshoter Mail.Ru.lnk -> C:\Users\User\AppData\Local\Mail.Ru\Screenshoter\Screenshoter.exe (No File)
BootExecute: autocheck autochk * sh4native Sh4Removal

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{83C9235D-F4FF-41FD-B9FF-83B207297B88}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?bcutc=sp-006
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?bcutc=sp-006
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1789560146-2085309282-2704652363-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1789560146-2085309282-2704652363-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = hxxps://search.yahoo.com/yhs/search?hspart=lvs&hsimp=yhs-awc&type=lvs__webcompa__1_0__ya__ch_WCYID10440__180101__yaie&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1789560146-2085309282-2704652363-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_141\bin\ssv.dll [2017-07-19] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_141\bin\jp2ssv.dll [2017-07-19] (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\ssv.dll [2017-07-19] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\jp2ssv.dll [2017-07-19] (Oracle Corporation)

FireFox:
========
FF DefaultProfile: f5pck2jz.default
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\f5pck2jz.default [2018-01-25]
FF Homepage: Mozilla\Firefox\Profiles\f5pck2jz.default -> hxxps://www.google.com/?bcutc=sp-006
FF NewTab: Mozilla\Firefox\Profiles\f5pck2jz.default -> about:newtab
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\f5pck2jz.default\searchplugins\google-avast.xml [2018-01-06]
FF Plugin: @java.com/DTPlugin,version=11.141.2 -> C:\Program Files\Java\jre1.8.0_141\bin\dtplugin\npDeployJava1.dll [2017-07-19] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.141.2 -> C:\Program Files\Java\jre1.8.0_141\bin\plugin2\npjp2.dll [2017-07-19] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-12-01] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-12-01] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-12-01] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-12-01] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\dtplugin\npDeployJava1.dll [2017-07-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.141.2 -> C:\Program Files (x86)\Java\jre1.8.0_141\bin\plugin2\npjp2.dll [2017-07-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> mail.ru
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2018-01-26]
CHR Extension: (Презентации) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-12]
CHR Extension: (Домашняя страница - Mail.Ru) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aijcflokephhcjdmjednnmejlcacgfgb [2017-10-30]
CHR Extension: (Документи) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-12]
CHR Extension: (Google Диск) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-25]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-25]
CHR Extension: (Avast Passwords) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\emhginjpijfggbofeediiojmdlmlkoik [2018-01-15]
CHR Extension: (Таблици) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-12]
CHR Extension: (Google Документи офлайн) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-25]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-22]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-25]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-17]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Guest Profile [2017-02-26]
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\System Profile [2017-04-26]
CHR HKLM-x32\...\Chrome\Extension: [aijcflokephhcjdmjednnmejlcacgfgb] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9236912 2018-01-03] (Emsisoft Ltd)
R2 FoxitReaderService; C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe [1659456 2017-12-11] (Foxit Software Inc.)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-12] (Intel Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10945776 2017-12-15] (TeamViewer GmbH)
S2 VIVACOM 3G USB Modem. RunOuc; C:\Program Files (x86)\VIVACOM 3G USB Modem\UpdateDog\ouc.exe [655712 2017-10-16] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [53904 2017-11-20] (The OpenVPN Project)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [124552 2016-11-23] (Emsisoft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77432 2017-11-29] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [238080 2017-10-16] (Huawei Technologies Co., Ltd.)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193968 2018-01-25] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [110016 2018-01-26] (Malwarebytes)
R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [46008 2018-01-26] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2018-01-25] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [84256 2018-01-26] (Malwarebytes)
R3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw02.sys [3423496 2016-10-19] (Intel Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
U1 aswbdisk; no ImagePath
S3 esgiguard; \??\C:\Program Files (x86)\SpyHunter Malware Security Suite\esgiguard.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-26 20:09 - 2018-01-26 20:10 - 002393088 _____ (Farbar) C:\Users\User\Downloads\FRST64 (1).exe
2018-01-25 21:32 - 2018-01-26 18:19 - 000084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2018-01-25 21:18 - 2018-01-25 21:26 - 000000000 ____D C:\AdwCleaner
2018-01-25 21:17 - 2018-01-25 21:18 - 008206624 _____ (Malwarebytes) C:\Users\User\Downloads\adwcleaner_7.0.7.0.exe
2018-01-25 21:10 - 2018-01-26 09:11 - 000110016 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2018-01-25 20:41 - 2018-01-25 20:41 - 000193968 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2018-01-25 20:40 - 2018-01-26 09:11 - 000046008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2018-01-25 20:40 - 2018-01-25 20:40 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-01-25 20:39 - 2018-01-25 20:39 - 000001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-01-25 20:39 - 2018-01-25 20:39 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-01-25 20:39 - 2017-11-29 09:11 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys
2018-01-25 20:38 - 2018-01-25 20:38 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-01-25 20:38 - 2018-01-25 20:38 - 000000000 ____D C:\Program Files\Malwarebytes
2018-01-25 20:37 - 2018-01-25 20:38 - 082261576 _____ (Malwarebytes ) C:\Users\User\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.3774.exe
2018-01-25 19:53 - 2018-01-25 20:27 - 000000000 ____D C:\AVG_Remover
2018-01-25 19:52 - 2018-01-25 19:52 - 007986864 _____ ( ) C:\Users\User\Downloads\AVG_Remover.exe
2018-01-25 12:52 - 2018-01-25 12:52 - 000518860 _____ (glax24 (safezone.cc)) C:\Users\User\Downloads\SecurityCheck (1).exe
2018-01-25 12:51 - 2018-01-25 12:51 - 000000000 ____D C:\SecurityCheck
2018-01-25 12:50 - 2018-01-25 12:51 - 000518860 _____ (glax24 (safezone.cc)) C:\Users\User\Downloads\SecurityCheck.exe
2018-01-25 12:12 - 2018-01-25 12:12 - 000030295 _____ C:\Users\User\Desktop\Addition.txt
2018-01-25 12:12 - 2018-01-25 12:12 - 000030165 _____ C:\Users\User\Desktop\FRST.txt
2018-01-25 12:05 - 2018-01-25 12:06 - 000030292 _____ C:\Users\User\Downloads\Addition.txt
2018-01-25 12:01 - 2018-01-26 20:14 - 000016831 _____ C:\Users\User\Downloads\FRST.txt
2018-01-25 12:00 - 2018-01-26 20:11 - 000000000 ____D C:\FRST
2018-01-25 11:59 - 2018-01-25 12:00 - 002393088 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2018-01-25 01:25 - 2018-01-25 01:47 - 000000000 ____D C:\ProgramData\Emsisoft
2018-01-25 01:22 - 2018-01-26 20:11 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2018-01-25 01:22 - 2018-01-25 01:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2018-01-25 01:17 - 2018-01-25 01:19 - 002109248 _____ (Emsisoft Ltd) C:\Users\User\Downloads\EmsisoftAntiMalwareWebSetup (2).exe
2018-01-25 01:02 - 2018-01-25 01:02 - 002109248 _____ (Emsisoft Ltd) C:\Users\User\Downloads\EmsisoftAntiMalwareWebSetup (1).exe
2018-01-25 00:58 - 2018-01-25 00:58 - 002109248 _____ (Emsisoft Ltd) C:\Users\User\Downloads\EmsisoftAntiMalwareWebSetup.exe
2018-01-25 00:54 - 2018-01-25 00:54 - 000019201 ____H C:\Users\User\Desktop\~WRL3356.tmp
2018-01-24 21:47 - 2018-01-24 21:47 - 000215610 _____ C:\Users\User\Desktop\Карта за гласуване издадена от Общината На Уулвърхемптън (1).pdf
2018-01-24 21:46 - 2018-01-24 21:46 - 001543723 _____ C:\Users\User\Downloads\Договор с Pertemps (1).pdf
2018-01-24 21:46 - 2018-01-24 21:46 - 001543723 _____ C:\Users\User\Desktop\Договор с Pertemps (1).pdf
2018-01-24 21:46 - 2018-01-24 21:46 - 000284130 _____ C:\Users\User\Downloads\P45 за приключване на работа с Pertemps (1).pdf
2018-01-24 21:46 - 2018-01-24 21:46 - 000284130 _____ C:\Users\User\Desktop\P45 за приключване на работа с Pertemps (1).pdf
2018-01-24 21:46 - 2018-01-24 21:46 - 000215610 _____ C:\Users\User\Downloads\Карта за гласуване издадена от Общината На Уулвърхемптън (1).pdf
2018-01-24 21:42 - 2018-01-24 21:42 - 007226309 _____ C:\Users\User\Downloads\Scan_20180105_092500 (2).pdf
2018-01-24 21:42 - 2018-01-24 21:42 - 007226309 _____ C:\Users\User\Downloads\Scan_20180105_092500 (1).pdf
2018-01-24 21:42 - 2018-01-24 21:42 - 007226309 _____ C:\Users\User\Desktop\Scan_20180105_092500 (1).pdf
2018-01-24 19:15 - 2018-01-24 19:15 - 007226309 _____ C:\Users\User\Downloads\Scan_20180105_092500.pdf
2018-01-24 19:14 - 2018-01-24 19:14 - 001543723 _____ C:\Users\User\Downloads\Договор с Pertemps.pdf
2018-01-24 19:14 - 2018-01-24 19:14 - 000284130 _____ C:\Users\User\Downloads\P45 за приключване на работа с Pertemps.pdf
2018-01-24 19:14 - 2018-01-24 19:14 - 000215610 _____ C:\Users\User\Downloads\Карта за гласуване издадена от Общината На Уулвърхемптън.pdf
2018-01-24 18:03 - 2018-01-24 18:03 - 001204224 _____ C:\Users\User\Downloads\TinyWallInstaller.msi
2018-01-24 15:35 - 2018-01-24 15:35 - 001210493 _____ C:\Users\User\Downloads\SKMBT_C224e18012416550.pdf
2018-01-12 11:47 - 2018-01-12 12:53 - 000000000 ____D C:\Users\Public\Foxit Software
2018-01-12 11:47 - 2018-01-12 11:47 - 000000000 ____D C:\Users\User\AppData\Roaming\Foxit AgentInformation
2018-01-12 11:47 - 2018-01-12 11:47 - 000000000 ____D C:\ProgramData\Foxit Software
2018-01-12 11:47 - 2018-01-12 11:47 - 000000000 ____D C:\ProgramData\Foxit ContentPlatform
2018-01-12 11:46 - 2018-01-12 11:46 - 000001355 _____ C:\Users\Public\Desktop\Foxit Reader.lnk
2018-01-12 11:46 - 2018-01-12 11:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
2018-01-11 00:55 - 2017-10-16 11:17 - 001001472 _____ (DiBcom SA) C:\Windows\system32\Drivers\mod7700.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000450048 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbwwan.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000238080 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juwwanecm.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000225920 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000117248 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwusbdev.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000104448 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcacm.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000090112 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jubusenum.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000076800 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcecm.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000032768 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000030720 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juextctrl.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000022016 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwupgrade.sys
2018-01-11 00:55 - 2017-10-16 11:17 - 000013952 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_usbenumfilter.sys
2018-01-09 20:02 - 2018-01-10 00:20 - 000027885 ____H C:\Users\User\Desktop\~WRL2625.tmp
2018-01-09 10:41 - 2018-01-09 10:41 - 000024765 ____H C:\Users\User\Desktop\~WRL1933.tmp
2018-01-02 15:42 - 2016-01-02 19:33 - 000695448 _____ (Sysinternals - www.sysinternals.com) C:\Users\User\Desktop\Autoruns.exe
2018-01-02 03:38 - 2018-01-02 03:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyHunter Malware
2018-01-02 03:23 - 2018-01-02 03:23 - 000001066 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Летящата Мишка.lnk
2018-01-02 03:23 - 2018-01-02 03:23 - 000001060 _____ C:\Users\Public\Desktop\Летящата Мишка.lnk
2018-01-02 03:23 - 2018-01-02 03:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Летящата Мишка
2018-01-02 03:22 - 2018-01-25 01:48 - 000000000 ____D C:\Program Files (x86)\FlyingMouse
2018-01-02 03:20 - 2018-01-02 03:20 - 000000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BACL SpeechLab 2.0
2018-01-02 03:20 - 2018-01-02 03:20 - 000000000 ____D C:\Program Files (x86)\BACL
2018-01-01 22:40 - 2018-01-01 22:40 - 000001047 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 13.lnk
2018-01-01 22:40 - 2018-01-01 22:40 - 000001035 _____ C:\Users\Public\Desktop\TeamViewer 13.lnk
2018-01-01 22:40 - 2018-01-01 22:40 - 000000000 ____D C:\Users\User\AppData\Roaming\TeamViewer
2018-01-01 22:40 - 2017-09-18 12:53 - 000035112 _____ (TeamViewer GmbH) C:\Windows\system32\Drivers\teamviewervpn.sys
2018-01-01 22:39 - 2018-01-25 21:34 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2018-01-01 22:26 - 2018-01-25 21:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2018-01-01 22:26 - 2018-01-25 21:25 - 000000000 ____D C:\Users\User\AppData\Roaming\Lavasoft
2018-01-01 22:26 - 2018-01-25 21:25 - 000000000 ____D C:\Program Files (x86)\Lavasoft
2018-01-01 22:26 - 2018-01-01 22:26 - 000000000 ____D C:\Users\User\AppData\Local\Lavasoft
2018-01-01 22:25 - 2018-01-25 21:25 - 000000000 ____D C:\ProgramData\Lavasoft
2018-01-01 22:25 - 2018-01-02 03:58 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2018-01-01 22:25 - 2018-01-01 22:26 - 000000000 ____D C:\Users\User\AppData\LocalLow\uTorrent
2018-01-01 22:25 - 2018-01-01 22:25 - 000000812 _____ C:\Users\User\Desktop\µTorrent.lnk
2018-01-01 22:25 - 2018-01-01 22:25 - 000000792 _____ C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-01-26 20:13 - 2017-01-24 12:29 - 000000000 ____D C:\Users\User\AppData\Roaming\Skype
2018-01-26 20:08 - 2017-12-14 18:10 - 000000000 ____D C:\Users\User\Desktop\Нова папка
2018-01-26 09:21 - 2009-07-14 06:45 - 000021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-01-26 09:21 - 2009-07-14 06:45 - 000021280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-01-26 09:19 - 2009-07-14 07:13 - 000785302 _____ C:\Windows\system32\PerfStringBackup.INI
2018-01-26 09:19 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2018-01-26 09:09 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-01-25 21:25 - 2017-10-31 18:06 - 000000000 ____D C:\Users\User\AppData\LocalLow\IObit
2018-01-25 21:09 - 2017-05-20 12:20 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-25 20:23 - 2017-01-24 12:10 - 000000000 ____D C:\ProgramData\Avg
2018-01-25 20:23 - 2017-01-24 12:10 - 000000000 ____D C:\Program Files (x86)\AVG
2018-01-25 20:22 - 2017-01-24 12:14 - 000000000 ____D C:\Users\User\AppData\Roaming\AVG
2018-01-25 01:13 - 2017-11-18 23:18 - 000000000 ____D C:\ProgramData\AVAST Software
2018-01-25 01:09 - 2017-08-27 15:29 - 000000000 _____ C:\Windows\SysWOW64\last.dump
2018-01-17 16:48 - 2017-12-08 23:02 - 000000000 ____D C:\Users\User\Desktop\AutoRuns 13.51
2018-01-15 19:49 - 2017-10-30 21:27 - 000000439 _____ C:\Windows\ULEAD32.INI
2018-01-12 11:46 - 2017-01-25 11:35 - 000000000 ____D C:\Users\User\AppData\Roaming\Foxit Software
2018-01-11 01:00 - 2017-02-12 13:49 - 000000000 ____D C:\Users\User\AppData\Local\ElevatedDiagnostics
2018-01-11 01:00 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\system32\NDF
2018-01-11 00:57 - 2017-10-16 11:17 - 000000000 ____D C:\ProgramData\DatacardService
2018-01-09 08:48 - 2017-01-24 11:47 - 000002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-01-09 08:48 - 2017-01-24 11:47 - 000002181 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-01-06 00:15 - 2017-10-30 22:19 - 000000000 ___HD C:\uAAE4X5oEVeJzTar
2018-01-06 00:10 - 2017-01-24 11:45 - 000001139 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2018-01-06 00:10 - 2017-01-24 11:45 - 000001139 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2018-01-04 23:29 - 2009-07-14 07:08 - 000032586 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-01-02 04:01 - 2009-07-14 06:45 - 000490680 _____ C:\Windows\system32\FNTCACHE.DAT
2018-01-02 03:27 - 2017-01-24 12:47 - 000128848 _____ C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2018-01-01 22:29 - 2017-01-24 11:57 - 000000000 ____D C:\Users\User\AppData\LocalLow\Mozilla

Some files in TEMP:
====================
2018-01-12 11:44 - 2013-05-15 14:00 - 007672896 _____ (Foxit Corporation) C:\Users\User\AppData\Local\Temp\Foxit Updater.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-05 17:50

==================== End of FRST.txt ============================

Addition1.txt

Рутерът - TP-LINK, Модел TL-WR740N,

Версия 4.23. Година на производство не пише на самия рутер.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 януари 20188 г.

Фикс с Farbar Recovery Scan Tool

Изтеглете прикачения файл fixlist.txt и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

Дневници

В следващия си отговор, моля да включите следните дневници:

FixLog.txt

26 януари 20188 г.

ix result of Farbar Recovery Scan Tool (x64) Version: 21.01.2018
Ran by User (26-01-2018 21:28:00) Run:2
Running from C:\Users\User\Downloads
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\MountPoints2: {8fad6e42-f648-11e7-9646-d07e353f3229} - F:\AutoRun.exe
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\MountPoints2: {dc0a1d5b-b244-11e7-a6f5-68f7284731e0} - E:\AutoRun.exe
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\...\MountPoints2: {dc0a1d83-b244-11e7-a6f5-d07e353f3229} - E:\AutoRun.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Screenshoter Mail.Ru.lnk [2017-10-30]
ShortcutTarget: Screenshoter Mail.Ru.lnk -> C:\Users\User\AppData\Local\Mail.Ru\Screenshoter\Screenshoter.exe (No File)
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
CHR HomePage: Default -> mail.ru
CHR HKLM-x32\...\Chrome\Extension: [aijcflokephhcjdmjednnmejlcacgfgb] - hxxps://clients2.google.com/service/update2/crx
S3 esgiguard; \??\C:\Program Files (x86)\SpyHunter Malware Security Suite\esgiguard.sys [X]
C:\Program Files (x86)\SpyHunter Malware Security Suite\esgiguard.sys
2018-01-25 19:53 - 2018-01-25 20:27 - 000000000 ____D C:\AVG_Remover
2018-01-25 19:52 - 2018-01-25 19:52 - 007986864 _____ ( ) C:\Users\User\Downloads\AVG_Remover.exe
2018-01-02 03:38 - 2018-01-02 03:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyHunter Malware
2018-01-01 22:26 - 2018-01-25 21:25 - 000000000 ____D C:\Users\User\AppData\Roaming\Lavasoft
2018-01-01 22:26 - 2018-01-25 21:25 - 000000000 ____D C:\Program Files (x86)\Lavasoft
2018-01-01 22:26 - 2018-01-01 22:26 - 000000000 ____D C:\Users\User\AppData\Local\Lavasoft
2018-01-01 22:25 - 2018-01-25 21:25 - 000000000 ____D C:\ProgramData\Lavasoft
2018-01-25 21:25 - 2017-10-31 18:06 - 000000000 ____D C:\Users\User\AppData\LocalLow\IObit
2018-01-25 20:23 - 2017-01-24 12:10 - 000000000 ____D C:\ProgramData\Avg
2018-01-25 20:23 - 2017-01-24 12:10 - 000000000 ____D C:\Program Files (x86)\AVG
2018-01-25 20:22 - 2017-01-24 12:14 - 000000000 ____D C:\Users\User\AppData\Roaming\AVG
2018-01-25 01:13 - 2017-11-18 23:18 - 000000000 ____D C:\ProgramData\AVAST Software
2018-01-06 00:15 - 2017-10-30 22:19 - 000000000 ___HD C:\uAAE4X5oEVeJzTar
2018-01-12 11:44 - 2013-05-15 14:00 - 007672896 _____ (Foxit Corporation) C:\Users\User\AppData\Local\Temp\Foxit Updater.exe
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ContextMenuHandlers1: [AIMP] -> {1F77B17B-F531-44DB-ACA4-76ABB5010A28} => -> No File
ContextMenuHandlers4: [AIMP] -> {1F77B17B-F531-44DB-ACA4-76ABB5010A28} => -> No File
cmd: ipconfig /flushdns
cmd: IPCONFIG /release
cmd: IPCONFIG /renew
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
reboot:
end

*****************

Restore point was successfully created.
Processes closed successfully.
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8fad6e42-f648-11e7-9646-d07e353f3229} => key not found
HKLM\Software\Classes\CLSID\{8fad6e42-f648-11e7-9646-d07e353f3229} => key not found
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc0a1d5b-b244-11e7-a6f5-68f7284731e0} => key not found
HKLM\Software\Classes\CLSID\{dc0a1d5b-b244-11e7-a6f5-68f7284731e0} => key not found
HKU\S-1-5-21-1789560146-2085309282-2704652363-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc0a1d83-b244-11e7-a6f5-d07e353f3229} => key not found
HKLM\Software\Classes\CLSID\{dc0a1d83-b244-11e7-a6f5-d07e353f3229} => key not found
"C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Screenshoter Mail.Ru.lnk" => not found
"C:\Users\User\AppData\Local\Mail.Ru\Screenshoter\Screenshoter.exe" => not found
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
"Chrome HomePage" => not found
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aijcflokephhcjdmjednnmejlcacgfgb => key not found
esgiguard => service not found.
"C:\Program Files (x86)\SpyHunter Malware Security Suite\esgiguard.sys" => not found
"C:\AVG_Remover" => not found
"C:\Users\User\Downloads\AVG_Remover.exe" => not found
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyHunter Malware" => not found
"C:\Users\User\AppData\Roaming\Lavasoft" => not found
"C:\Program Files (x86)\Lavasoft" => not found
"C:\Users\User\AppData\Local\Lavasoft" => not found
"C:\ProgramData\Lavasoft" => not found
"C:\Users\User\AppData\LocalLow\IObit" => not found
"C:\ProgramData\Avg" => not found
"C:\Program Files (x86)\AVG" => not found
"C:\Users\User\AppData\Roaming\AVG" => not found
"C:\ProgramData\AVAST Software" => not found
"C:\uAAE4X5oEVeJzTar" => not found
"C:\Users\User\AppData\Local\Temp\Foxit Updater.exe" => not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => key not found
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avg => key not found
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\AIMP => key not found
HKLM\Software\Classes\CLSID\{1F77B17B-F531-44DB-ACA4-76ABB5010A28} => key not found
HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\AIMP => key not found
HKLM\Software\Classes\CLSID\{1F77B17B-F531-44DB-ACA4-76ABB5010A28} => key not found

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= IPCONFIG /release =========

Windows IP Configuration

No operation can be performed on ‹®Є «  ўак§Є  2 while it has its media disconnected.
No operation can be performed on ЃҐ§¦Ёз  ¬аҐ¦®ў  ўак§Є  2 while it has its media disconnected.
No operation can be performed on ‹®Є «  ўак§Є  while it has its media disconnected.
No operation can be performed on Bluetooth ¬аҐ¦®ў  ўак§Є  while it has its media disconnected.

Ethernet adapter ‹®Є « ўак§Є 2: