Инсталирах едно нещо, което се оказа, че не трябва и сега ми пъкват реклами постоянно, компа забозва и така нататък. С любов от русия.

С какво може да сканирам и да оправя нещата, уиндолс 10. 

Пишете в специален раздел!

Изчакайте екипа на HJT Team

Изпълнете указанията тук.

Системата ми е инфектирана - Какво да правя сега?

Редактирано 19 януари 20197 г. от barbuncela (преглед на промените)

Ако съм объркал раздела, да пусна другаде? 
Като цяло минах със malwarebytes намери 250 заплахи, оправих ги, но усещам, че още нещо тежи на компа. Мисли повече, и перката я чувам.

преди 4 минути, qnkov написа:

Ако съм объркал раздела, да пусна другаде? 

Това вие си решавате! Тук трябва да изпълните указанията и да чакате човек от HJT Team

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16.01.2019 01
Ran by Vladi (administrator) on DESKTOP-38DQMQI (19-01-2019 18:29:09)
Running from C:\Users\Vladi\Downloads
Loaded Profiles: Vladi &  (Available Profiles: Vladi)
Platform: Windows 10 Pro Version 1803 17134.523 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
() C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1812.3-0\MsMpEng.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
() C:\Program Files (x86)\SmartData\svchost_ms.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeApp.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1812.3-0\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) C:\Windows\System32\MSTM64_Q.EXE
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(BitTorrent Inc.) C:\Users\Vladi\AppData\Roaming\uTorrent\uTorrent.exe
(Discord Inc.) C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe
(BitTorrent Inc.) C:\Users\Vladi\AppData\Roaming\uTorrent\updates\3.5.5_44994\utorrentie.exe
(BitTorrent Inc.) C:\Users\Vladi\AppData\Roaming\uTorrent\updates\3.5.5_44994\utorrentie.exe
(Viber Media S.à r.l.) C:\Users\Vladi\AppData\Local\Viber\Viber.exe
(Discord Inc.) C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe
(Epic Games, Inc.) D:\Игри\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.35\Lightshot.exe
(Discord Inc.) C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe
(Discord Inc.) C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe
(Discord Inc.) C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe
(Discord Inc.) C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Vaclav Slavik) C:\Program Files (x86)\Poedit\Poedit.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Program Files (x86)\SmartData\performer.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] => C:\Windows\system32\MSTM64_Q.EXE [247224 2011-03-09] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [2675176 2018-12-13] (Adobe Systems, Incorporated)
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2017-04-11] ()
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\...\Run: [uTorrent] => C:\Users\Vladi\AppData\Roaming\uTorrent\uTorrent.exe [1908920 2019-01-15] (BitTorrent Inc.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\...\Run: [Discord] => C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe [81747288 2019-01-15] (Discord Inc.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3208992 2018-10-13] (Valve Corporation)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\...\Run: [Viber] => C:\Users\Vladi\AppData\Local\Viber\Viber.exe [37117512 2018-12-21] (Viber Media S.à r.l.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4471536 2015-05-21] (Disc Soft Ltd)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\...\Run: [EpicGamesLauncher] => D:\Игри\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [35184016 2019-01-10] (Epic Games, Inc.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\...\Run: [uTorrent] => C:\Users\Vladi\AppData\Roaming\uTorrent\uTorrent.exe [1908920 2019-01-15] (BitTorrent Inc.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\...\Run: [Discord] => C:\Users\Vladi\AppData\Local\Discord\app-0.0.304\Discord.exe [81747288 2019-01-15] (Discord Inc.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3208992 2018-10-13] (Valve Corporation)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\...\Run: [Viber] => C:\Users\Vladi\AppData\Local\Viber\Viber.exe [37117512 2018-12-21] (Viber Media S.à r.l.)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4471536 2015-05-21] (Disc Soft Ltd)
HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\...\Run: [EpicGamesLauncher] => D:\Игри\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [35184016 2019-01-10] (Epic Games, Inc.)
HKLM\...\Drivers32: [VIDC.X264] => C:\Windows\system32\x264vfw64.dll [3799552 2017-07-30] (x264vfw project)
HKLM\...\Drivers32: [VIDC.LAGS] => C:\Windows\system32\lagarith.dll [148992 2011-12-07] ( )
HKLM\...\Drivers32: [VIDC.XVID] => C:\Windows\system32\xvidvfw.dll [311296 2018-01-28] ()
HKLM\...\Drivers32: [msacm.ac3acm] => C:\Windows\system32\ac3acm.acm [180736 2012-07-21] (fccHandler)
HKLM\...\Drivers32: [msacm.l3codecp] => C:\Windows\system32\l3codecp.acm [181760 2018-04-12] (Fraunhofer Institut Integrierte Schaltungen IIS)
HKLM\...\Drivers32-x32: [VIDC.X264] => C:\Windows\SysWOW64\x264vfw.dll [3850240 2017-07-30] (x264vfw project)
HKLM\...\Drivers32-x32: [VIDC.LAGS] => C:\Windows\SysWOW64\lagarith.dll [216064 2011-12-07] ( )
HKLM\...\Drivers32-x32: [VIDC.XVID] => C:\Windows\SysWOW64\xvidvfw.dll [284672 2018-01-28] ()
HKLM\...\Drivers32-x32: [msacm.ac3acm] => C:\Windows\SysWOW64\ac3acm.acm [122880 2012-07-21] (fccHandler)
HKLM\...\Drivers32-x32: [msacm.l3codecp] => C:\Windows\SysWOW64\l3codecp.acm [190464 2018-04-12] (Fraunhofer Institut Integrierte Schaltungen IIS)
HKLM\...\Drivers32-x32: [VIDC.FFDS] => C:\Windows\SysWOW64\ff_vfw.dll [112128 2015-10-24] ()
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\71.0.3578.98\Installer\chrmstp.exe [2019-01-19] (Google Inc.)
AppInit_DLLs: C:\Windows\system32\DriverStore\FileRepository\nvaci.inf_amd64_f658c3ebd2a88192\nvinitx.dll => C:\Windows\system32\DriverStore\FileRepository\nvaci.inf_amd64_f658c3ebd2a88192\nvinitx.dll [209128 2018-03-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\system32\DriverStore\FileRepository\nvaci.inf_amd64_f658c3ebd2a88192\nvinit.dll => C:\Windows\System32\DriverStore\FileRepository\nvaci.inf_amd64_f658c3ebd2a88192\nvinit.dll [182592 2018-03-25] (NVIDIA Corporation)
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{1d01a90e-b932-4fb9-9113-fcc33134707d}: [DhcpNameServer] 192.168.100.1
Tcpip\..\Interfaces\{3b4a32f7-c8c9-4470-aaf6-71de369df7e5}: [DhcpNameServer] 192.168.100.1

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-2956623404-1635080235-2419004971-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
SearchScopes: HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2017-02-01] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2016-11-16] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2016-11-16] (Microsoft Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2017-02-01] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2017-02-01] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2017-02-01] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2017-02-01] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: d9we50gv.default
FF ProfilePath: C:\Users\Vladi\AppData\Roaming\Mozilla\Firefox\Profiles\d9we50gv.default [2019-01-19]
FF Homepage: Mozilla\Firefox\Profiles\d9we50gv.default -> hxxps://inline.go.mail.ru/homepage?inline_comp=ffhp15.1.11.102&inline_hp_cnt=11956636
FF HomepageOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: [email protected]
FF NewTabOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: {a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}
FF NewTabOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: [email protected]
FF Extension: (Firefox Protection) - C:\Users\Vladi\AppData\Roaming\Mozilla\Firefox\Profiles\d9we50gv.default\Extensions\{ab10d63e-3096-4492-ab0e-5edcf4baf988} [2019-01-19] [not signed]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-02-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2019-01-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2019-01-19] (Google Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default [2019-01-19]
CHR Extension: (Презентации) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-01-19]
CHR Extension: (Документи) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-01-19]
CHR Extension: (Google Диск) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-01-19]
CHR Extension: (YouTube) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-01-19]
CHR Extension: (Таблици) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-01-19]
CHR Extension: (Google Документи офлайн) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2019-01-19]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-01-19]
CHR Extension: (Gmail) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-01-19]
CHR Extension: (Chrome Media Router) - C:\Users\Vladi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-01-19]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [818136 2018-02-16] (Adobe Systems Incorporated)
R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [2917864 2018-12-13] (Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2709480 2018-12-13] (Adobe Systems, Incorporated)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [7356680 2018-10-03] ()
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1272560 2015-05-21] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [784512 2018-09-16] (EasyAntiCheat Ltd)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-03] (Malwarebytes)
R2 MEmuSVC; C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe [85296 2018-06-22] ()
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [773512 2018-10-10] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [773512 2018-10-10] (NVIDIA Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-07-15] (Microsoft Corporation)
R2 Smart Monitoring; C:\Program Files (x86)\SmartData\svchost_ms.exe [2203648 2019-01-19] () [File not signed]
S4 ssh-agent; C:\Windows\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1812.3-0\NisSrv.exe [3880120 2018-12-11] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1812.3-0\MsMpEng.exe [114208 2018-12-11] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2018-10-25] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [152184 2018-04-26] (Malwarebytes)
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [190696 2019-01-19] (Malwarebytes)
S3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [112864 2019-01-19] (Malwarebytes)
S3 MBAMProtection; C:\Windows\system32\DRIVERS\mbam.sys [44768 2019-01-19] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253664 2019-01-19] (Malwarebytes)
S3 MBAMWebProtection; C:\Windows\system32\DRIVERS\mwac.sys [103648 2019-01-19] (Malwarebytes)
R2 MEmuDrv; C:\Program Files (x86)\Microvirt\MEmuHyperv\MEmuDrv.sys [319304 2018-03-30] (Maiwei Corporation)
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nvaci.inf_amd64_f658c3ebd2a88192\nvlddmkm.sys [17544792 2018-03-25] (NVIDIA Corporation)
R0 nvpciflt; C:\Windows\System32\DriverStore\FileRepository\nvaci.inf_amd64_f658c3ebd2a88192\nvpciflt.sys [48480 2018-03-25] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30792 2018-08-21] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [69544 2018-06-08] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [58816 2018-03-24] (NVIDIA Corporation)
R0 vsock; C:\Windows\system32\DRIVERS\vsock.sys [91712 2018-05-05] (VMware, Inc.)
S0 WdBoot; C:\Windows\System32\drivers\wd\WdBoot.sys [46680 2018-12-11] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\wd\WdFilter.sys [330936 2018-12-11] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [62136 2018-12-11] (Microsoft Corporation)
S2 MLPTDR_Q; \??\C:\Windows\system32\ [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-01-19 18:27 - 2019-01-19 18:29 - 000060823 _____ C:\Users\Vladi\Downloads\Addition.txt
2019-01-19 18:27 - 2019-01-19 18:27 - 000018831 _____ C:\Users\Vladi\Downloads\um-activity-bg_BG.po
2019-01-19 18:27 - 2019-01-19 18:27 - 000018831 _____ C:\Users\Vladi\Desktop\um-activity-bg_BG.po
2019-01-19 18:25 - 2019-01-19 18:30 - 000022491 _____ C:\Users\Vladi\Downloads\FRST.txt
2019-01-19 18:24 - 2019-01-19 18:29 - 000000000 ____D C:\FRST
2019-01-19 18:24 - 2019-01-19 18:24 - 002427904 _____ (Farbar) C:\Users\Vladi\Downloads\FRST64.exe
2019-01-19 18:24 - 2019-01-19 18:24 - 002427904 _____ (Farbar) C:\Users\Vladi\Downloads\FRST64 (1).exe
2019-01-19 18:21 - 2019-01-19 18:19 - 000976005 _____ C:\Users\Vladi\Desktop\contus-video-gallery-master 2.7.zip
2019-01-19 18:19 - 2019-01-19 18:19 - 000976005 _____ C:\Users\Vladi\Downloads\contus-video-gallery-master (1).zip
2019-01-19 18:15 - 2015-07-08 08:50 - 000000000 ____D C:\Users\Vladi\Downloads\contus-video-gallery-master
2019-01-19 18:14 - 2019-01-19 18:13 - 000977191 _____ C:\Users\Vladi\Desktop\contus-video-gallery-master.zip
2019-01-19 18:13 - 2019-01-19 18:13 - 000977191 _____ C:\Users\Vladi\Downloads\contus-video-gallery-master.zip
2019-01-19 17:43 - 2019-01-19 17:43 - 000002375 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-01-19 17:43 - 2019-01-19 17:43 - 000002334 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-01-19 17:42 - 2019-01-19 17:42 - 000003518 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2019-01-19 17:42 - 2019-01-19 17:42 - 000003394 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2019-01-19 17:34 - 2019-01-19 17:34 - 001136176 _____ (Google Inc.) C:\Users\Vladi\Downloads\ChromeSetup.exe
2019-01-19 17:16 - 2019-01-19 17:16 - 000044768 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2019-01-19 17:15 - 2019-01-19 17:16 - 000103648 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2019-01-19 17:15 - 2019-01-19 17:15 - 000253664 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2019-01-19 17:15 - 2019-01-19 17:15 - 000190696 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2019-01-19 17:15 - 2019-01-19 17:15 - 000112864 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2019-01-19 17:15 - 2019-01-19 17:15 - 000001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-01-19 17:15 - 2019-01-19 17:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-01-19 17:15 - 2019-01-19 17:15 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-01-19 17:15 - 2019-01-19 17:15 - 000000000 ____D C:\Program Files\Malwarebytes
2019-01-19 17:15 - 2018-04-26 05:36 - 000152184 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae64.sys
2019-01-19 17:14 - 2019-01-19 17:29 - 000000000 ____D C:\Users\Vladi\AppData\LocalLow\uTorrent
2019-01-19 17:10 - 2019-01-19 17:10 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\Obsidium
2019-01-19 16:56 - 2019-01-19 16:56 - 000020267 _____ C:\Users\Vladi\Downloads\RyuKo_Karin.torrent
2019-01-19 16:56 - 2019-01-19 16:56 - 000012689 _____ C:\Users\Vladi\Downloads\Malwarebytes Anti-Malware Premium v3.5.1.2522 (1).torrent
2019-01-19 16:50 - 2019-01-19 16:50 - 000012689 _____ C:\Users\Vladi\Downloads\Malwarebytes Anti-Malware Premium v3.5.1.2522.torrent
2019-01-19 16:21 - 2019-01-19 17:26 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\TablacusApp2
2019-01-19 16:21 - 2019-01-19 16:25 - 000000000 ____D C:\Users\Vladi\AppData\Local\Mail.Ru
2019-01-19 16:21 - 2019-01-19 16:22 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-01-19 16:21 - 2019-01-19 16:22 - 000000000 ____D C:\Program Files (x86)\SmartData
2019-01-19 16:21 - 2019-01-19 16:21 - 004915200 _____ C:\Users\Vladi\Downloads\apptha-wordpress-video-gallery-nulled-league-1_9fbbb6b-2366.iso
2019-01-19 16:18 - 2019-01-19 16:18 - 004915200 _____ C:\Users\Vladi\Downloads\wordpress-video-gallery-apptha-nulled-io_f77ad62-2055.iso
2019-01-19 16:17 - 2019-01-19 16:18 - 004915200 _____ C:\Users\Vladi\Downloads\wordpress-video-gallery-apptha-nulled-io_ca04b65-3040.iso
2019-01-19 15:30 - 2019-01-19 15:28 - 003631542 _____ C:\Users\Vladi\Desktop\contus-video-gallery_5.zip
2019-01-19 15:28 - 2019-01-19 15:28 - 003631542 _____ C:\Users\Vladi\Downloads\contus-video-gallery_5.zip
2019-01-19 15:21 - 2019-01-19 15:21 - 000000038 _____ C:\Users\Vladi\Desktop\Трейлър.txt
2019-01-19 15:18 - 2019-01-19 15:18 - 001628887 _____ C:\Users\Vladi\Downloads\Karin 01-24.rar
2019-01-19 13:42 - 2019-01-19 13:42 - 000038822 _____ C:\Users\Vladi\Downloads\[RyuKo]Karin.torrent
2019-01-19 13:26 - 2019-01-19 13:26 - 000000754 _____ C:\Users\Vladi\Desktop\Documents - Shortcut.lnk
2019-01-19 13:11 - 2019-01-19 13:11 - 000043368 _____ C:\Users\Vladi\Downloads\cricket-bold_[bg.allfont.net].ttf
2019-01-19 13:11 - 2019-01-19 13:11 - 000043348 _____ C:\Users\Vladi\Downloads\cricket_[allfont.net].ttf
2019-01-19 13:10 - 2019-01-19 13:10 - 000135004 _____ C:\Users\Vladi\Downloads\dom-casual.zip
2019-01-19 13:08 - 2019-01-19 13:08 - 000051246 _____ C:\Users\Vladi\Downloads\uk_arbat_[bg.allfont.net].ttf
2019-01-18 18:53 - 2019-01-18 18:54 - 000000000 ____D C:\Users\Vladi\Desktop\WPTouch.Pro.v4.0.18.Nulled
2019-01-18 18:52 - 2019-01-18 18:52 - 001242266 _____ C:\Users\Vladi\Desktop\WPTouch.Pro.v4.0.18._ed.zip
2019-01-18 18:51 - 2019-01-18 18:52 - 001242266 _____ C:\Users\Vladi\Downloads\WPTouch.Pro.v4.0.18._ed.zip
2019-01-18 18:40 - 2019-01-09 15:12 - 001486670 _____ C:\Users\Vladi\Desktop\WPTouch Pro Nulled v4.3.13.zip
2019-01-18 18:39 - 2019-01-18 18:40 - 000000000 ____D C:\Users\Vladi\Desktop\Installable-plugin
2019-01-18 18:39 - 2019-01-18 18:39 - 001403484 _____ C:\Users\Vladi\Downloads\72624_wptouch-pro_v4313.zip
2019-01-18 18:39 - 2019-01-18 18:39 - 001403484 _____ C:\Users\Vladi\Desktop\72624_wptouch-pro_v4313.zip
2019-01-18 18:34 - 2019-01-18 18:34 - 003505696 _____ C:\Users\Vladi\Desktop\wptouch-pro.zip
2019-01-18 18:33 - 2019-01-18 18:34 - 000000000 ____D C:\Users\Vladi\Desktop\wptouch-pro
2019-01-18 18:31 - 2019-01-18 18:31 - 003486154 _____ C:\Users\Vladi\Downloads\87581_wptouch-pro_v4325.zip
2019-01-17 21:45 - 2019-01-17 21:45 - 000012565 _____ C:\Users\Vladi\Desktop\New Text Document (2).txt
2019-01-16 22:39 - 2019-01-16 22:39 - 073999135 _____ C:\Users\Vladi\Desktop\Платени плъгини.zip
2019-01-16 22:35 - 2019-01-16 22:38 - 000000000 ____D C:\Users\Vladi\Desktop\Платени плъгини
2019-01-16 17:40 - 2018-09-20 06:12 - 001483576 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2019-01-15 18:00 - 2019-01-15 18:00 - 000001047 _____ C:\Users\Vladi\Desktop\IrfanView 64.lnk
2019-01-15 18:00 - 2019-01-15 18:00 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2019-01-15 18:00 - 2019-01-15 18:00 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\IrfanView
2019-01-15 18:00 - 2019-01-15 18:00 - 000000000 ____D C:\Program Files\IrfanView
2019-01-15 17:56 - 2019-01-15 17:56 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\FastStone
2019-01-15 17:55 - 2019-01-15 17:55 - 000001196 _____ C:\Users\Public\Desktop\FastStone Image Viewer.lnk
2019-01-15 17:55 - 2019-01-15 17:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Image Viewer
2019-01-15 17:55 - 2019-01-15 17:55 - 000000000 ____D C:\Program Files (x86)\FastStone Image Viewer
2019-01-15 00:38 - 2019-01-15 00:38 - 000000000 ____D C:\Users\Vladi\AppData\Local\Brice_Lambson
2019-01-15 00:11 - 2019-01-15 00:11 - 000000000 ____D C:\Program Files\Image Resizer for Windows
2019-01-15 00:09 - 2019-01-15 00:09 - 000000000 ____D C:\Program Files (x86)\Image Resizer for Windows
2019-01-13 21:53 - 2018-10-14 14:08 - 000000000 ____D C:\Users\Vladi\Desktop\madara1511
2019-01-13 17:08 - 2019-01-13 17:08 - 000000683 _____ C:\Users\Vladi\Desktop\Favorite tab.txt
2019-01-12 17:43 - 2019-01-12 18:25 - 000009065 _____ C:\Users\Vladi\Desktop\New Text Document (3).txt
2019-01-11 01:14 - 2019-01-11 01:14 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\Poedit
2019-01-09 15:19 - 2019-01-01 15:46 - 012710912 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2019-01-09 15:19 - 2019-01-01 15:20 - 011902976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2019-01-09 15:19 - 2019-01-01 09:14 - 001221432 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2019-01-09 15:19 - 2019-01-01 09:14 - 001029944 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2019-01-09 15:19 - 2019-01-01 09:14 - 000134968 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.dll
2019-01-09 15:19 - 2019-01-01 09:13 - 003292152 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2019-01-09 15:19 - 2019-01-01 09:13 - 001363536 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2019-01-09 15:19 - 2019-01-01 09:13 - 000709728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2019-01-09 15:19 - 2019-01-01 09:13 - 000170808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2019-01-09 15:19 - 2019-01-01 09:12 - 009084216 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2019-01-09 15:19 - 2019-01-01 09:12 - 007520104 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2019-01-09 15:19 - 2019-01-01 09:12 - 002765344 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2019-01-09 15:19 - 2019-01-01 09:12 - 002465792 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2019-01-09 15:19 - 2019-01-01 09:12 - 002421288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2019-01-09 15:19 - 2019-01-01 09:12 - 000713272 _____ (Microsoft Corporation) C:\Windows\system32\MSVideoDSP.dll
2019-01-09 15:19 - 2019-01-01 08:55 - 025856512 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2019-01-09 15:19 - 2019-01-01 08:50 - 022715392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2019-01-09 15:19 - 2019-01-01 08:50 - 004383744 _____ (Microsoft Corporation) C:\Windows\system32\EdgeContent.dll
2019-01-09 15:19 - 2019-01-01 08:47 - 000808448 _____ (Microsoft Corporation) C:\Windows\system32\EdgeManager.dll
2019-01-09 15:19 - 2019-01-01 08:46 - 000154112 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2019-01-09 15:19 - 2019-01-01 08:45 - 007573504 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2019-01-09 15:19 - 2019-01-01 08:45 - 002368512 _____ (Microsoft Corporation) C:\Windows\system32\WebRuntimeManager.dll
2019-01-09 15:19 - 2019-01-01 08:44 - 001708544 _____ (Microsoft Corporation) C:\Windows\system32\MSPhotography.dll
2019-01-09 15:19 - 2019-01-01 08:44 - 001549824 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2019-01-09 15:19 - 2019-01-01 08:44 - 000894464 _____ (Microsoft Corporation) C:\Windows\system32\webplatstorageserver.dll
2019-01-09 15:19 - 2019-01-01 08:43 - 001805312 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2019-01-09 15:19 - 2019-01-01 08:42 - 004939776 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2019-01-09 15:19 - 2019-01-01 08:42 - 000717312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Web.dll
2019-01-09 15:19 - 2019-01-01 08:41 - 001159680 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2019-01-09 15:19 - 2019-01-01 08:41 - 000505344 _____ (Microsoft Corporation) C:\Windows\system32\edgeIso.dll
2019-01-09 15:19 - 2019-01-01 08:37 - 006571584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2019-01-09 15:19 - 2019-01-01 08:37 - 002478664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2019-01-09 15:19 - 2019-01-01 08:37 - 002253696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2019-01-09 15:19 - 2019-01-01 08:37 - 001989040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2019-01-09 15:19 - 2019-01-01 08:29 - 022016512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2019-01-09 15:19 - 2019-01-01 08:22 - 019405312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2019-01-09 15:19 - 2019-01-01 08:16 - 005775872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2019-01-09 15:19 - 2019-01-01 08:15 - 005307392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2019-01-09 15:19 - 2019-01-01 08:15 - 000608768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EdgeManager.dll
2019-01-09 15:19 - 2019-01-01 08:15 - 000331264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgeIso.dll
2019-01-09 15:19 - 2019-01-01 08:14 - 004514816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2019-01-09 15:19 - 2019-01-01 08:14 - 000578560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webplatstorageserver.dll
2019-01-09 15:19 - 2019-01-01 08:13 - 001628160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2019-01-09 15:19 - 2019-01-01 08:13 - 000251904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msIso.dll
2019-01-09 15:18 - 2019-01-01 15:50 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\iemigplugin.dll
2019-01-09 15:18 - 2019-01-01 15:47 - 000225792 _____ (Microsoft Corporation) C:\Windows\system32\windowslivelogin.dll
2019-01-09 15:18 - 2019-01-01 15:45 - 000714752 _____ (Microsoft Corporation) C:\Windows\system32\wlidcli.dll
2019-01-09 15:18 - 2019-01-01 15:45 - 000285184 _____ (Microsoft Corporation) C:\Windows\system32\wlidcredprov.dll
2019-01-09 15:18 - 2019-01-01 15:43 - 001364992 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvruserservice.dll
2019-01-09 15:18 - 2019-01-01 15:20 - 000165888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windowslivelogin.dll
2019-01-09 15:18 - 2019-01-01 15:18 - 000500736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidcli.dll
2019-01-09 15:18 - 2019-01-01 15:17 - 000231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidcredprov.dll
2019-01-09 15:18 - 2019-01-01 09:14 - 001063224 _____ (Microsoft Corporation) C:\Windows\system32\SecConfig.efi
2019-01-09 15:18 - 2019-01-01 09:14 - 000566568 _____ (Microsoft Corporation) C:\Windows\system32\tcblaunch.exe
2019-01-09 15:18 - 2019-01-01 09:14 - 000076088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hvservice.sys
2019-01-09 15:18 - 2019-01-01 09:13 - 000436024 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2019-01-09 15:18 - 2019-01-01 09:12 - 000268304 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2019-01-09 15:18 - 2019-01-01 09:12 - 000128824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tm.sys
2019-01-09 15:18 - 2019-01-01 09:12 - 000043536 _____ (Microsoft Corporation) C:\Windows\system32\browser_broker.exe
2019-01-09 15:18 - 2019-01-01 08:48 - 000342528 _____ (Microsoft Corporation) C:\Windows\system32\browserexport.exe
2019-01-09 15:18 - 2019-01-01 08:48 - 000081920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2019-01-09 15:18 - 2019-01-01 08:48 - 000079360 _____ (Microsoft Corporation) C:\Windows\system32\Print.Workflow.Source.dll
2019-01-09 15:18 - 2019-01-01 08:47 - 000433152 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
2019-01-09 15:18 - 2019-01-01 08:46 - 000209408 _____ (Microsoft Corporation) C:\Windows\system32\MicrosoftAccountTokenProvider.dll
2019-01-09 15:18 - 2019-01-01 08:46 - 000153088 _____ (Microsoft Corporation) C:\Windows\system32\dssvc.dll
2019-01-09 15:18 - 2019-01-01 08:45 - 000352768 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore.dll
2019-01-09 15:18 - 2019-01-01 08:44 - 000662528 _____ (Microsoft Corporation) C:\Windows\system32\wlidprov.dll
2019-01-09 15:18 - 2019-01-01 08:44 - 000456192 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Graphics.Printing.Workflow.dll
2019-01-09 15:18 - 2019-01-01 08:42 - 002247680 _____ (Microsoft Corporation) C:\Windows\system32\wlidsvc.dll
2019-01-09 15:18 - 2019-01-01 08:42 - 001371136 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2019-01-09 15:18 - 2019-01-01 08:41 - 000899072 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2019-01-09 15:18 - 2019-01-01 08:41 - 000895488 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
2019-01-09 15:18 - 2019-01-01 08:37 - 000880048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2019-01-09 15:18 - 2019-01-01 08:37 - 000581808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVideoDSP.dll
2019-01-09 15:18 - 2019-01-01 08:37 - 000381240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2019-01-09 15:18 - 2019-01-01 08:17 - 000153088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MicrosoftAccountTokenProvider.dll
2019-01-09 15:18 - 2019-01-01 08:16 - 001361408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSPhotography.dll
2019-01-09 15:18 - 2019-01-01 08:16 - 000310272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2019-01-09 15:18 - 2019-01-01 08:15 - 000317440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore.dll
2019-01-09 15:18 - 2019-01-01 08:14 - 000330752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Graphics.Printing.Workflow.dll
2019-01-09 15:18 - 2019-01-01 08:13 - 000594432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Web.dll
2019-01-09 15:18 - 2019-01-01 08:12 - 001036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2019-01-09 15:18 - 2019-01-01 08:12 - 000795648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2019-01-09 15:18 - 2019-01-01 08:12 - 000778240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2019-01-09 15:18 - 2019-01-01 08:12 - 000516608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidprov.dll
2019-01-09 15:18 - 2019-01-01 07:23 - 000001310 _____ C:\Windows\system32\tcbres.wim
2019-01-09 15:18 - 2018-12-19 06:49 - 000352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2019-01-06 02:56 - 2019-01-06 02:56 - 000001008 _____ C:\Users\Vladi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\4K Video Downloader.lnk
2019-01-06 02:56 - 2019-01-06 02:56 - 000000000 ____D C:\Users\Vladi\AppData\Local\4kdownload.com
2019-01-06 02:56 - 2019-01-06 02:56 - 000000000 ____D C:\Program Files (x86)\4KDownload
2019-01-05 11:13 - 2019-01-05 11:13 - 000004574 _____ C:\Users\Vladi\AppData\Local\recently-used.xbel
2019-01-04 18:19 - 2019-01-04 18:19 - 000000000 ____D C:\Users\Vladi\AppData\Local\Aegisub
2018-12-26 18:34 - 2018-12-26 18:34 - 000000000 ____D C:\Users\Vladi\AppData\LocalLow\Adobe
2018-12-26 18:32 - 2018-12-26 18:32 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\NVIDIA
2018-12-26 10:57 - 2018-12-26 10:57 - 000000000 ____D C:\Users\Vladi\AppData\Local\Viber
2018-12-26 10:53 - 2018-12-26 18:46 - 000000000 ____D C:\Windows\Minidump
2018-12-24 10:12 - 2018-12-25 10:36 - 000003680 _____ C:\Windows\System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-38DQMQI-Vladi
2018-12-23 16:53 - 2018-12-23 16:53 - 000001085 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2018.lnk
2018-12-23 16:53 - 2018-12-23 16:53 - 000000000 ____D C:\Users\Vladi\Documents\Adobe
2018-12-23 16:53 - 2018-12-23 16:53 - 000000000 ____D C:\Program Files (x86)\Starth
2018-12-23 16:47 - 2018-12-23 16:53 - 000000000 ____D C:\Program Files\Common Files\Adobe
2018-12-23 16:47 - 2018-12-23 16:47 - 000000000 ____D C:\Program Files\Adobe
2018-12-23 16:45 - 2018-12-26 18:33 - 000000000 ____D C:\Users\Vladi\AppData\Local\Adobe
2018-12-23 16:45 - 2018-12-23 16:49 - 000000000 ____D C:\ProgramData\Adobe
2018-12-23 16:45 - 2018-12-23 16:45 - 000000000 ____D C:\Program Files (x86)\Adobe
2018-12-21 12:50 - 2019-01-19 13:23 - 000020480 ____H C:\Users\Vladi\Desktop\photothumb.db
2018-12-20 15:10 - 2018-12-14 09:29 - 001130760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvproc.dll
2018-12-20 15:10 - 2018-12-14 09:25 - 001035256 _____ (Microsoft Corporation) C:\Windows\system32\ApplyTrustOffline.exe
2018-12-20 15:10 - 2018-12-14 09:21 - 001457240 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-12-20 15:10 - 2018-12-14 09:21 - 001257672 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-12-20 15:10 - 2018-12-14 09:21 - 001140480 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-12-20 15:10 - 2018-12-14 09:21 - 001098064 _____ (Microsoft Corporation) C:\Windows\system32\msvproc.dll
2018-12-20 15:10 - 2018-12-14 09:21 - 000982912 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2018-12-20 15:10 - 2018-12-14 09:10 - 001295360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
2018-12-20 15:10 - 2018-12-14 09:07 - 000669696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-12-20 15:10 - 2018-12-14 08:55 - 003396608 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2018-12-20 15:10 - 2018-12-14 08:55 - 000209408 _____ (Microsoft Corporation) C:\Windows\system32\AppXApplicabilityBlob.dll
2018-12-20 15:10 - 2018-12-14 08:54 - 006032384 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2018-12-20 15:10 - 2018-12-14 08:54 - 001307648 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll
2018-12-20 15:10 - 2018-12-14 08:52 - 002173440 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2018-12-20 15:10 - 2018-12-14 08:52 - 001826816 _____ (Microsoft Corporation) C:\Windows\system32\Windows.CloudStore.dll
2018-12-20 15:10 - 2018-12-14 08:51 - 001551360 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2018-12-20 15:10 - 2018-12-14 08:50 - 000776192 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-12-20 14:40 - 2018-12-20 14:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SD Association
2018-12-20 14:40 - 2018-12-20 14:40 - 000000000 ____D C:\Program Files (x86)\SDA
2018-12-20 14:38 - 2018-12-20 14:38 - 000000000 ____D C:\Users\Vladi\AppData\Local\Downloaded Installations

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-01-19 18:30 - 2018-10-24 21:05 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\uTorrent
2019-01-19 18:20 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2019-01-19 17:43 - 2018-10-24 20:51 - 000000000 ____D C:\Users\Vladi\AppData\Local\Google
2019-01-19 17:41 - 2018-10-24 20:51 - 000000000 ____D C:\Program Files (x86)\Google
2019-01-19 17:32 - 2018-10-24 20:41 - 000842712 _____ C:\Windows\system32\PerfStringBackup.INI
2019-01-19 17:32 - 2018-04-12 01:36 - 000000000 ____D C:\Windows\INF
2019-01-19 17:31 - 2018-10-24 20:42 - 000000000 ____D C:\ProgramData\NVIDIA
2019-01-19 17:28 - 2018-10-28 20:00 - 000000000 ____D C:\ProgramData\VMware
2019-01-19 17:27 - 2018-10-24 20:30 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-01-19 17:27 - 2018-04-11 23:04 - 000524288 _____ C:\Windows\system32\config\BBI
2019-01-19 17:26 - 2018-10-26 22:40 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\AIMP
2019-01-19 17:19 - 2018-11-30 19:34 - 000000000 ____D C:\Users\Vladi\AppData\LocalLow\Mozilla
2019-01-19 17:13 - 2018-10-24 20:30 - 000500904 _____ C:\Windows\system32\FNTCACHE.DAT
2019-01-19 17:12 - 2018-11-16 09:17 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\qBittorrent
2019-01-19 16:22 - 2018-04-12 01:38 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2019-01-19 16:22 - 2018-04-12 01:38 - 000000000 ____D C:\Windows\SysWOW64\GroupPolicy
2019-01-19 14:59 - 2018-10-24 20:30 - 000000000 ____D C:\Windows\system32\SleepStudy
2019-01-19 13:25 - 2018-11-03 21:37 - 000000000 ____D C:\Users\Vladi\Desktop\Originals
2019-01-19 13:23 - 2018-10-25 18:50 - 000000000 ____D C:\Users\Vladi\AppData\Local\MKVCleaver
2019-01-19 13:12 - 2018-10-25 19:48 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\Aegisub
2019-01-19 13:11 - 2018-10-25 19:49 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\fontconfig
2019-01-18 17:02 - 2018-11-16 09:44 - 000000000 ____D C:\Program Files\rempl
2019-01-17 23:12 - 2018-10-24 23:25 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\discord
2019-01-17 18:17 - 2018-04-12 01:38 - 000000000 ____D C:\Windows\AppReadiness
2019-01-16 20:39 - 2018-04-12 01:30 - 000000000 ____D C:\Windows\CbsTemp
2019-01-16 17:12 - 2018-10-24 23:25 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc
2019-01-16 17:12 - 2018-10-24 23:25 - 000000000 ____D C:\Users\Vladi\AppData\Local\Discord
2019-01-15 00:53 - 2018-10-25 19:21 - 000000000 ____D C:\Users\Vladi\AppData\Local\CrashDumps
2019-01-15 00:09 - 2018-10-25 19:48 - 000000000 ____D C:\ProgramData\Package Cache
2019-01-12 23:07 - 2018-10-24 23:45 - 000000000 ____D C:\Users\Vladi\Documents\ViberDownloads
2019-01-11 21:08 - 2018-10-29 22:03 - 000000000 ____D C:\Program Files (x86)\Battle.net
2019-01-11 21:06 - 2018-10-29 22:04 - 000000000 ____D C:\Users\Vladi\AppData\Local\Battle.net
2019-01-11 02:24 - 2018-10-24 20:40 - 000000000 ____D C:\Users\Vladi
2019-01-10 02:03 - 2018-04-12 01:38 - 000000000 ____D C:\Windows\TextInput
2019-01-10 02:03 - 2018-04-12 01:38 - 000000000 ____D C:\Windows\bcastdvr
2019-01-09 15:48 - 2018-10-25 18:15 - 000000000 ____D C:\Windows\system32\MRT
2019-01-09 15:43 - 2018-10-25 18:15 - 132790320 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2019-01-07 20:54 - 2018-11-01 23:53 - 000000000 ____D C:\ProgramData\TEMP
2019-01-06 21:07 - 2018-11-01 22:01 - 000000000 ____D C:\Users\Vladi\Desktop\Escanor
2019-01-05 12:48 - 2018-11-01 22:01 - 000000000 ____D C:\Users\Vladi\Desktop\Зъби
2019-01-05 11:13 - 2018-10-26 21:36 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\deluge
2019-01-02 21:41 - 2018-04-12 01:41 - 000835480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2019-01-02 21:41 - 2018-04-12 01:41 - 000179600 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2019-01-01 15:05 - 2018-10-29 22:43 - 000000000 ____D C:\Users\Vladi\Documents\StarCraft II
2019-01-01 15:05 - 2018-10-29 22:05 - 000000000 ____D C:\Users\Vladi\AppData\Local\Blizzard Entertainment
2019-01-01 15:04 - 2018-10-29 22:06 - 000000000 ____D C:\ProgramData\Blizzard Entertainment
2019-01-01 11:55 - 2018-10-25 18:30 - 000000000 ____D C:\Users\Vladi\Desktop\Игри
2018-12-31 09:49 - 2018-04-12 01:38 - 000000000 ____D C:\Windows\LiveKernelReports
2018-12-26 18:33 - 2018-10-24 20:41 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\Adobe
2018-12-26 12:15 - 2018-10-24 23:32 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\ViberPC
2018-12-23 20:11 - 2018-10-24 20:41 - 000000000 ____D C:\Users\Vladi\AppData\Local\Packages
2018-12-23 16:42 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-12-20 15:26 - 2018-10-24 20:46 - 000003378 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2956623404-1635080235-2419004971-1001
2018-12-20 15:26 - 2018-10-24 20:44 - 000000000 ___RD C:\Users\Vladi\OneDrive
2018-12-20 15:26 - 2018-10-24 20:40 - 000002367 _____ C:\Users\Vladi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

==================== Files in the root of some directories =======

2018-10-31 19:36 - 2018-10-31 19:36 - 000000000 _____ () C:\Users\Vladi\AppData\Local\D27589.tmp
2018-10-31 19:36 - 2018-10-31 19:36 - 000000000 _____ () C:\Users\Vladi\AppData\Local\D2C37B.tmp
2018-12-25 10:36 - 2018-12-25 10:36 - 000000000 _____ () C:\Users\Vladi\AppData\Local\oobelibMkey.log
2019-01-05 11:13 - 2019-01-05 11:13 - 000004574 _____ () C:\Users\Vladi\AppData\Local\recently-used.xbel
2018-10-24 21:12 - 2018-10-24 21:12 - 000000003 _____ () C:\Users\Vladi\AppData\Local\updater.log
2018-10-24 21:12 - 2018-10-24 21:12 - 000000425 _____ () C:\Users\Vladi\AppData\Local\UserProducts.xml

Some files in TEMP:
====================
2019-01-19 17:11 - 2019-01-19 16:51 - 074288784 _____ (Malwarebytes                                                ) C:\Users\Vladi\AppData\Local\Temp\mb3-setup-consumer-3.5.1.2522-1.0.365-1.0.4968.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-10-24 20:30

==================== End of FRST.txt ============================

Addition.txt

Здравейте,

По-късно ще напиша скрипт. Но май видях виновниците:

Цитат

2019-01-19 16:21 - 2019-01-19 17:26 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\TablacusApp2
2019-01-19 16:21 - 2019-01-19 16:25 - 000000000 ____D C:\Users\Vladi\AppData\Local\Mail.Ru
2019-01-19 16:21 - 2019-01-19 16:22 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-01-19 16:21 - 2019-01-19 16:22 - 000000000 ____D C:\Program Files (x86)\SmartData

 

Благодаря, аз ще минавам и ще гледам за отговор. 

Изтеглете fixlist.txt и го запазете на в папката, където сте свалили FRST64.exe.

Стартирайте FRST64.exe и натиснете бутона Fix веднъж!

След като приключи, ако ви поиска рестарт - съгласете се. След рестарта публикувайте лог файла - fixlog.txt, който ще се създаде след работата на програмата.

Внимание: Скрипта е създаден за текущата система. Да не се ползва за други системи с подобни проблеми!

Fix result of Farbar Recovery Scan Tool (x64) Version: 16.01.2019 01
Ran by Vladi (20-01-2019 11:31:59) Run:1
Running from C:\Users\Vladi\Downloads
Loaded Profiles: Vladi &  (Available Profiles: Vladi)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
FF Homepage: Mozilla\Firefox\Profiles\d9we50gv.default -> hxxps://inline.go.mail.ru/homepage?inline_comp=ffhp15.1.11.102&inline_hp_cnt=11956636
FF HomepageOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: [email protected]
FF NewTabOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: {a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}
FF NewTabOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: [email protected]
R2 Smart Monitoring; C:\Program Files (x86)\SmartData\svchost_ms.exe [2203648 2019-01-19] () [File not signed]
2019-01-19 16:21 - 2019-01-19 17:26 - 000000000 ____D C:\Users\Vladi\AppData\Roaming\TablacusApp2
2019-01-19 16:21 - 2019-01-19 16:25 - 000000000 ____D C:\Users\Vladi\AppData\Local\Mail.Ru
2019-01-19 16:21 - 2019-01-19 16:22 - 000000000 ____D C:\ProgramData\Mail.Ru
2019-01-19 16:21 - 2019-01-19 16:22 - 000000000 ____D C:\Program Files (x86)\SmartData
2018-10-31 19:36 - 2018-10-31 19:36 - 000000000 _____ () C:\Users\Vladi\AppData\Local\D27589.tmp
2018-10-31 19:36 - 2018-10-31 19:36 - 000000000 _____ () C:\Users\Vladi\AppData\Local\D2C37B.tmp
Folder: C:\Program Files\rempl
AlternateDataStreams: C:\ProgramData\TEMP:58A5270D [376]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [482]
FirewallRules: [{4C747352-DFE3-42CC-9CDA-6E4A6D5B845F}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe No File
FirewallRules: [{874565AC-CC23-4F43-9829-00B61FBC3587}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe No File
FirewallRules: [TCP Query User{CDC65CAE-DF99-4604-B10F-A07C45E4E43B}D:\игри\starcraft ii\versions\base71061\sc2_x64.exe] => (Allow) D:\игри\starcraft ii\versions\base71061\sc2_x64.exe No File
FirewallRules: [UDP Query User{0436E92A-359A-4A72-9BC0-98120D700805}D:\игри\starcraft ii\versions\base71061\sc2_x64.exe] => (Allow) D:\игри\starcraft ii\versions\base71061\sc2_x64.exe No File
FirewallRules: [TCP Query User{DB7C44BE-3310-479D-918C-3204CB6790CB}C:\users\vladi\downloads\downloader_diablo2_lord_of_destruction_enus.exe] => (Allow) C:\users\vladi\downloads\downloader_diablo2_lord_of_destruction_enus.exe No File
FirewallRules: [UDP Query User{F215E1D4-E7E6-41B6-A13D-288F1A6D00FD}C:\users\vladi\downloads\downloader_diablo2_lord_of_destruction_enus.exe] => (Allow) C:\users\vladi\downloads\downloader_diablo2_lord_of_destruction_enus.exe No File
FirewallRules: [TCP Query User{8B1E7ABC-2B26-40D2-BF83-F90617757C2A}C:\users\vladi\downloads\downloader_diablo2_enus (1).exe] => (Allow) C:\users\vladi\downloads\downloader_diablo2_enus (1).exe No File
FirewallRules: [UDP Query User{C5B2F0DA-49FA-4959-9385-AE3181766ACF}C:\users\vladi\downloads\downloader_diablo2_enus (1).exe] => (Allow) C:\users\vladi\downloads\downloader_diablo2_enus (1).exe No File
FirewallRules: [TCP Query User{52D2F5FA-3473-42B5-83C3-4C8B1EFA8614}C:\users\vladi\downloads\downloader_diablo2_enus.exe] => (Allow) C:\users\vladi\downloads\downloader_diablo2_enus.exe No File
FirewallRules: [UDP Query User{DAE615DB-F43A-4B2D-98B2-BB5E461E5F45}C:\users\vladi\downloads\downloader_diablo2_enus.exe] => (Allow) C:\users\vladi\downloads\downloader_diablo2_enus.exe No File
cmd: del %temp%\*.* /f /s /q
cmd: rd /s /q %temp%
cmd: bitsadmin /reset /allusers
cmd: netsh winsock reset catalog
cmd: ipconfig /flushdns
RemoveProxy:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
C:\Windows\system32\GroupPolicy\User => moved successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
"Firefox homepage" => removed successfully
"FF HomepageOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: [email protected]" => not found
"FF NewTabOverride: Mozilla\Firefox\Profiles\d9we50gv.default -> Enabled: {a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}" => not found
"Firefox NewTabOverride ([email protected]) " => removed successfully
HKLM\System\CurrentControlSet\Services\Smart Monitoring => removed successfully
Smart Monitoring => service removed successfully
C:\Users\Vladi\AppData\Roaming\TablacusApp2 => moved successfully
C:\Users\Vladi\AppData\Local\Mail.Ru => moved successfully
C:\ProgramData\Mail.Ru => moved successfully
C:\Program Files (x86)\SmartData => moved successfully
C:\Users\Vladi\AppData\Local\D27589.tmp => moved successfully
C:\Users\Vladi\AppData\Local\D2C37B.tmp => moved successfully

========================= Folder: C:\Program Files\rempl ========================

2019-01-07 17:01 - 2019-01-07 17:01 - 000014534 ____A [E022D8156E57EBA1D416660669E67987] () C:\Program Files\rempl\CTAC.json
2019-01-07 17:01 - 2019-01-07 17:01 - 000092664 ____A [C8C3B8FB878CE29B75A69219ABFF4CCF] (Microsoft Corporation) C:\Program Files\rempl\disktoast.exe
2019-01-07 17:01 - 2019-01-07 17:01 - 000076984 ____A [A7851A05E83F42F741A804320C485083] (Microsoft Corporation) C:\Program Files\rempl\osrrb.exe
2019-01-07 17:01 - 2019-01-07 17:01 - 000003798 ____A [902B8F146998B77AB9450A484FA8796E] () C:\Program Files\rempl\rempl.xml
2019-01-11 13:28 - 2019-01-11 13:28 - 000283448 ____A [F8326B64CC70665225A2547CF84BE14F] (Microsoft Corporation) C:\Program Files\rempl\sedlauncher.exe
2019-01-11 13:29 - 2019-01-11 13:29 - 001113912 ____A [EA27C334320FAA404D788E1251E213FD] (Microsoft Corporation) C:\Program Files\rempl\sedplugins.dll
2019-01-11 13:28 - 2019-01-11 13:28 - 000325432 ____A [B2A91F7491623480CEBF260355943E76] (Microsoft Corporation) C:\Program Files\rempl\sedsvc.exe
2019-01-07 17:01 - 2019-01-07 17:01 - 000034696 ____A [CFF38DAC2D884B3A493DD74D8053E684] () C:\Program Files\rempl\ServiceStackHardening.Inf
2019-01-11 13:30 - 2019-01-11 13:30 - 000475960 ____A [F1DD9A74E929F72BE15725D3E0158BCA] (Microsoft Corporation) C:\Program Files\rempl\strgsnsaddons.dll
2019-01-07 17:01 - 2019-01-07 17:01 - 000000570 ____A [DF28BE0DF05E1F12A22F72902F25360C] () C:\Program Files\rempl\toastlogo.png
2018-11-16 09:44 - 2019-01-20 11:32 - 000000000 ____D [00000000000000000000000000000000] () C:\Program Files\rempl\Logs
2019-01-19 12:42 - 2019-01-20 11:14 - 000065536 _____ [6065369F82A2D0773EDEA1E1318AC53A] () C:\Program Files\rempl\Logs\LauncherRemediation.001.etl
2019-01-19 12:42 - 2019-01-19 17:12 - 000131072 ____A [9337884AEC5FEB0E1454A696682420CF] () C:\Program Files\rempl\Logs\LauncherRemediation.002.etl
2018-11-16 09:44 - 2019-01-18 17:02 - 000196608 ____A [FF131D0B9ED3D765E3208BA38FFE12F1] () C:\Program Files\rempl\Logs\LauncherRemediation.004.etl
2018-11-16 09:44 - 2019-01-17 16:48 - 000131072 ____A [2445CB5996531FC3D667B2A8649C8FD0] () C:\Program Files\rempl\Logs\LauncherRemediation.005.etl
2018-11-16 09:44 - 2019-01-16 17:42 - 000131072 ____A [62F1A0138923A97C45180F9563621A27] () C:\Program Files\rempl\Logs\LauncherRemediation.006.etl
2018-11-16 09:44 - 2019-01-16 17:10 - 000196608 ____A [003CD97BFFAA3AE60790359434FE1DBF] () C:\Program Files\rempl\Logs\LauncherRemediation.007.etl
2018-11-16 09:44 - 2019-01-15 17:18 - 000131072 ____A [C58B372AB3E6DA95224D31B5BE2BDDDC] () C:\Program Files\rempl\Logs\LauncherRemediation.008.etl
2018-11-16 09:44 - 2019-01-15 17:17 - 000131072 ____A [CE12472B688C90DB0CC2BD9820AD2EB7] () C:\Program Files\rempl\Logs\LauncherRemediation.009.etl
2018-11-16 09:44 - 2019-01-14 17:44 - 000131072 ____A [EE300443CD2CBE55D4C614F3F2EC7728] () C:\Program Files\rempl\Logs\LauncherRemediation.010.etl
2018-11-16 09:44 - 2019-01-13 15:29 - 000131072 ____A [FD8196712A0E4BB24FFD8A6DE57F3A31] () C:\Program Files\rempl\Logs\LauncherRemediation.011.etl
2018-11-16 09:44 - 2019-01-13 12:05 - 000131072 ____A [66C51663DED92B29EB3F236E28185D04] () C:\Program Files\rempl\Logs\LauncherRemediation.012.etl
2018-11-16 09:44 - 2019-01-13 11:45 - 000131072 ____A [C176D0E75F30235505BEFBCBA18DB59C] () C:\Program Files\rempl\Logs\LauncherRemediation.013.etl
2018-11-16 09:44 - 2019-01-13 10:44 - 000131072 ____A [58EB9FB57DDBAF1ED865E7E7C2A59AB2] () C:\Program Files\rempl\Logs\LauncherRemediation.014.etl
2018-11-16 09:44 - 2019-01-12 16:29 - 000131072 ____A [2C42DC82EEEDCE6435F6019577E17810] () C:\Program Files\rempl\Logs\LauncherRemediation.015.etl
2018-11-16 09:44 - 2019-01-12 12:45 - 000131072 ____A [90177B479E18AA13634F22A86D5EFE28] () C:\Program Files\rempl\Logs\LauncherRemediation.016.etl
2018-11-16 09:44 - 2019-01-12 10:00 - 000131072 ____A [EFD617F8B087D26243565ECFFDD99B75] () C:\Program Files\rempl\Logs\LauncherRemediation.017.etl
2018-11-16 09:44 - 2019-01-11 17:31 - 000131072 ____A [A745AD73F6241E5BF5D4506D2E6A1FB1] () C:\Program Files\rempl\Logs\LauncherRemediation.018.etl
2018-11-16 09:44 - 2019-01-10 17:06 - 000131072 ____A [3F04921790A7EF62093956E88E395172] () C:\Program Files\rempl\Logs\LauncherRemediation.019.etl
2018-11-16 09:44 - 2019-01-09 15:55 - 000131072 ____A [B5D1F5277D3CF4FE346114F54E2C5161] () C:\Program Files\rempl\Logs\LauncherRemediation.020.etl
2018-11-16 09:44 - 2019-01-09 12:23 - 000131072 ____A [75D992918136CF39FEB3971331C48A92] () C:\Program Files\rempl\Logs\LauncherRemediation.021.etl
2018-11-16 09:44 - 2019-01-09 10:28 - 000131072 ____A [494CB56807D64BE257AC24A8E6542C8E] () C:\Program Files\rempl\Logs\LauncherRemediation.022.etl
2018-11-16 09:44 - 2019-01-09 09:00 - 000131072 ____A [34F09A7CA46CF138C1ED467CFD6B0E38] () C:\Program Files\rempl\Logs\LauncherRemediation.023.etl
2018-11-16 09:44 - 2019-01-08 17:04 - 000131072 ____A [3F9979EDA503ED6160734247B26AEB07] () C:\Program Files\rempl\Logs\LauncherRemediation.024.etl
2018-11-16 09:44 - 2019-01-07 12:28 - 000131072 ____A [9028B10961A02BD87CBA0D6BB30E8158] () C:\Program Files\rempl\Logs\LauncherRemediation.025.etl
2018-11-16 09:44 - 2019-01-07 11:02 - 000131072 ____A [5D3C47F9F0202248335AA0AD282D19FD] () C:\Program Files\rempl\Logs\LauncherRemediation.026.etl
2018-11-16 09:44 - 2019-01-06 12:23 - 000131072 ____A [C7A2E2D9C109A1692A57B0411D96AFC3] () C:\Program Files\rempl\Logs\LauncherRemediation.027.etl
2018-11-16 09:44 - 2019-01-06 11:57 - 000131072 ____A [EAAF893BC29F1131BFF265991A6A100E] () C:\Program Files\rempl\Logs\LauncherRemediation.028.etl
2018-11-16 09:44 - 2019-01-06 11:39 - 000131072 ____A [FFD42F3699642E2C9D1AE62C1F4CC1CB] () C:\Program Files\rempl\Logs\LauncherRemediation.029.etl
2018-11-16 09:44 - 2019-01-05 13:00 - 000131072 ____A [9FEA8B24F81308940F021265DE72CC5D] () C:\Program Files\rempl\Logs\LauncherRemediation.030.etl
2018-11-16 09:44 - 2019-01-05 11:46 - 000131072 ____A [1B93D36F9DA33420798DC747B2FB4CF1] () C:\Program Files\rempl\Logs\LauncherRemediation.031.etl
2018-11-16 09:44 - 2019-01-05 10:55 - 000131072 ____A [F6FB5DAA47C31ED14D5A2145234D7C4C] () C:\Program Files\rempl\Logs\LauncherRemediation.032.etl
2018-11-16 09:44 - 2019-01-04 12:46 - 000131072 ____A [45767E338F92C6E898EBC7CB7E954683] () C:\Program Files\rempl\Logs\LauncherRemediation.033.etl
2018-11-16 09:44 - 2019-01-04 11:58 - 000131072 ____A [CCEC330F383C0953E5167B144AE21512] () C:\Program Files\rempl\Logs\LauncherRemediation.034.etl
2018-11-16 09:44 - 2019-01-03 12:01 - 000131072 ____A [3EE6C1968FFF3FA0341E1A4F576EB780] () C:\Program Files\rempl\Logs\LauncherRemediation.035.etl
2018-11-16 09:44 - 2019-01-03 11:29 - 000131072 ____A [81E19E027025958B9B024F988392FA2B] () C:\Program Files\rempl\Logs\LauncherRemediation.036.etl
2018-11-16 09:44 - 2019-01-02 12:17 - 000131072 ____A [D6733622070EC3C7E0FE6E744EB3B16D] () C:\Program Files\rempl\Logs\LauncherRemediation.037.etl
2018-11-16 09:44 - 2019-01-02 11:26 - 000131072 ____A [C611602AA676A48506584A6627972FC7] () C:\Program Files\rempl\Logs\LauncherRemediation.038.etl
2018-11-16 09:44 - 2019-01-02 10:00 - 000131072 ____A [89E3958F9F7820CCAEF7C1FAE1EDE26A] () C:\Program Files\rempl\Logs\LauncherRemediation.039.etl
2018-11-16 09:44 - 2019-01-01 12:29 - 000131072 ____A [C04686AEFE9139021A57693C989935F5] () C:\Program Files\rempl\Logs\LauncherRemediation.040.etl
2018-11-16 09:44 - 2019-01-01 11:47 - 000131072 ____A [622F72C3639A6B4D7AD0C77195A80946] () C:\Program Files\rempl\Logs\LauncherRemediation.041.etl
2018-11-16 09:44 - 2018-12-31 12:22 - 000131072 ____A [5609443E442ACC771125BC68CF4D0CE2] () C:\Program Files\rempl\Logs\LauncherRemediation.042.etl
2018-11-16 09:44 - 2018-12-31 11:00 - 000131072 ____A [097AF243718FBB92DE3F4E91E41FA7A9] () C:\Program Files\rempl\Logs\LauncherRemediation.043.etl
2018-11-16 09:44 - 2018-12-31 10:46 - 000131072 ____A [8B071E955D37B9DAD1366F612BBBF37C] () C:\Program Files\rempl\Logs\LauncherRemediation.044.etl
2018-11-16 09:44 - 2018-12-31 09:50 - 000131072 ____A [55ED9D578BF332088AE39FFA1CA064D0] () C:\Program Files\rempl\Logs\LauncherRemediation.045.etl
2018-11-16 09:44 - 2018-12-30 12:00 - 000131072 ____A [17D3857FFA03107D07292256CED811E3] () C:\Program Files\rempl\Logs\LauncherRemediation.046.etl
2018-11-16 09:44 - 2018-12-30 11:46 - 000131072 ____A [2105959EED8E91ACC739BD0D7AAFFD4E] () C:\Program Files\rempl\Logs\LauncherRemediation.047.etl
2018-11-16 09:44 - 2018-12-30 11:12 - 000131072 ____A [69B833A0AB55CD82C7E435E931AB72FB] () C:\Program Files\rempl\Logs\LauncherRemediation.048.etl
2018-11-16 09:44 - 2018-12-29 12:46 - 000131072 ____A [EFF0CF791F8BA58A353544B76ACDAEC8] () C:\Program Files\rempl\Logs\LauncherRemediation.049.etl
2018-11-16 09:44 - 2018-12-29 11:14 - 000131072 ____A [AA38F2A8CDEDA2F3E081693E3CE3AB26] () C:\Program Files\rempl\Logs\LauncherRemediation.050.etl
2019-01-19 12:42 - 2019-01-20 11:15 - 000458752 _____ [081BCD7BFDFD27EA3F7BBE4E68A2E7F3] () C:\Program Files\rempl\Logs\Remediation.001.etl
2019-01-19 12:42 - 2019-01-19 17:12 - 000655360 ____A [F603D60CDB2A48B15D1EAA2EAC3F6F6B] () C:\Program Files\rempl\Logs\Remediation.002.etl
2018-11-16 09:44 - 2019-01-18 17:02 - 000458752 ____A [42B0EDA28B93DF9BE112F3E08E922E73] () C:\Program Files\rempl\Logs\Remediation.004.etl
2018-11-16 09:44 - 2019-01-17 16:48 - 000131072 ____A [54638CF5E457FB9381D109D12CCF60DF] () C:\Program Files\rempl\Logs\Remediation.005.etl
2018-11-16 09:44 - 2019-01-16 17:42 - 000458752 ____A [AA03E7FE9D1D7BAC4F1BF1E6CDAFE983] () C:\Program Files\rempl\Logs\Remediation.006.etl
2018-11-16 09:44 - 2019-01-16 17:10 - 000196608 ____A [8A28D5EEDD630F6E914793017F7B0F3C] () C:\Program Files\rempl\Logs\Remediation.007.etl
2018-11-16 09:44 - 2019-01-15 17:18 - 000131072 ____A [1ED5BE942B86A02D296C08562A828BD5] () C:\Program Files\rempl\Logs\Remediation.008.etl
2018-11-16 09:44 - 2019-01-15 17:17 - 000131072 ____A [D8CDF9B5A52AD83DD9E0FBBBCE8E5848] () C:\Program Files\rempl\Logs\Remediation.009.etl
2018-11-16 09:44 - 2019-01-14 17:44 - 000458752 ____A [9EAEB1373CEFB9CBCD7D0FE979D1F117] () C:\Program Files\rempl\Logs\Remediation.010.etl
2018-11-16 09:44 - 2019-01-13 15:29 - 000131072 ____A [33F709AD708CD342902C14B474EA28A6] () C:\Program Files\rempl\Logs\Remediation.011.etl
2018-11-16 09:44 - 2019-01-13 12:05 - 000131072 ____A [E31784443E678D123D3CB04D6455E724] () C:\Program Files\rempl\Logs\Remediation.012.etl
2018-11-16 09:44 - 2019-01-13 11:45 - 000131072 ____A [404D6829DA1058E7307A7B409123C7A2] () C:\Program Files\rempl\Logs\Remediation.013.etl
2018-11-16 09:44 - 2019-01-13 10:44 - 000458752 ____A [7EF959E788745F8B2E1EEB267BC4021D] () C:\Program Files\rempl\Logs\Remediation.014.etl
2018-11-16 09:44 - 2019-01-12 16:29 - 000131072 ____A [923260F289D69324DB7D764A43D6D371] () C:\Program Files\rempl\Logs\Remediation.015.etl
2018-11-16 09:44 - 2019-01-12 12:45 - 000131072 ____A [56FD86D9E0AE3490DD7A82D83DA1B19C] () C:\Program Files\rempl\Logs\Remediation.016.etl
2018-11-16 09:44 - 2019-01-12 10:00 - 000131072 ____A [FB42EED96670F1E0E1E265AAF77BBB46] () C:\Program Files\rempl\Logs\Remediation.017.etl
2018-11-16 09:44 - 2019-01-11 17:31 - 000458752 ____A [C83A54C1B8C3EFD7F029912DB2947AB6] () C:\Program Files\rempl\Logs\Remediation.018.etl
2018-11-16 09:44 - 2019-01-10 17:06 - 000458752 ____A [0E07C78A54C9F978F497CCB5B095E7F9] () C:\Program Files\rempl\Logs\Remediation.019.etl
2018-11-16 09:44 - 2019-01-09 15:55 - 000131072 ____A [8832F03DBDFCC515CAB3A134FED0D2FD] () C:\Program Files\rempl\Logs\Remediation.020.etl
2018-11-16 09:44 - 2019-01-09 12:23 - 000131072 ____A [4011674DAD6C88CADA8D712E0D982B7F] () C:\Program Files\rempl\Logs\Remediation.021.etl
2018-11-16 09:44 - 2019-01-09 10:28 - 000131072 ____A [FE7B122908CE6018206F5422D27816F6] () C:\Program Files\rempl\Logs\Remediation.022.etl
2018-11-16 09:44 - 2019-01-09 09:00 - 000131072 ____A [3044C6A61CCA60FA39C81FA90633B244] () C:\Program Files\rempl\Logs\Remediation.023.etl
2018-11-16 09:44 - 2019-01-08 17:04 - 000458752 ____A [21B305387D2A0831F7A05C7A5789BA68] () C:\Program Files\rempl\Logs\Remediation.024.etl
2018-11-16 09:44 - 2019-01-07 12:28 - 000131072 ____A [AC246268536E8FCA0F505744BDCA78E5] () C:\Program Files\rempl\Logs\Remediation.025.etl
2018-11-16 09:44 - 2019-01-07 11:02 - 000458752 ____A [70502ED878A94D0F4993BDA8D0B1ED9D] () C:\Program Files\rempl\Logs\Remediation.026.etl
2018-11-16 09:44 - 2019-01-06 12:23 - 000131072 ____A [08F2F612FCDAFA6090BF7FCF859614C1] () C:\Program Files\rempl\Logs\Remediation.027.etl
2018-11-16 09:44 - 2019-01-06 11:57 - 000131072 ____A [88AB7C76E20FEACC3AC75A04128F9EA3] () C:\Program Files\rempl\Logs\Remediation.028.etl
2018-11-16 09:44 - 2019-01-06 11:39 - 000131072 ____A [5CB7FB0F37D796A9548195EBF3DEA737] () C:\Program Files\rempl\Logs\Remediation.029.etl
2018-11-16 09:44 - 2019-01-05 13:00 - 000458752 ____A [05C9C155F9F270F1443AC21DED7426ED] () C:\Program Files\rempl\Logs\Remediation.030.etl
2018-11-16 09:44 - 2019-01-05 11:46 - 000131072 ____A [5E2916DC8DEA880DEED650D64547A583] () C:\Program Files\rempl\Logs\Remediation.031.etl
2018-11-16 09:44 - 2019-01-05 10:55 - 000131072 ____A [7E66C2B7F22D1202D1790BF971D2CBB3] () C:\Program Files\rempl\Logs\Remediation.032.etl
2018-11-16 09:44 - 2019-01-04 12:46 - 000131072 ____A [E8737D1D9F0E3BCE27BE58F254EE8B2D] () C:\Program Files\rempl\Logs\Remediation.033.etl
2018-11-16 09:44 - 2019-01-04 11:58 - 000458752 ____A [A89D7F3EDDA35A75CD50AAA4A62A9B36] () C:\Program Files\rempl\Logs\Remediation.034.etl
2018-11-16 09:44 - 2019-01-03 12:01 - 000131072 ____A [9C365C648F67F4F21647CB236BFA4B6E] () C:\Program Files\rempl\Logs\Remediation.035.etl
2018-11-16 09:44 - 2019-01-03 11:29 - 000458752 ____A [DD9452B6D9C763407466AD8E91CACF90] () C:\Program Files\rempl\Logs\Remediation.036.etl
2018-11-16 09:44 - 2019-01-02 12:17 - 000131072 ____A [1AB2890F553BA20E6F5252FE0170D0DB] () C:\Program Files\rempl\Logs\Remediation.037.etl
2018-11-16 09:44 - 2019-01-02 11:26 - 000131072 ____A [66D98F35651E253DC5357B033E84DA28] () C:\Program Files\rempl\Logs\Remediation.038.etl
2018-11-16 09:44 - 2019-01-02 10:00 - 000131072 ____A [14EF4208A0116B4831975A29391E4FF5] () C:\Program Files\rempl\Logs\Remediation.039.etl
2018-11-16 09:44 - 2019-01-01 12:29 - 000458752 ____A [42D2F660F2F746E9428AB09B4CBFC987] () C:\Program Files\rempl\Logs\Remediation.040.etl
2018-11-16 09:44 - 2019-01-01 11:47 - 000131072 ____A [1D3A2A65DC25BFAAADB3897FD24B8AF8] () C:\Program Files\rempl\Logs\Remediation.041.etl
2018-11-16 09:44 - 2018-12-31 12:22 - 000458752 ____A [3CBAA6441A28ED3BD8B9939443EA481D] () C:\Program Files\rempl\Logs\Remediation.042.etl
2018-11-16 09:44 - 2018-12-31 11:00 - 000131072 ____A [FABCBB3A9DCA25DC614CBAA42510CC91] () C:\Program Files\rempl\Logs\Remediation.043.etl
2018-11-16 09:44 - 2018-12-31 10:46 - 000131072 ____A [10B89D5B5435D1EEBEDA3BEB4DDC46CE] () C:\Program Files\rempl\Logs\Remediation.044.etl
2018-11-16 09:44 - 2018-12-31 09:50 - 000131072 ____A [C160001391937967B5726DF9A402196C] () C:\Program Files\rempl\Logs\Remediation.045.etl
2018-11-16 09:44 - 2018-12-30 12:00 - 000131072 ____A [1D8576B3DF23BC3675FB5BE15C2672ED] () C:\Program Files\rempl\Logs\Remediation.046.etl
2018-11-16 09:44 - 2018-12-30 11:46 - 000131072 ____A [9CFEBEBB468BF552E95FA89F50EB33E5] () C:\Program Files\rempl\Logs\Remediation.047.etl
2018-11-16 09:44 - 2018-12-30 11:12 - 000458752 ____A [CC2CC482DBE7C16002749C38AD313FC6] () C:\Program Files\rempl\Logs\Remediation.048.etl
2018-11-16 09:44 - 2018-12-29 12:46 - 000131072 ____A [950900C1AC56F2A33C035CB00D85A909] () C:\Program Files\rempl\Logs\Remediation.049.etl
2018-11-16 09:44 - 2018-12-29 11:14 - 000131072 ____A [BE85A8F17D72ACD80F3673198AFA2111] () C:\Program Files\rempl\Logs\Remediation.050.etl
2018-11-16 09:44 - 2019-01-19 17:30 - 000065536 ____A [D77DE6665643C92EFF689C26824B207E] () C:\Program Files\rempl\Logs\ServiceRemediation.002.etl
2018-11-16 09:44 - 2019-01-19 17:26 - 000131072 ____A [B9BC9597798C9B1029D94E75BAD7F850] () C:\Program Files\rempl\Logs\ServiceRemediation.003.etl
2018-11-16 09:44 - 2019-01-19 17:12 - 000131072 ____A [AABEE16E6D617EFF9E1040F3CA62F87F] () C:\Program Files\rempl\Logs\ServiceRemediation.004.etl
2018-11-16 09:44 - 2019-01-19 02:07 - 000131072 ____A [3E082BD908F2FC5F0D0B1343BC420B99] () C:\Program Files\rempl\Logs\ServiceRemediation.005.etl
2018-11-16 09:44 - 2019-01-18 17:02 - 000131072 ____A [3F502DDD36FBD0A9ADCF06692C52B798] () C:\Program Files\rempl\Logs\ServiceRemediation.006.etl
2018-11-16 09:44 - 2019-01-17 02:03 - 000131072 ____A [BCA2384E76651E14DD20861FA086871C] () C:\Program Files\rempl\Logs\ServiceRemediation.007.etl
2018-11-16 09:44 - 2019-01-10 16:52 - 000065536 ____A [8870EA913C471C0D20F703D16B2B4952] () C:\Program Files\rempl\Logs\ServiceRemediation.008.etl
2018-11-16 09:44 - 2019-01-10 02:04 - 000131072 ____A [A918C2782B65C9E7D33DC29F165D5607] () C:\Program Files\rempl\Logs\ServiceRemediation.009.etl
2018-11-16 09:44 - 2019-01-07 01:47 - 000131072 ____A [1A8BF0446566913D1FD116C6DC005218] () C:\Program Files\rempl\Logs\ServiceRemediation.010.etl
2018-11-16 09:44 - 2018-12-26 10:57 - 000065536 ____A [DE3A498310B834C70620BCF2F782A064] () C:\Program Files\rempl\Logs\ServiceRemediation.011.etl
2018-11-16 09:44 - 2018-12-23 17:03 - 000065536 ____A [BA84202676BE493C28E5EC133BCC0EDF] () C:\Program Files\rempl\Logs\ServiceRemediation.012.etl
2018-11-16 09:44 - 2018-12-23 16:59 - 000131072 ____A [769C3E71AE223C999D59D278E5731052] () C:\Program Files\rempl\Logs\ServiceRemediation.013.etl
2018-11-16 09:44 - 2018-12-21 02:07 - 000131072 ____A [BDA200EA8E9905F768909B3FB8868697] () C:\Program Files\rempl\Logs\ServiceRemediation.014.etl
2018-11-16 09:44 - 2018-12-20 14:52 - 000131072 ____A [641C9B1369CF403D8A7BB1A47DD85C54] () C:\Program Files\rempl\Logs\ServiceRemediation.015.etl
2018-11-16 09:44 - 2018-12-15 16:22 - 000131072 ____A [2A69FB7C516BE2955CAB3D00347A38C1] () C:\Program Files\rempl\Logs\ServiceRemediation.016.etl
2018-11-16 09:44 - 2018-12-15 15:15 - 000065536 ____A [E2AA0DFBA090EFA44AE461816BC142C4] () C:\Program Files\rempl\Logs\ServiceRemediation.017.etl
2018-11-16 09:44 - 2018-12-15 14:22 - 000065536 ____A [ED0C7F98DA76AD0A812611BEA8ECECD9] () C:\Program Files\rempl\Logs\ServiceRemediation.018.etl
2018-11-16 09:44 - 2018-12-13 17:49 - 000065536 ____A [A13D23A20266E4CDDDECFE9164CF95F0] () C:\Program Files\rempl\Logs\ServiceRemediation.019.etl
2018-11-16 09:44 - 2018-12-13 17:44 - 000131072 ____A [7A19AB462775520EE695DEA7ED25754D] () C:\Program Files\rempl\Logs\ServiceRemediation.020.etl
2018-11-16 09:44 - 2018-12-08 09:36 - 000131072 ____A [D9B6E411602DD5D51E7E1D8F6B24F185] () C:\Program Files\rempl\Logs\ServiceRemediation.021.etl
2018-11-16 09:44 - 2018-11-22 07:27 - 000065536 ____A [DF12AB3AA15A10DFE3AD8D7C26F5C2F3] () C:\Program Files\rempl\Logs\ServiceRemediation.022.etl
2018-11-16 09:44 - 2018-11-22 00:29 - 000196608 ____A [570BF28841AFB1EB8B195A708A96807E] () C:\Program Files\rempl\Logs\ServiceRemediation.023.etl

====== End of Folder: ======

C:\ProgramData\TEMP => ":58A5270D" ADS removed successfully
C:\Users\Public\Shared Files => ":VersionCache" ADS removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4C747352-DFE3-42CC-9CDA-6E4A6D5B845F}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{874565AC-CC23-4F43-9829-00B61FBC3587}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{CDC65CAE-DF99-4604-B10F-A07C45E4E43B}D:\игри\starcraft ii\versions\base71061\sc2_x64.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{0436E92A-359A-4A72-9BC0-98120D700805}D:\игри\starcraft ii\versions\base71061\sc2_x64.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{DB7C44BE-3310-479D-918C-3204CB6790CB}C:\users\vladi\downloads\downloader_diablo2_lord_of_destruction_enus.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{F215E1D4-E7E6-41B6-A13D-288F1A6D00FD}C:\users\vladi\downloads\downloader_diablo2_lord_of_destruction_enus.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{8B1E7ABC-2B26-40D2-BF83-F90617757C2A}C:\users\vladi\downloads\downloader_diablo2_enus (1).exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{C5B2F0DA-49FA-4959-9385-AE3181766ACF}C:\users\vladi\downloads\downloader_diablo2_enus (1).exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{52D2F5FA-3473-42B5-83C3-4C8B1EFA8614}C:\users\vladi\downloads\downloader_diablo2_enus.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{DAE615DB-F43A-4B2D-98B2-BB5E461E5F45}C:\users\vladi\downloads\downloader_diablo2_enus.exe" => removed successfully

========= del %temp%\*.* /f /s /q =========

Deleted file - C:\Users\Vladi\AppData\Local\Temp\2a65f440-c1f8-4c8e-a77b-8f824c09c534.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\3ab1e975-c451-43ee-b645-7640ad0c4331.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\4670c979-94e2-4bf8-907e-5fb081c37d42.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\7ecf5189-71c4-4608-98a1-4fd0f6e45030.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\8bd066d3-42a9-4ff6-9495-415093f9b816.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\adobegc.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-10760.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-11188.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-11608.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-12220.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-14060.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-14240.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-19244.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-3084.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-35316.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-35628.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-36984.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-37064.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-37832.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-3888.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-39696.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-40228.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-41612.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-42856.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-44300.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-44660.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-74632.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\aria-debug-8592.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\ashinet_B442E08F.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\chrome_installer.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\ecache.bin
Deleted file - C:\Users\Vladi\AppData\Local\Temp\f175b275-40a8-4739-941d-00d64986c502.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\f27e6b25-ee63-40f9-af8a-caf88eeb82e5.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\fno18dhjs
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Image_Resizer_for_Windows_20190115000849.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Image_Resizer_for_Windows_20190115000849_000_ImageResizer_x86.msi.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Image_Resizer_for_Windows_20190115000849_001_ImageResizer_x64.msi.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt1262.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt14E0.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt15E9.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt1A2C.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt1AF8.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt35F1.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt399F.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt3F98.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt48A9.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt48C8.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt61E9.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt78D2.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt8007.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt86B8.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgt8838.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtA47F.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtD1FC.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtDDA1.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtDE56.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtDF47.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtE3A9.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtE90C.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtF18.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtF5D1.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtFC9E.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\lgtFE46.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mb-clean-results.txt
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mb3-setup-consumer-3.5.1.2522-1.0.365-1.0.4968.exe
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mb_setup.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-qBitto-2d83-1-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-Viber-0-1-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-Viber-0-2-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-Viber-0-4-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-Viber-0-5-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-Viber-0-6-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\qtsingleapp-Viber-0-7-lockfile
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Setup Log 2019-01-19 #001.txt
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Setup Log 2019-01-19 #002.txt
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Setup Log 2019-01-19 #003.txt
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Setup Log 2019-01-19 #004.txt
Deleted file - C:\Users\Vladi\AppData\Local\Temp\StructuredQuery.log
Deleted file - C:\Users\Vladi\AppData\Local\Temp\test
Deleted file - C:\Users\Vladi\AppData\Local\Temp\tmpaddon
Deleted file - C:\Users\Vladi\AppData\Local\Temp\tmpaddon-96085
Deleted file - C:\Users\Vladi\AppData\Local\Temp\wct1928.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\wct1D82.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\wct1E24.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\wctD7EA.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\wctF14.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\139b-8b28-5d3d-7e8e\ie\p0b4c3115a4446533ea643007f860c4f6
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\AppxProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\AssocProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\CbsProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\CompatProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\DismCore.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\DismCorePS.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\DismHost.exe
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\DismProv.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\DmiProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\FfuProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\FolderProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\GenericProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\IBSProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\ImagingProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\IntlProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\LogProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\MsiProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\OfflineSetupProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\OSProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\ProvProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\SetupPlatformProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\SmiProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\SysprepProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\TransmogProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\UnattendProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\VhdProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\WimProvider.dll
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\AppxProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\AssocProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\CbsProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\CompatProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\DismCore.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\DismProv.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\DmiProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\FfuProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\FolderProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\GenericProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\IBSProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\ImagingProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\IntlProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\LogProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\MsiProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\OfflineSetupProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\OSProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\ProvProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\SetupPlatformProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\SmiProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\SysprepProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\TransmogProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\UnattendProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\VhdProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\2D8AD443-A0E1-4805-8BCA-C0D9C1641C1D\en-US\WimProvider.dll.mui
Deleted file - C:\Users\Vladi\AppData\Local\Temp\9WFQLUEr4qVgzpq5\b385232b4bb22f7d096bf88633b52ab9.exe
Deleted file - C:\Users\Vladi\AppData\Local\Temp\bsTempPath\ACD8835.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\CR_D010B.tmp\setup.exe
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Discord Crashes\operation_log.txt
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\3ca9678.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\3ca97e8.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\3f0bcd0.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\3f0bce0.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\434e1c0.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\434e200.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\434e210.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\434e2f0.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\c15480.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\mbam\qt-jl-icons\c154a0.ico
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir16848_27802\14e7cb37049d7fd65e36032a110ef3de.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir16904_5517\58fd2875d568072bcb10dfd70064bdc9.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir416_10469\942c842d271cee2501c2ac1a319c8f31.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir416_10469\acbf7002cee0b04daf2ff5c2cb156a4e.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir51172_7754\58fd2875d568072bcb10dfd70064bdc9.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir51172_7754\74744bcbb4eb8e81202b18768be08e1d.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir51172_7754\acbf7002cee0b04daf2ff5c2cb156a4e.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6772_28160\14e7cb37049d7fd65e36032a110ef3de.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\f27e6b25-ee63-40f9-af8a-caf88eeb82e5.tmp
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\128.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\manifest.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ar\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\bg\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ca\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\cs\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\da\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\de\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\el\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\en_GB\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\en_US\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\es\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\es_419\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\et\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\eu\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\fi\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\fil\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\fr\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\he\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\hi\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\hr\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\hu\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\id\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\it\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ja\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ko\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\lt\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\lv\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ms\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\nl\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\no\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\pl\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\pt_BR\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\pt_PT\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ro\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\ru\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\sk\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\sl\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\sr\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\sv\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\th\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\tr\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\uk\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\vi\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\zh_CN\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_locales\zh_TW\messages.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir6904_186\CRX_INSTALL\_metadata\verified_contents.json
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir8980_12632\14e7cb37049d7fd65e36032a110ef3de.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\scoped_dir8980_12632\942c842d271cee2501c2ac1a319c8f31.png
Deleted file - C:\Users\Vladi\AppData\Local\Temp\Viber Crashes\.id
Deleted file - C:\Users\Vladi\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Deleted file - C:\Users\Vladi\AppData\Local\Temp\~nsuA.tmp\Un_B.exe

========= End of CMD: =========

========= rd /s /q %temp% =========

========= End of CMD: =========

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

0 out of 0 jobs canceled.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-2956623404-1635080235-2419004971-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-2956623404-1635080235-2419004971-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01192019172904180\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully

========= End of RemoveProxy: =========

=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 302866105 B
Java, Flash, Steam htmlcache => 28178442 B
Windows/system/drivers => 1794614 B
Edge => 1486043 B
Chrome => 401778466 B
Firefox => 50343889 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 23626 B
LocalService => 0 B
LocalService => 0 B
NetworkService => 295686 B
NetworkService => 0 B
Vladi => 8057527 B

RecycleBin => 16592939 B
EmptyTemp: => 781.4 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 11:37:01 ====

Чудесно. Скрипта се е изпълнил коректно. Как е сега положението?

Ми, май пак си е така. Забелязвам, че в мозилата ми изкачат тия реклами, въпреки че я преинсталирах. 

Не би трябвало да е същото, защото премахнахме Bitcoinminer-a и поне би трябвало да не товари охлаждането.

А иначе не правете неща на своя глава докато имате тема тук, защото така може да пропусна някои детайли по време на почистващия процес.

• Изтеглете и стартирайте AdwCleaner 7.2.6.0 Final
• Натиснете бутона Scan Now (или Сканиране сега, ако ви е на български)

• AdwCleaner ще обнови базата с дефинициите си и ще започне да проверява компютъра. Проверката ще отнеме не повече от няколко секунди.
• След като проверката приключи ако има намерени обекти ще се появи диалогов прозорец подканващ ви да натиснете бутона Clean & Repair (Почисти & Поправи).
• Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.

• Ако не бъдат открити зарази ще видите следния прозорец:

• Натиснете бутона Skip Basic Repair (Пропускане на основното поправяне).
• И в двата случая ако няма открити зарази или ако програмата е почистила такива, стартирайте пак програмата и отидете до табът Log files (Журнални файлове на български, но превода не се събира в интерфейса на програмата и съм докладвал за проблема).
• Кликнете с двукратен клил на мишката върху лог файла с последната дата и част (новите файлове са най-отдолу в списъка) и публикувайте съдържанието на файла в следващия си коментар.

Благодаря много за съдействието. Определено ще е по-добре, но явно е останало нещо в мозилата...

http://prntscr.com/m9t9wy

Ето с нея какво излезе. 

Здравейте,

Аз искам да видя лог файла.

В инструкциите е споменато как да се извади лог файла след сканирането и почистването.

Поздрави!

Здрасти. Опитах се да редактирам снощи публикацията си, но не стана. Историята накратко.

След като минах с adwcleaner и лаптопа го рестартирах, след като се пусна, все едно бях инсталирал всички вируси обратно. Компа бозеше, като търсиш в гугъл ти излизаха първо 10 реклами преди реалното търсене, трагедия. Не знаех какво да правя и взех, че повторих нещата с оная програма и файла и всичко се нормализира. След това инсталирах NOD32 да видя какво се случва. Нода намери 4 заплахи, които премахнах.Не видях как да ги видя... или лог. Но при отваряне на браузера НОД-а блокира постоянно сайтове, потенциални вируси. Бях събрал 30 блокирания за 5 минути с Мозила. Според мен тия вируси се прикачват от сървър или веднага се пускат с браузерите. Явно това дето съм инсталирал е прикачено по някакъв начин към браузерите ми. По някаква причина се връщат. В момента след почистването с НОДА, гледам че не ми изкарва блокирано сайтове, но знае ли човек... Като цяло лиценза ще ми изтече сиа на 29 на НОДА и пак съм на вълците оставен.  Как се преебах само с това, дето инсталирах тогава, не е истина. :)))

Ще дам отново файловете.

Addition.txt

FRST.txt

adwscan.txt

adwclean.txt

 

Edit: Няколко снимки от сега, пак се започна след рестарт на компютъра.

http://prntscr.com/ma4zf9

Нещо не стана ясно...с коя програма сте минали и са се нормализирали нещата? С FRST? Ама със скрипта или без него, защото ако е без него FRST само сканира и нищо не поправя и няма как това да е оправило проблема. Това говорим за рекламите или за Bitcoinminer-a? Ако миньора се е върнал няма да е добре, но ако са само рекламите, то има просто обяснение. Ако използвате синхронизация на профила си в Mozilla с облака, след почистването на браузъра, заразите (рекламите) ще се върнат от копието в облака. Добре е да спрете временно синхронизацията (ако има такава) докато трае почистването.

Би било добре да покажете и какво е премахнал NOD32 все пак.

Предоставените лог файлове са чисти (поне миньора не се е върнал), но не се вижда и наличие на адуер в системата.

Видях обаче, че използвате доста пиратски софтуер и keygen-и (дори за Malwarebytes) и това не е добра идея, защото те често също са бъкани от зарази.

Как преинсталирахте Mozilla? Върху старата инсталация или премахнахте старата версия и инсталирахте новата?

Пробвахте ли да дадете първо Help => Troubleshooting information => Refresh Firefox... ?

Ако не се оправи от него просто я деинсталирайте например с Revo Uninstaller (като спрете синхронизацията с облака преди това) и я качете наново и вижте дали проблема остава.

Пишете за резултатите.

Здравейте. Да, програмите са ми пиратски, инсталирах ги само заради тоя проблем. Най-вероятно ще ги премахна след като им изтекат сроковете и ще търся някакво решение. 

Да, с FRST и файла, дето ми направихте, с него оправих нещата - повторно. 

Преинсталирах ги с унистал просто. И да, четох, че ако имам някаква синрхонизация, връща. Но аз нямам, в Хромето е изключена. Мозилата дори не съм я ползвал много-много.

http://prntscr.com/ma66ok

Ако говориме за това. Щом пише, Включване на синрхонизирането - явно не е включвано. 

Не, не трябва да я включвате. Точно трябва да стоят изключени синхронизациите.

Пробвайте да деинсталирате браузърите например с GeekUninstaller и след това ги инсталирайте наново.

Изтеглете програмата GeekUninstaller и я запазете на десктопа.

Разархивирайте я и стартирайте файла geek.exe
От списъка намерете Mozilla Firefox и Google Chrome  (примера е за Mozilla Firefox, но това е просто за показно).

Кликнете с десен бутон върху програмата и изберете Uninstall.
 

 
След края на инсталацията ще се отвори прозорец подканващ ви да премахнете всички остатъци от програмата (ако има такива, ако няма този прозорец няма да се появи):
 
Пример за Mozilla браузъра:

Уверете се, че всички редове са маркирани и натиснете бутона Finish за да изтриете останките от програмата.

Повторете и за Google Chrome и след това ги преинсталирайте.

Току-що я изтрих с нея, но не се появи прозорец. Инсталирах Revo unistaller Pro пробната:

http://prntscr.com/ma6jpt

 

Тя намери някакви остатъци. Трябва ли да маркирам тъмно черните и да дам Delete? Да не оплескам нещо... ;0

Натиснете Select All и после Delete. Повторете това и за прозореца с файловете (ако се появи такъв).

Като дам селект алл, то маркира всичко, не само тъмно черните.

http://prntscr.com/ma6qc4

Така ли трябва да стане, да не изтърка и повреди уиндолса? 

Да, това трябва да стане. Трябва да се изберат всички, не само черните...

Направих го и за Мозила и за Хроме като ги нсталирах отначало. Единственото, което направих е да влеза в гугъл акаунта си през Хроме. 

Нода веднага хвана някакъв сайт и го блокира...

http://prntscr.com/ma6vql

Да проверим за остатъци:

 

СТЪПКА 1

 

Моля изтеглете   Malwarebytes Anti-Malware 3.6.1.2711 Final и я запазете на вашия десктоп.

• Стартирайте файла mb3-setup-consumer-3.6.1.2711.exe и следвайте указанията за да инсталирате програмата.
• След като инсталацията приключи програмата ще стартира автоматично.
• Отидете до табът Settings => Protection > и под категорията Scan Options включете опцията "Scan for rootkits" като преместите плъзгача надясно.

• Отидете до табът Scan, и изберете Threat Scan и след това натиснете бутона Start Scan.

• Ще започне проверка за зловреден софтуер.

• При някои инфекции можете да видите съобщението:
• "Could not load DDA driver"
• Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
• Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
• След като проверката приключи ще се появи списъка с резултатите (ако има намерени обекти). Ако програмата е минимизирана докато сканира ще се появи следното съобщение ако има открити заплахи. Натиснете бутона View Scan Results.

• . Натиснете бутона Quarantine Selected.

• Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.

• След рестарта, стартирайте отново Malwarebytes Anti-Malware.
• Отидете то табът Reports и отворете лог файла с името Scan Report.

• Натиснете бутона Export и след това =>  "Copy to Clipboard"

Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + V и го публикувайте в следващия си коментар.

 

СТЪПКА 2

 

1.Изтеглете Hitman Pro.

За 32-битова система - .
За 64-битова система -

2.Стартирайте програмата.
3.След като сте стартирали програмата като кликнете върху иконата и натиснете бутона „Напред“ като се съгласите с лицензионното споразумение (EULA).

4.Сложете отметка пред "Не, искам да завърша еднократно сканиране на компютъра".

5.Натиснете бутона „Напред“.

6.Програмата ще започне да сканира. Времето за сканиране е около 2 минути.

7.След завършване на сканирането от списъка с намерените неща (ако има такива) изберете Apply to all => Ignore.

8.Натиснете "Next" и след това натиснете "Изнеси резултата в XML file" и запазете лог файла на десктопа.

9.Архивирайте файла и го прикачете в следващия си коментар или копирайте съдържанието му в следващия си коментар.
 
Забележка: Ако няма падащо меню, където да изберете ignore както на снимката:
 

 
Тогава просто затворете програмата след края на проверката (без да премахвате нищо)...след това отворете C:\Programdata\HitmanPro\Logs, отворете и публикувайте съдържанието на лог файла в следващия си коментар. Пак повтарям, не трийте нищо с програмата, защото е доста мощна и може да бъде опасна!

Забележка: Папката C:\ProgramData е скрита и затова трябва да направите скритите файлове видими по-следния начин:

От My Computer => Tools => Folder Options => View:

Сложете отметка пред "Show hidden files, folders and drives"

и махнете отметката пред "Hide protected operating system files (recommended)".

Натиснете Apply.

Сега проверете за лог файла в папката C:\Programdata\HitmanPro\Logs и го прикачете в следващия си коментар.

 

СТЪПКА 3

 

• Моля изтеглете EmsisoftEmergencyKit, стартирайте exe файла и посочете къде да се разархивира програмата - например в (C:\EEK), натискайки бутона Extract.
• Стартирайте иконата на файла Start Emsisoft Emergency Kit от десктопа за да стартирате приложението.
• Натиснете бутона"Yes", когато бъдете подканени да обновите дефинициите на програмата.
• След като процеса по обновяването на дефинициите приключи натиснете бутона "Scan".
• Натиснете бутона "Yes", когато бъдете попитани дали да програмата да включи засичането на потенциално нежелани приложения (Potentially Unwanted Applications).
• Сега вече изберете бутона Custom Scan. Премахнете от списъка всички дялове без C:\ (т.е. нека да остане само дял C:\ в списъка).
• Натиснете Next за да започне проверката.
• Когато проверката приключи натиснете бутона View Report.
• Копирайте съдържанието на лог файла в следващия си коментар.

 

Поздрави!

Така. Malwarebyes не намери нищо, освен че ми блокираше някакви сайтове от уторента. Прикачил съм файл за него и за другите, като с последната стъпка дадох направи Изтрий, защото тия файлове ги знам и не ми трябват.

Emisoft.txt

HitmanPro_20190121_2017.log

utorrent.txt