Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Засякох Троянец!

ivan_pop
в Премахване на зловреден софтуер

Featured Replies

Здравейте!

Засякох Троянец който изтрих.Ако може една проверка за вируси?

Win8.1/32bit

Нямам оплаквания от работата на компютъра(лаптоп).

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-03-2019
Ran by Vanka (administrator) on IVAN (27-03-2019 19:24:51)
Running from C:\Users\Vanka\Desktop
Loaded Profiles: Vanka (Available Profiles: Vanka)
Platform: Microsoft Windows 8.1 Enterprise (Update) (X86) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() [File not signed] C:\Program Files\Realtek\REALTEK Bluetooth\BTDevMgr.exe
(CrypKey (Canada) Ltd.) [File not signed] C:\Windows\System32\Crypserv.exe
(Digital Wave Ltd -> Digital Wave Ltd.) C:\Program Files\Common Files\DVDVideoSoft\lib\app_updater.exe
(CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed] C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe
(SafeNet Canada, Inc. -> SafeNet, Inc.) C:\Windows\System32\hasplms.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(VMware, Inc. -> VMware, Inc.) C:\Windows\System32\vmnat.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\pg_ctl.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files\VMware\VMware Player\vmware-authd.exe
(VMware, Inc. -> VMware, Inc.) C:\Windows\System32\vmnetdhcp.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(SafeNet Canada, Inc. -> SafeNet, Inc.) C:\Windows\System32\hasplmv.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\vds.exe
(HP Inc. -> HP Inc.) C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CHENGDU YIWO Tech Development Co., Ltd. -> ) [File not signed] C:\Program Files\EaseUS\Todo Backup\bin\TodoBackupService.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [VIDC.VMnc] => C:\Windows\system32\vmnc.dll [360528 2013-02-26] (VMware, Inc. -> VMware, Inc.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-26] (Google LLC -> Google Inc.)
GroupPolicy: Restriction ? <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{77F6F871-16E3-4748-90A7-7C5866B35451}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-3136552650-2365130857-356673686-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-3136552650-2365130857-356673686-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2018-10-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2018-07-18] (Microsoft Corporation -> Microsoft Corporation)
IE Session Restore: HKU\S-1-5-21-3136552650-2365130857-356673686-1001 -> is enabled.
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2018-03-14] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 0r0ddk0y.default-1538076306800
FF ProfilePath: C:\Users\Vanka\AppData\Roaming\Mozilla\Firefox\Profiles\0r0ddk0y.default-1538076306800 [2019-03-04]
FF Extension: (Telemetry coverage) - C:\Users\Vanka\AppData\Roaming\Mozilla\Firefox\Profiles\0r0ddk0y.default-1538076306800\features\{0276cc46-1c6e-4fb5-90cb-58f820b6e0bd}\[email protected] [2018-09-27] [Legacy]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-10-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-24] (Google Inc -> Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-24] (Google Inc -> Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN -> VideoLAN)

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/?hl=bg
CHR DefaultSearchURL: Default -> hxxps://www.google.bg/search?source=hp&ei=puTaW6nkGcuVkwWo3pvwCA&btnG=%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5&q={searchTerms}&oq=BiGas+&gs_l=psy-ab.1.1.0l10.228878.235855.0.240374.6.6.0.0.0.0.119.511.5j1.6.0....0...1c.1.64.psy-ab..0.6.509...0i10k1.0.M9MP0hQ3K4s
CHR Profile: C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default [2019-03-27]
CHR Extension: (Презентации) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-12-24]
CHR Extension: (Документи) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-12-24]
CHR Extension: (Google Диск) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-12-24]
CHR Extension: (MEGA) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\bigefpfhnfcobdlfbedofhhaibnlghod [2019-03-24]
CHR Extension: (YouTube) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-12-24]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2019-03-13]
CHR Extension: (I don't care about cookies) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\fihnjjcciajhdojfnbdddfaoknhalnja [2019-03-13]
CHR Extension: (Google Документи офлайн) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-24]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-12-24]
CHR Extension: (Gmail) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-12-24]
CHR Extension: (Chrome Media Router) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-03-26]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [209408 2014-07-22] (Microsoft Windows Hardware Compatibility Publisher -> AMD)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2014-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 BTDevManager; C:\Program Files\REALTEK\Realtek Bluetooth\BTDevMgr.exe [88064 2014-10-09] () [File not signed]
R2 CrypKey License; C:\Windows\system32\crypserv.exe [126976 2010-03-18] (CrypKey (Canada) Ltd.) [File not signed]
R2 DigitalWave.Update.Service; C:\Program Files\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-03-22] (Digital Wave Ltd -> Digital Wave Ltd.)
R2 EaseUS Agent; C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe [37416 2015-06-23] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 hasplms; C:\Windows\system32\hasplms.exe [4295208 2017-07-07] (SafeNet Canada, Inc. -> SafeNet, Inc.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [347512 2018-12-06] (HP Inc. -> HP Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe [254680 2015-05-05] (Realtek Semiconductor Corp -> Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [208040 2015-05-07] (Synaptics Incorporated -> Synaptics Incorporated)
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [11665136 2019-01-16] (TeamViewer GmbH -> TeamViewer GmbH)
R2 VMAuthdService; C:\Program Files\VMware\VMware Player\vmware-authd.exe [87120 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMnetDHCP; C:\Windows\system32\vmnetdhcp.exe [357456 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMUSBArbService; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [721048 2012-10-11] (VMware, Inc. -> VMware, Inc.)
R2 VMware NAT Service; C:\Windows\system32\vmnat.exe [436304 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [280872 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103696 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
R2 WorkshopDbService; "C:\Program Files\ATRis_Technik\pgsql\bin\pg_ctl.exe" runservice  -N WorkshopDbService -D "C:\ProgramData\WorkshopData\data2" -w 

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aksfridge; C:\Windows\system32\drivers\aksfridge.sys [450904 2017-07-07] (SafeNet, Inc. -> SafeNet, Inc.)
R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [15080 2013-10-24] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, INC.)
R3 amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [11529216 2014-07-22] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [501248 2014-07-22] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [16088 2013-08-13] (Broadcom Corporation -> Windows (R) Win 7 DDK provider)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [26168 2016-01-28] (Disc Soft Ltd -> Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [40504 2016-01-28] (Disc Soft Ltd -> Disc Soft Ltd)
R0 EUBAKUP; C:\Windows\System32\drivers\eubakup.sys [51752 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [41512 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> ) [File not signed]
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [15912 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R1 EUFDDISK; C:\Windows\system32\drivers\EuFdDisk.sys [189992 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 eusk2par; C:\Windows\system32\Drivers\eusk2par.sys [25680 2008-12-18] (Aladdin Knowledge Systems LTD  -> Aladdin Knowledge Systems Ltd.)
S3 FTDIBUS; C:\Windows\system32\drivers\autrbus.sys [47249 2006-05-18] (Microsoft Windows Hardware Compatibility Publisher -> FTDI Ltd.)
S3 FTSER2K; C:\Windows\system32\drivers\autrser2k.sys [61067 2006-05-18] (Microsoft Windows Hardware Compatibility Publisher -> FTDI Ltd.)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [606760 2017-07-07] (SafeNet Canada, Inc. -> SafeNet, Inc.)
R2 hcmon; C:\Windows\system32\drivers\hcmon.sys [41496 2012-10-11] (VMware, Inc. -> VMware, Inc.)
S3 iaioi2c; C:\Windows\System32\drivers\iaioi2c.sys [61936 2013-07-23] (MCG Windows Development and Validation -> Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [524784 2013-08-10] (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation)
S3 MDA_NTDRV; C:\Windows\system32\MDA_NTDRV.sys [31224 2019-01-25] (Bada Technology Co.,Ltd -> )
R1 NetworkX; C:\Windows\System32\ckldrv.sys [23360 2010-03-19] (CrypKey (Canada) Inc. -> )
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [525568 2015-06-02] (Realtek Semiconductor Corp -> Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [5357056 2016-12-29] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corporation )
S3 Ser2pl; C:\Windows\system32\DRIVERS\ser2pl.sys [211648 2018-11-28] (WDKTestCert charles-yeh,131345514351795974 -> Prolific Technology Inc.)
S3 Ser2plx86; C:\Windows\system32\DRIVERS\ser2pl.sys [211648 2018-11-28] (WDKTestCert charles-yeh,131345514351795974 -> Prolific Technology Inc.)
R3 SmbDrv; C:\Windows\system32\DRIVERS\Smb_driver_AMDASF.sys [25768 2015-05-07] (Synaptics Incorporated -> Synaptics Incorporated)
S3 SNTNLUSB; C:\Windows\System32\drivers\SNTNLUSB.SYS [38376 2009-09-17] (SafeNet, Inc. -> SafeNet, Inc.)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [685816 2018-05-30] (Duplex Secure Ltd -> Duplex Secure Ltd.)
R3 vmkbd; C:\Windows\system32\drivers\VMkbd.sys [26064 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 VMnetAdapter; C:\Windows\system32\DRIVERS\vmnetadapter.sys [16664 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMnetBridge; C:\Windows\system32\DRIVERS\vmnetbridge.sys [37016 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMnetuserif; C:\Windows\system32\drivers\vmnetuserif.sys [26192 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 vmusb; C:\Windows\System32\Drivers\vmusb.sys [31280 2012-10-11] (VMware, Inc. -> VMware, Inc.)
R2 vmx86; C:\Windows\system32\Drivers\vmx86.sys [62416 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S1 vtzkusmf; C:\Windows\system32\drivers\vtzkusmf.sys [63448 2019-03-26] (Microsoft Corporation -> Microsoft Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [38920 2017-02-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [231256 2017-01-12] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [85336 2017-01-12] (Microsoft Windows -> Microsoft Corporation)
S3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver86.sys [29792 2016-03-23] (Hewlett-Packard Company -> HP)
R3 WirelessButtonDriver86; C:\Windows\System32\drivers\WirelessButtonDriver86.sys [29792 2016-03-23] (Hewlett-Packard Company -> HP)
S3 WUDFWpdMtp; C:\Windows\system32\DRIVERS\WUDFRd.sys [190976 2014-11-21] (Microsoft Windows -> Microsoft Corporation)
S3 audas0; \SystemRoot\System32\drivers\audas0.sys [X]
S3 BlueletAudio; \SystemRoot\system32\DRIVERS\blueletaudio.sys [X]
S3 BlueletSCOAudio; \SystemRoot\system32\DRIVERS\BlueletSCOAudio.sys [X]
S3 BT; \SystemRoot\system32\DRIVERS\btnetdrv.sys [X]
S3 btaudio; \SystemRoot\system32\drivers\btaudio.sys [X]
S3 BTDriver; \SystemRoot\system32\DRIVERS\btport.sys [X]
S0 BTHidEnum; System32\Drivers\vbtenum.sys [X]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [X]
S3 BTKRNL; \SystemRoot\system32\DRIVERS\btkrnl.sys [X]
S3 BTWDNDIS; \SystemRoot\system32\DRIVERS\btwdndis.sys [X]
S3 BTWUSB; \SystemRoot\System32\Drivers\btwusb.sys [X]
S3 VComm; \SystemRoot\system32\DRIVERS\VComm.sys [X]
S3 VcommMgr; \SystemRoot\System32\Drivers\VcommMgr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-03-27 19:24 - 2019-03-27 19:26 - 000019663 _____ C:\Users\Vanka\Desktop\FRST.txt
2019-03-27 19:24 - 2019-03-27 19:24 - 000000000 ____D C:\FRST
2019-03-27 19:22 - 2019-03-27 19:22 - 001793024 _____ (Farbar) C:\Users\Vanka\Desktop\FRST.exe
2019-03-26 10:10 - 2019-03-26 10:10 - 000063448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vtzkusmf.sys
2019-03-25 23:18 - 2019-03-25 23:18 - 000009680 _____ C:\Users\Vanka\AppData\Local\Tempastraheobd_dba_ellemeet.svgz
2019-03-25 21:49 - 2019-03-25 21:49 - 000002045 _____ C:\Users\Vanka\Desktop\HynesPro.lnk
2019-03-25 21:41 - 2019-03-25 21:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ATRis_Technik
2019-03-25 21:32 - 2019-03-25 21:46 - 000000000 ____D C:\Program Files\ATRis_Technik
2019-03-25 21:32 - 2011-04-18 20:54 - 000941568 _____ (Igor Pavlov) C:\ProgramData\7z.dll
2019-03-25 21:32 - 2011-04-18 20:34 - 000168448 _____ (Igor Pavlov) C:\ProgramData\7z.exe
2019-03-25 21:29 - 2019-03-25 21:29 - 000000295 _____ C:\Windows\Atris_STG.INI
2019-03-25 21:29 - 2019-03-25 21:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ATRis STAHLGRUBER DVD
2019-03-25 21:16 - 2019-03-25 21:16 - 000000000 ____D C:\ATRIS_ST
2019-03-25 20:40 - 2019-03-26 14:30 - 000144625 _____ C:\Users\Vanka\wirdia.svg
2019-03-23 20:12 - 2019-03-23 20:12 - 000643330 _____ C:\Users\Vanka\Desktop\nastroiki_W-router_DK.pdf
2019-03-22 20:39 - 2019-03-06 08:41 - 005679864 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2019-03-22 20:39 - 2019-03-06 08:40 - 001407120 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2019-03-22 20:39 - 2019-03-06 08:40 - 001297088 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2019-03-22 20:39 - 2019-03-06 08:40 - 001281072 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2019-03-22 20:39 - 2019-03-06 08:40 - 001181944 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2019-03-22 20:39 - 2019-03-06 07:51 - 003450368 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2019-03-22 20:39 - 2019-03-06 07:37 - 003617280 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2019-03-22 20:39 - 2019-03-06 06:39 - 002464256 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2019-03-22 20:39 - 2019-02-26 09:25 - 020281856 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2019-03-22 20:39 - 2019-02-26 09:07 - 000498176 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2019-03-22 20:39 - 2019-02-26 09:04 - 002295808 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2019-03-22 20:39 - 2019-02-26 08:57 - 000663040 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2019-03-22 20:39 - 2019-02-26 08:36 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2019-03-22 20:39 - 2019-02-26 08:35 - 004494848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2019-03-22 20:39 - 2019-02-26 08:31 - 000696320 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2019-03-22 20:39 - 2019-02-26 08:29 - 013681664 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2019-03-22 20:39 - 2019-02-26 08:12 - 004386304 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2019-03-22 20:39 - 2019-02-26 08:09 - 001332224 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2019-03-22 20:39 - 2019-02-26 08:07 - 000710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2019-03-22 20:39 - 2019-02-20 22:17 - 000313344 _____ (Microsoft Corporation) C:\Windows\system32\msrd2x40.dll
2019-03-22 20:39 - 2019-02-15 21:51 - 000449744 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2019-03-22 20:39 - 2019-02-15 21:51 - 000413576 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2019-03-22 20:39 - 2019-02-09 20:26 - 000333560 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2019-03-22 20:39 - 2019-02-09 20:21 - 001683400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2019-03-22 20:39 - 2019-02-09 18:45 - 000367104 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2019-03-22 20:39 - 2019-02-09 18:14 - 000879616 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2019-03-22 20:39 - 2019-02-09 02:33 - 001901888 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2019-03-22 20:39 - 2019-02-09 01:07 - 000889344 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2019-03-22 20:39 - 2019-02-09 01:07 - 000614040 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2019-03-22 20:39 - 2019-02-08 23:29 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2019-03-22 20:39 - 2019-02-08 19:50 - 001493504 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2019-03-22 20:39 - 2019-02-08 19:45 - 001556992 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2019-03-22 20:39 - 2019-02-07 02:34 - 001070456 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2019-03-22 20:39 - 2019-02-07 02:34 - 000849216 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2019-03-22 20:39 - 2019-02-06 20:29 - 000575488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2019-03-22 20:39 - 2019-02-01 06:25 - 001839344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2019-03-22 20:39 - 2019-01-08 07:12 - 001489704 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 001387520 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000617984 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000593408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000524800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000377856 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000361472 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000254464 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000205312 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2019-03-22 20:38 - 2019-03-06 07:52 - 000027392 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2019-03-22 20:38 - 2019-02-26 08:41 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2019-03-22 20:38 - 2019-02-26 08:39 - 000279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2019-03-22 20:38 - 2019-02-26 08:39 - 000128000 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2019-03-22 20:38 - 2019-02-26 08:33 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2019-03-22 20:38 - 2019-02-26 08:31 - 002059776 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2019-03-22 20:38 - 2019-02-26 08:31 - 000333312 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2019-03-22 20:38 - 2019-02-26 08:20 - 001049600 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2019-03-22 20:38 - 2019-02-15 21:51 - 000033504 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2019-03-22 20:38 - 2019-02-15 21:50 - 000372328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2019-03-22 20:38 - 2019-02-09 20:29 - 000178632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2019-03-22 20:38 - 2019-02-09 19:21 - 000260096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2019-03-22 20:38 - 2019-02-09 19:21 - 000163840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2019-03-22 20:38 - 2019-02-09 19:21 - 000073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdfs.sys
2019-03-22 20:38 - 2019-02-09 19:19 - 000229888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2019-03-22 20:38 - 2019-02-09 18:43 - 000730624 _____ (Microsoft Corporation) C:\Windows\system32\pmcsnap.dll
2019-03-22 20:38 - 2019-02-09 18:16 - 000399360 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2019-03-22 20:38 - 2019-02-08 20:32 - 000044544 _____ (Microsoft Corporation) C:\Windows\system32\mf3216.dll
2019-03-22 20:38 - 2019-02-07 20:35 - 000098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2019-03-22 20:38 - 2019-02-06 20:30 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
2019-03-22 20:38 - 2019-02-06 20:30 - 000023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msfs.sys
2019-03-22 20:38 - 2019-02-06 20:29 - 000337920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2019-03-22 20:38 - 2019-02-06 20:28 - 000187392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2019-03-22 20:38 - 2019-01-09 05:52 - 000038912 _____ (Microsoft Corporation) C:\Windows\system32\hcproviders.dll
2019-03-22 20:38 - 2019-01-09 05:45 - 000530432 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenterCPL.dll
2019-03-22 20:38 - 2019-01-09 05:40 - 000839680 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2019-03-22 20:38 - 2019-01-05 09:31 - 000131344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2019-03-22 19:56 - 2019-03-22 19:56 - 024718688 _____ ( ) C:\Users\Vanka\Downloads\AdbeRdr812_ru_RU.exe
2019-03-22 19:56 - 2019-03-22 19:56 - 015382749 _____ C:\Users\Vanka\Downloads\CAD-KAS  PDFEditor 5.5 Pro.rar
2019-03-21 18:05 - 2019-03-21 18:06 - 000000000 ____D C:\Users\Vanka\AppData\Local\Viber
2019-03-21 13:06 - 2019-03-21 13:06 - 000002511 _____ C:\Users\Public\Desktop\EmmeGas MULTI IC.lnk
2019-03-21 13:06 - 2019-03-21 13:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EmmeGas
2019-03-21 10:13 - 2019-03-21 10:16 - 000001139 _____ C:\Users\Public\Desktop\LPGTECH Gas Setting 2.0.lnk
2019-03-21 10:13 - 2019-03-21 10:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LPGTECH Gas Setting 2.0
2019-03-21 10:13 - 2019-03-21 10:16 - 000000000 ____D C:\Program Files\LPGTECH Gas Setting 2.0
2019-03-20 12:08 - 2019-03-20 12:08 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Livecare
2019-03-20 12:08 - 2019-03-20 12:08 - 000000000 ____D C:\Users\Vanka\AppData\LocalLow\livecare
2019-03-20 12:08 - 2019-03-20 12:08 - 000000000 ____D C:\ProgramData\Livecare
2019-03-20 12:03 - 2019-03-20 12:03 - 000000000 ____D C:\Users\Vanka\AppData\Local\Zavoli
2019-03-20 12:02 - 2019-03-20 12:06 - 000001567 _____ C:\Users\Public\Desktop\Zavoli.lnk
2019-03-20 12:02 - 2019-03-20 12:02 - 000000000 ____D C:\Zavoli
2019-03-19 21:09 - 2019-03-19 21:09 - 000013424 _____ C:\Users\Vanka\Downloads\FI202049G34.rar
2019-03-19 21:06 - 2019-03-19 21:06 - 000059444 _____ C:\Users\Vanka\Desktop\LR202043G34.rar
2019-03-19 20:37 - 2019-03-19 20:37 - 000000000 _____ C:\Windows\TCULR.INI
2019-03-17 21:02 - 2019-03-17 21:02 - 000179937 _____ C:\Users\Vanka\Downloads\А10.pdf
2019-03-17 20:31 - 2019-03-17 20:32 - 009824545 _____ C:\Users\Vanka\Downloads\Opel pin.rar
2019-03-17 20:30 - 2019-03-17 20:30 - 016930062 _____ C:\Users\Vanka\Downloads\VIN to PIN Opel.rar
2019-03-13 18:35 - 2019-03-13 18:41 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BlueEnergy
2019-03-13 18:35 - 2019-03-13 18:35 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\BlueEnergy
2019-03-13 18:35 - 2019-03-13 18:35 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Blue Energy
2019-03-13 18:35 - 2019-03-13 18:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueEnergy
2019-03-13 18:26 - 2019-03-13 18:34 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BluePower
2019-03-13 18:26 - 2019-03-13 18:26 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\BluePower
2019-03-13 18:26 - 2019-03-13 18:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BluePower
2019-03-07 14:35 - 2019-03-07 14:41 - 000000000 ____D C:\Program Files\Simgas2
2019-03-07 14:35 - 2019-03-07 14:35 - 000000911 _____ C:\Users\Vanka\Desktop\Simgas2.lnk
2019-03-07 14:35 - 2019-03-07 14:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Simgas2
2019-03-07 14:34 - 2019-03-07 14:34 - 000001001 _____ C:\Users\Vanka\Desktop\Simgas+.lnk
2019-03-07 14:34 - 2019-03-07 14:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimgasPlus
2019-03-07 14:34 - 2019-03-07 14:34 - 000000000 ____D C:\Program Files\SimgasPlus
2019-03-05 18:23 - 2019-03-05 18:23 - 000001799 _____ C:\Users\Public\Desktop\AIS.lnk
2019-03-05 18:23 - 2019-03-05 18:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Romano s.r.l
2019-03-05 18:23 - 2019-03-05 18:23 - 000000000 ____D C:\Program Files\AIS
2019-03-04 12:42 - 2019-03-04 12:42 - 000002505 _____ C:\Users\Public\Desktop\Alex Sequential Injection System CAD.lnk
2019-03-04 12:42 - 2019-03-04 12:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alex
2019-03-03 15:30 - 2019-03-03 15:30 - 058773809 _____ C:\Users\Vanka\Downloads\T-NT14LDEUC_1042.0.exe
2019-03-03 14:36 - 2019-03-03 14:36 - 000000024 _____ C:\Users\Vanka\Desktop\nasko12233.txt
2019-02-28 18:21 - 2019-02-28 18:21 - 000001545 _____ C:\Users\Vanka\Desktop\VAUXCOM.exe - Shortcut.lnk
2019-02-28 18:19 - 2019-02-28 18:20 - 000000000 ____D C:\Program Files\WaxCom
2019-02-28 13:02 - 2019-02-28 13:03 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\AcGasSynchro II
2019-02-28 12:54 - 2019-02-28 12:54 - 000001046 _____ C:\Users\Vanka\Desktop\ACGasSynchro 11.2.1.1.lnk
2019-02-28 12:54 - 2019-02-28 12:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcGasSynchro II
2019-02-28 12:54 - 2019-02-28 12:54 - 000000000 ____D C:\Program Files\AcGasSynchro II
2019-02-28 12:42 - 2019-02-28 12:42 - 002938908 _____ C:\Users\Vanka\Downloads\ver2_8_9_RU_PREMIUM_manual.pdf
2019-02-27 20:21 - 2019-02-27 20:22 - 000000353 _____ C:\Users\Vanka\Desktop\STOP-updates.txt

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-03-27 19:24 - 2018-04-25 19:40 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\ViberPC
2019-03-27 18:36 - 2018-05-30 22:31 - 000000000 ____D C:\ADCDA2
2019-03-26 21:42 - 2015-12-25 14:45 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\uTorrent
2019-03-26 13:48 - 2018-12-24 14:34 - 000002188 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-03-26 13:48 - 2018-12-24 14:34 - 000002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-03-25 23:13 - 2013-08-22 08:13 - 000000187 _____ C:\Windows\win.ini
2019-03-25 23:12 - 2019-01-29 19:09 - 000000000 ____D C:\Program Files\TeamViewer
2019-03-25 23:12 - 2018-07-13 16:20 - 000000000 ____D C:\ProgramData\VMware
2019-03-25 23:12 - 2013-08-22 09:23 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-03-25 22:51 - 2015-12-14 02:55 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\vlc
2019-03-25 22:26 - 2015-12-12 05:09 - 000000000 ____D C:\Users\Vanka\AppData\Local\Packages
2019-03-25 21:32 - 2016-10-30 16:20 - 000000000 ____D C:\ProgramData\WorkshopData
2019-03-25 21:29 - 2016-10-30 16:19 - 000000626 _____ C:\Windows\ODBC.INI
2019-03-25 21:29 - 2016-10-30 16:19 - 000000295 _____ C:\Windows\Atris_St.INI
2019-03-25 20:49 - 2013-08-22 08:21 - 000000000 ____D C:\Windows\inf
2019-03-25 20:40 - 2018-11-26 15:12 - 000000000 ____D C:\Users\Vanka
2019-03-24 14:34 - 2013-08-22 10:17 - 000000000 ____D C:\Windows\rescache
2019-03-23 10:39 - 2018-01-25 19:32 - 000000000 ____D C:\ProgramData\MCShield
2019-03-22 21:06 - 2013-08-22 09:22 - 000481584 _____ C:\Windows\system32\FNTCACHE.DAT
2019-03-22 21:04 - 2013-08-22 08:13 - 000262144 ___SH C:\Windows\system32\config\BBI
2019-03-22 21:01 - 2015-04-14 23:41 - 000000000 ____D C:\Windows\system32\appraiser
2019-03-22 21:01 - 2014-11-21 07:42 - 000000000 ___SD C:\Windows\system32\CompatTel
2019-03-22 21:01 - 2013-08-22 10:17 - 000000000 ___RD C:\Windows\ToastData
2019-03-22 20:53 - 2013-08-22 10:05 - 000000000 ____D C:\Windows\CbsTemp
2019-03-22 20:33 - 2018-12-12 09:01 - 000513376 _____ C:\Windows\system32\locale.nls
2019-03-21 18:05 - 2018-04-25 19:48 - 000000000 ____D C:\Users\Vanka\Documents\ViberDownloads
2019-03-21 13:06 - 2018-06-30 10:30 - 000000000 ____D C:\Program Files\MultipointInj
2019-03-20 12:47 - 2017-08-21 11:56 - 000000000 ____D C:\Users\Vanka\AppData\Local\SequentPD
2019-03-20 12:47 - 2017-05-12 22:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BRC Gas Equipment
2019-03-20 12:06 - 2018-06-30 10:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zavoli
2019-03-19 21:30 - 2015-12-13 04:41 - 000000000 ___HD C:\Program Files\InstallShield Installation Information
2019-03-19 20:27 - 2016-10-30 16:19 - 000000588 _____ C:\Windows\ODBCINST.INI
2019-03-19 19:55 - 2018-06-10 09:55 - 000000000 ____D C:\Program Files\KME
2019-03-13 11:33 - 2014-11-21 05:17 - 000869216 _____ C:\Windows\system32\PerfStringBackup.INI
2019-03-12 19:02 - 2019-01-22 21:20 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Skype
2019-03-12 17:55 - 2013-08-22 10:17 - 000000000 ____D C:\Windows\system32\Macromed
2019-03-05 18:23 - 2019-02-18 21:16 - 000000000 ____D C:\ProgramData\AntonioInjectionSystem
2019-03-05 18:23 - 2018-11-18 13:30 - 000000000 ____D C:\Users\Vanka\AppData\Local\Downloaded Installations
2019-03-04 21:52 - 2018-07-15 16:10 - 000000000 ____D C:\Users\Vanka\AppData\LocalLow\Mozilla
2019-03-04 12:42 - 2018-12-18 21:40 - 000000000 ____D C:\Program Files\Chiave Hardware Eutron
2019-03-03 09:04 - 2015-12-25 18:58 - 000000000 ____D C:\Users\Vanka\AppData\Local\ElevatedDiagnostics
2019-03-02 12:26 - 2018-06-30 10:30 - 000000000 ____D C:\Users\Vanka\Documents\MultipointInj
2019-02-25 21:28 - 2018-07-13 16:23 - 000000000 ____D C:\Users\Vanka\AppData\Local\VMware
2019-02-25 21:25 - 2013-08-22 10:17 - 000000000 ____D C:\Windows\system32\FxsTmp
2019-02-25 21:23 - 2018-07-13 16:23 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\VMware

==================== Files in the root of some directories =======

2019-03-25 21:32 - 2011-04-18 20:54 - 000941568 _____ (Igor Pavlov) C:\ProgramData\7z.dll
2019-03-25 21:32 - 2011-04-18 20:34 - 000168448 _____ (Igor Pavlov) C:\ProgramData\7z.exe
2018-07-02 11:56 - 2005-06-29 14:39 - 000617472 _____ () C:\Program Files\AUTRONIT.EX_
2018-07-02 11:56 - 2002-03-21 10:29 - 000289056 _____ () C:\Program Files\HDSETUP.EX_
2018-07-02 11:56 - 2002-03-21 10:29 - 000006656 _____ () C:\Program Files\SETUP.EXE
2018-07-02 11:56 - 2005-06-29 13:00 - 000000633 _____ () C:\Program Files\SETUP.INF
2018-07-02 11:56 - 2005-06-29 08:32 - 000000407 _____ () C:\Program Files\UNINSTAL.INF
2018-07-02 11:56 - 2005-06-29 11:00 - 000000004 _____ () C:\Program Files\XMON.CF_
2018-07-02 11:56 - 2005-04-27 08:59 - 000000195 _____ () C:\Program Files\XMON.DE_
2018-07-02 11:56 - 2005-06-30 14:16 - 000009832 _____ () C:\Program Files\Xmon.di_
2018-06-20 17:13 - 2018-12-09 15:27 - 000000071 _____ () C:\Users\Vanka\AppData\Local\DiegoG3-3.0.8.2.INI
2019-03-25 23:18 - 2019-03-25 23:18 - 000009680 _____ () C:\Users\Vanka\AppData\Local\Tempastraheobd_dba_ellemeet.svgz
2016-10-30 19:29 - 2016-10-30 19:29 - 000009612 _____ () C:\Users\Vanka\AppData\Local\Temppicasso eobd_dba_ellemeet.svgz

Some files in TEMP:
====================
2019-03-25 20:34 - 2019-03-26 14:16 - 000003584 _____ () C:\Users\Vanka\AppData\Local\Temp\dateinj01.dll
2019-01-27 14:31 - 2013-07-29 13:40 - 000086392 _____ () C:\Users\Vanka\AppData\Local\Temp\dp-chooser.exe
2019-01-27 14:31 - 2013-07-29 13:41 - 000676288 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\dpinst-amd64.exe
2019-01-27 14:31 - 2013-07-29 13:41 - 000550848 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\dpinst-x86.exe
2009-07-13 21:12 - 2009-07-13 21:12 - 001047632 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\DPInstx64.exe
2009-07-13 20:47 - 2009-07-13 20:47 - 000922176 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\DPInstx86.exe
2010-10-08 10:07 - 2010-10-08 10:07 - 000075672 _____ () C:\Users\Vanka\AppData\Local\Temp\DPInst_Monx64.exe
2010-10-08 10:07 - 2010-10-08 10:07 - 000075160 _____ () C:\Users\Vanka\AppData\Local\Temp\DPInst_Monx86.exe
2019-03-25 23:18 - 2019-03-25 23:18 - 000155729 _____ () C:\Users\Vanka\AppData\Local\Temp\JExplorer32.2.7.1.dll
2019-03-25 23:18 - 2019-03-25 23:18 - 000008273 _____ (TeamDev Ltd) C:\Users\Vanka\AppData\Local\Temp\JExplorer32.2.7.1.exe
2019-03-25 23:18 - 2019-03-25 23:18 - 000228864 _____ () C:\Users\Vanka\AppData\Local\Temp\JExplorer64.2.7.1.dll
2010-10-08 10:06 - 2010-10-08 10:06 - 000075152 _____ () C:\Users\Vanka\AppData\Local\Temp\OS_Detect.exe
2019-01-22 21:20 - 2015-12-31 23:00 - 000000000 __RSH () C:\Users\Vanka\AppData\Local\Temp\SkypeSetup.exe
2019-01-27 14:27 - 2019-01-23 13:38 - 000205960 _____ () C:\Users\Vanka\AppData\Local\Temp\Uninstall.exe
2019-01-21 21:05 - 2019-01-21 21:05 - 014456872 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\vc_redist.x86.exe
2018-09-07 13:03 - 2018-09-07 13:03 - 000865280 _____ () C:\Users\Vanka\AppData\Local\Temp\x.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\dllhost.exe => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2019-03-19 12:44

==================== End of FRST.txt ============================

Addition.txt

Здравейте..! В предоставените дневници не се виждат активни зарази..!  :)

Да направим контролни проверки:

 

GfiJrQ9.png&key=c8330b952021a3c1e5ae3771  Сканиране с Malwarebytes Anti-Malware (MBAM)

Моля изтеглете  Malwarebytes Anti -Malware и я запазете на вашия десктоп.

  • Стартирайте файла  mb3-setup-consumer-x.x.x.xxxx.exe и следвайте указанията за да инсталирате програмата.
  • След като инсталацията приключи програмата ще стартира автоматично.
  • Отидете до табът Settings => Protection > и под категорията Scan Options включете опцията "Scan for rootkits" като преместите плъзгача надясно.

xTvORSF.png

  • Отидете до табът Scan, и изберете Threat Scan и след това натиснете бутона Start Scan.

RUSrqgW.png

  • Ще започне проверка за зловреден софтуер.

4CJ90KI.png

  • При някои инфекции можете да видите съобщението:
  • "Could not load DDA driver"
  • Натиснете "Yes" на това съобщение за да позволите драйвера да се зареди след рестарт.
  • Разрешете на компютъра да се рестартира и след това продължете с останалите инструкции.
  • След като проверката приключи ще се появи списъка с резултатите (ако има намерени обекти). Ако програмата е минимизирана докато сканира ще се появи следното съобщение ако има открити заплахи. Натиснете бутона View Scan Results.

37b.png

  • . Натиснете бутона Quarantine Selected.

2CfXEk1.png

  • Изчакайте да се появи прозореца подканващ ви да рестартирате и след това натиснете бутона Yes.

8Jc9dl9.png

  • След рестарта, стартирайте отново Malwarebytes Anti-Malware.
  • Отидете то табът Reports и отворете лог файла с името Scan Report.

X0ha4sd.png

  • Натиснете бутона Export и след това =>  "Copy to Clipboard"

fE9qzai.png

  • Сега вече поставете съдържанието на лог файла с клавишната комбинация Ctrl + Vи го публикувайте в следващия си коментар.

 

Стъпка 2 :

 

BY4dvz9.png Сканиране с AdwCleaner

  • Изтеглете и стартирайте 6sv1DN9.jpgAdwCleaner 7.1.1.0 Final
  • Натиснете бутона Scan Now (или Сканиране сега, ако ви е на български)

4lqbd6J.png

  • AdwCleaner ще обнови базата с дефинициите си и ще започне да проверява компютъра. Проверката ще отнеме не повече от няколко секунди.
  • След като проверката приключи ако има намерени обекти ще се появи диалогов прозорец подканващ ви да натиснете бутона Clean & Repair (Почисти & Поправи).
  • Програмата ще затвори всички излишни процеси и след почистването ще иска да рестартира машината. Съгласете се.

FCuQiuz.png

  • Ако не бъдат открити зарази ще видите следния прозорец:

CWWivYK.png

  • Натиснете бутона Skip Basic Repair (Пропускане на основното поправяне).
  • И в двата случая ако няма открити зарази или ако програмата е почистила такива, стартирайте пак програмата и отидете до табът Log files
  • Кликнете с двукратен клил на мишката върху лог файла с последната дата и част (новите файлове са най-отдолу в списъка) и публикувайте съдържанието на файла в следващия си коментар.

 

pfNZP4A.png  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • Дневник от Malwarebytes Anti -Malware
  • AdwCleaner .txt

 

  • Автор

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/28/19
Scan Time: 6:15 PM
Log File: b2672bb4-5174-11e9-ba65-000000000000.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.563
Update Package Version: 1.0.9896
License: Trial

-System Information-
OS: Windows 8.1
CPU: x86
File System: NTFS
User: Ivan\Vanka

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 184062
Threats Detected: 8
Threats Quarantined: 8
Time Elapsed: 10 min, 34 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 2
PUP.Optional.RelevantKnowledge, HKLM\SOFTWARE\MICROSOFT\TRACING\rlvknlg_RASAPI32, Quarantined, [1314], [184776],1.0.9896
PUP.Optional.RelevantKnowledge, HKLM\SOFTWARE\MICROSOFT\TRACING\rlvknlg_RASMANCS, Quarantined, [1314], [184776],1.0.9896

Registry Value: 0
(No malicious items detected)

Registry Data: 3
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|ANTIVIRUSDISABLENOTIFY, Replaced, [13247], [293294],1.0.9896
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|FIREWALLDISABLENOTIFY, Replaced, [13247], [293295],1.0.9896
PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UPDATESDISABLENOTIFY, Replaced, [13247], [293296],1.0.9896

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 3
Trojan.Agent, C:\USERS\VANKA\APPDATA\LOCAL\TEMP\X.EXE, Quarantined, [419], [254162],1.0.9896
Generic.Malware/Suspicious, C:\USERS\VANKA\APPDATA\ROAMING\MICROSOFT\WINDOWS ACTIVATOR\WINDOWS ACTIVATOR.EXE, Quarantined, [0], [392686],1.0.9896
Generic.Malware/Suspicious, C:\USERS\VANKA\DOWNLOADS\OP COM 1.59.ZIP, Quarantined, [0], [392686],1.0.9896

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)


(end)

# -------------------------------
# Malwarebytes AdwCleaner 7.1.1.0
# -------------------------------
# Build:    04-24-2018
# Database: 
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    03-28-2019
# Duration: 00:00:31
# OS:       Windows 8.1 Enterprise
# Scanned:  31097
# Detected: 2


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.DriverPack         HKCU\Software\drpsu
PUP.Optional.Legacy             HKCU\Software\Video Player

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########
 

След сканирането с първата програма не се появи прозорец подканващ рестартиране но аз рестартирах.

HDD ми е разделен на C и E.Заедно с Троянеца на Е се появиха някакви файлове които прикачам в архив.

virus.rar

В този архив няма зарази:

https://www.virustotal.com/#/file/0503093c0724a26da485aa0881cccc7d6ea9ee83133a0cc28443e47220803bb4/detection

https://virusdesk.kaspersky.ru/?utm_source=support.kaspersky.ru&utm_medium=referral&utm_campaign=support_ru&utm_content=safety101_tab#scanresults

Това е от Visual Studio ..! Като стартирам инсталатора от архива и се случва това:

111.PNG.143495f4a797a887a4569fb9ea483484.PNGч

преди 9 минути, ivan_pop написа:

Ако всичко е наред,да не Ви притеснявам повече с моя проблем?

 

Моля подгответе свежи дневници с:

 

Сканиране с Farbar Recovery Scan

  • Моля изтеглете icon1337953436.pngFarbar Recovery Scan Tool (според версията на Windows изберете 32 битовата или 64 битовата версия) и го запазете на десктопа.
  • Стартирайте файла FRST.exe (или FRST64.exe)
  • Програмата ще се стартира. Натиснете YES за да се съгласите с лицензионното споразумение.
  • Натиснете бутона YClYkft.jpg.
  • Изчакайте търпеливо проверката да приключи.
  • Ще се създадат два лог файла с името - FRST.txt и Addition.txt на десктопа.
  • Копирайте съдържанието на файла FRST.txt в следващия си пост.Прикачете Addition.txt в коментар си (погледнете опцията Прикачване на файлове, когато публикувате мнение).

pfNZP4A.png&key=0a487e0a7cff89c690a32d13  Дневници 

В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

  • FRST.txt (копирате цялото съдържание)
  • Addition.txt (прикачате..) 
  • Автор

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-03-2019
Ran by Vanka (administrator) on IVAN (28-03-2019 20:37:48)
Running from C:\Users\Vanka\Desktop
Loaded Profiles: Vanka &  (Available Profiles: Vanka)
Platform: Microsoft Windows 8.1 Enterprise (Update) (X86) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices, Inc.) [File not signed] C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() [File not signed] C:\Program Files\Realtek\REALTEK Bluetooth\BTDevMgr.exe
(CrypKey (Canada) Ltd.) [File not signed] C:\Windows\System32\Crypserv.exe
(Digital Wave Ltd -> Digital Wave Ltd.) C:\Program Files\Common Files\DVDVideoSoft\lib\app_updater.exe
(CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed] C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe
(SafeNet Canada, Inc. -> SafeNet, Inc.) C:\Windows\System32\hasplms.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(TeamViewer GmbH -> TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(VMware, Inc. -> VMware, Inc.) C:\Windows\System32\vmnat.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\pg_ctl.exe
(CHENGDU YIWO Tech Development Co., Ltd. -> ) [File not signed] C:\Program Files\EaseUS\Todo Backup\bin\TodoBackupService.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files\VMware\VMware Player\vmware-authd.exe
(VMware, Inc. -> VMware, Inc.) C:\Windows\System32\vmnetdhcp.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) [File not signed] C:\Program Files\ATRis_Technik\pgsql\bin\postgres.exe
(SafeNet Canada, Inc. -> SafeNet, Inc.) C:\Windows\System32\hasplmv.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\vds.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(HP Inc. -> HP Inc.) C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Viber Media S.à r.l. -> Viber Media S.à r.l.) C:\Users\Vanka\AppData\Local\Viber\Viber.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google LLC -> Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [VIDC.VMnc] => C:\Windows\system32\vmnc.dll [360528 2013-02-26] (VMware, Inc. -> VMware, Inc.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\73.0.3683.86\Installer\chrmstp.exe [2019-03-26] (Google LLC -> Google Inc.)
GroupPolicy: Restriction ? <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{77F6F871-16E3-4748-90A7-7C5866B35451}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-3136552650-2365130857-356673686-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-3136552650-2365130857-356673686-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3136552650-2365130857-356673686-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03282019184938916\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-3136552650-2365130857-356673686-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03282019184938916\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3136552650-2365130857-356673686-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03282019184941948\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-3136552650-2365130857-356673686-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03282019184941948\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2018-10-31] (Microsoft Corporation -> Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2018-07-18] (Microsoft Corporation -> Microsoft Corporation)
IE Session Restore: HKU\S-1-5-21-3136552650-2365130857-356673686-1001 -> is enabled.
IE Session Restore: HKU\S-1-5-21-3136552650-2365130857-356673686-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03282019184938916 -> is enabled.
IE Session Restore: HKU\S-1-5-21-3136552650-2365130857-356673686-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-03282019184941948 -> is enabled.
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0015-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2018-03-14] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 0r0ddk0y.default-1538076306800
FF ProfilePath: C:\Users\Vanka\AppData\Roaming\Mozilla\Firefox\Profiles\0r0ddk0y.default-1538076306800 [2019-03-04]
FF Extension: (Telemetry coverage) - C:\Users\Vanka\AppData\Roaming\Mozilla\Firefox\Profiles\0r0ddk0y.default-1538076306800\features\{0276cc46-1c6e-4fb5-90cb-58f820b6e0bd}\[email protected] [2018-09-27] [Legacy]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-10-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.34.7\npGoogleUpdate3.dll [2019-03-28] (Google Inc -> Google LLC)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN -> VideoLAN)

Chrome: 
=======
CHR HomePage: Default -> hxxps://www.google.com/?hl=bg
CHR DefaultSearchURL: Default -> hxxps://www.google.bg/search?source=hp&ei=puTaW6nkGcuVkwWo3pvwCA&btnG=%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5&q={searchTerms}&oq=BiGas+&gs_l=psy-ab.1.1.0l10.228878.235855.0.240374.6.6.0.0.0.0.119.511.5j1.6.0....0...1c.1.64.psy-ab..0.6.509...0i10k1.0.M9MP0hQ3K4s
CHR Profile: C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default [2019-03-28]
CHR Extension: (Презентации) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-12-24]
CHR Extension: (Документи) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-12-24]
CHR Extension: (Google Диск) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-12-24]
CHR Extension: (MEGA) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\bigefpfhnfcobdlfbedofhhaibnlghod [2019-03-24]
CHR Extension: (YouTube) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-12-24]
CHR Extension: (Adblock Plus - free ad blocker) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2019-03-13]
CHR Extension: (I don't care about cookies) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\fihnjjcciajhdojfnbdddfaoknhalnja [2019-03-13]
CHR Extension: (Google Документи офлайн) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-12-24]
CHR Extension: (Плащания в уеб магазина на Chrome) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-12-24]
CHR Extension: (Gmail) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-12-24]
CHR Extension: (Chrome Media Router) - C:\Users\Vanka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-03-26]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [209408 2014-07-22] (Microsoft Windows Hardware Compatibility Publisher -> AMD)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [276992 2014-07-05] (Advanced Micro Devices, Inc.) [File not signed]
R2 BTDevManager; C:\Program Files\REALTEK\Realtek Bluetooth\BTDevMgr.exe [88064 2014-10-09] () [File not signed]
R2 CrypKey License; C:\Windows\system32\crypserv.exe [126976 2010-03-18] (CrypKey (Canada) Ltd.) [File not signed]
R2 DigitalWave.Update.Service; C:\Program Files\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-03-22] (Digital Wave Ltd -> Digital Wave Ltd.)
R2 EaseUS Agent; C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe [37416 2015-06-23] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 hasplms; C:\Windows\system32\hasplms.exe [4295208 2017-07-07] (SafeNet Canada, Inc. -> SafeNet, Inc.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [347512 2018-12-06] (HP Inc. -> HP Inc.)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [5247944 2019-02-01] (Malwarebytes Corporation -> Malwarebytes)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe [254680 2015-05-05] (Realtek Semiconductor Corp -> Realtek Semiconductor)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [208040 2015-05-07] (Synaptics Incorporated -> Synaptics Incorporated)
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [11665136 2019-01-16] (TeamViewer GmbH -> TeamViewer GmbH)
R2 VMAuthdService; C:\Program Files\VMware\VMware Player\vmware-authd.exe [87120 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMnetDHCP; C:\Windows\system32\vmnetdhcp.exe [357456 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMUSBArbService; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [721048 2012-10-11] (VMware, Inc. -> VMware, Inc.)
R2 VMware NAT Service; C:\Windows\system32\vmnat.exe [436304 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [280872 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103696 2017-01-12] (Microsoft Corporation -> Microsoft Corporation)
R2 WorkshopDbService; "C:\Program Files\ATRis_Technik\pgsql\bin\pg_ctl.exe" runservice  -N WorkshopDbService -D "C:\ProgramData\WorkshopData\data2" -w 

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aksfridge; C:\Windows\system32\drivers\aksfridge.sys [450904 2017-07-07] (SafeNet, Inc. -> SafeNet, Inc.)
R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [15080 2013-10-24] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, INC.)
R3 amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [11529216 2014-07-22] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [501248 2014-07-22] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [16088 2013-08-13] (Broadcom Corporation -> Windows (R) Win 7 DDK provider)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [26168 2016-01-28] (Disc Soft Ltd -> Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\drivers\dtliteusbbus.sys [40504 2016-01-28] (Disc Soft Ltd -> Disc Soft Ltd)
R0 EUBAKUP; C:\Windows\System32\drivers\eubakup.sys [51752 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [41512 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> ) [File not signed]
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [15912 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R1 EUFDDISK; C:\Windows\system32\drivers\EuFdDisk.sys [189992 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd. -> CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 eusk2par; C:\Windows\system32\Drivers\eusk2par.sys [25680 2008-12-18] (Aladdin Knowledge Systems LTD  -> Aladdin Knowledge Systems Ltd.)
S3 FTDIBUS; C:\Windows\system32\drivers\autrbus.sys [47249 2006-05-18] (Microsoft Windows Hardware Compatibility Publisher -> FTDI Ltd.)
S3 FTSER2K; C:\Windows\system32\drivers\autrser2k.sys [61067 2006-05-18] (Microsoft Windows Hardware Compatibility Publisher -> FTDI Ltd.)
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [606760 2017-07-07] (SafeNet Canada, Inc. -> SafeNet, Inc.)
R2 hcmon; C:\Windows\system32\drivers\hcmon.sys [41496 2012-10-11] (VMware, Inc. -> VMware, Inc.)
S3 iaioi2c; C:\Windows\System32\drivers\iaioi2c.sys [61936 2013-07-23] (MCG Windows Development and Validation -> Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [524784 2013-08-10] (Intel Corporation - Intel® Rapid Storage Technology -> Intel Corporation)
S3 MDA_NTDRV; C:\Windows\system32\MDA_NTDRV.sys [31224 2019-01-25] (Bada Technology Co.,Ltd -> )
R1 NetworkX; C:\Windows\System32\ckldrv.sys [23360 2010-03-19] (CrypKey (Canada) Inc. -> )
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [525568 2015-06-02] (Realtek Semiconductor Corp -> Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [5357056 2016-12-29] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corporation )
S3 Ser2pl; C:\Windows\system32\DRIVERS\ser2pl.sys [211648 2018-11-28] (WDKTestCert charles-yeh,131345514351795974 -> Prolific Technology Inc.)
S3 Ser2plx86; C:\Windows\system32\DRIVERS\ser2pl.sys [211648 2018-11-28] (WDKTestCert charles-yeh,131345514351795974 -> Prolific Technology Inc.)
R3 SmbDrv; C:\Windows\system32\DRIVERS\Smb_driver_AMDASF.sys [25768 2015-05-07] (Synaptics Incorporated -> Synaptics Incorporated)
S3 SNTNLUSB; C:\Windows\System32\drivers\SNTNLUSB.SYS [38376 2009-09-17] (SafeNet, Inc. -> SafeNet, Inc.)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [685816 2018-05-30] (Duplex Secure Ltd -> Duplex Secure Ltd.)
R3 vmkbd; C:\Windows\system32\drivers\VMkbd.sys [26064 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 VMnetAdapter; C:\Windows\system32\DRIVERS\vmnetadapter.sys [16664 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMnetBridge; C:\Windows\system32\DRIVERS\vmnetbridge.sys [37016 2013-02-26] (VMware, Inc. -> VMware, Inc.)
R2 VMnetuserif; C:\Windows\system32\drivers\vmnetuserif.sys [26192 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 vmusb; C:\Windows\System32\Drivers\vmusb.sys [31280 2012-10-11] (VMware, Inc. -> VMware, Inc.)
R2 vmx86; C:\Windows\system32\Drivers\vmx86.sys [62416 2013-02-26] (VMware, Inc. -> VMware, Inc.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [38920 2017-02-10] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [231256 2017-01-12] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [85336 2017-01-12] (Microsoft Windows -> Microsoft Corporation)
S3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver86.sys [29792 2016-03-23] (Hewlett-Packard Company -> HP)
R3 WirelessButtonDriver86; C:\Windows\System32\drivers\WirelessButtonDriver86.sys [29792 2016-03-23] (Hewlett-Packard Company -> HP)
S3 WUDFWpdMtp; C:\Windows\system32\DRIVERS\WUDFRd.sys [190976 2014-11-21] (Microsoft Windows -> Microsoft Corporation)
S3 audas0; \SystemRoot\System32\drivers\audas0.sys [X]
S3 BlueletAudio; \SystemRoot\system32\DRIVERS\blueletaudio.sys [X]
S3 BlueletSCOAudio; \SystemRoot\system32\DRIVERS\BlueletSCOAudio.sys [X]
S3 BT; \SystemRoot\system32\DRIVERS\btnetdrv.sys [X]
S3 btaudio; \SystemRoot\system32\drivers\btaudio.sys [X]
S3 BTDriver; \SystemRoot\system32\DRIVERS\btport.sys [X]
S0 BTHidEnum; System32\Drivers\vbtenum.sys [X]
S0 BTHidMgr; System32\Drivers\BTHidMgr.sys [X]
S3 BTKRNL; \SystemRoot\system32\DRIVERS\btkrnl.sys [X]
S3 BTWDNDIS; \SystemRoot\system32\DRIVERS\btwdndis.sys [X]
S3 BTWUSB; \SystemRoot\System32\Drivers\btwusb.sys [X]
S3 VComm; \SystemRoot\system32\DRIVERS\VComm.sys [X]
S3 VcommMgr; \SystemRoot\System32\Drivers\VcommMgr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-03-28 20:37 - 2019-03-28 20:39 - 000020557 _____ C:\Users\Vanka\Desktop\FRST.txt
2019-03-28 20:32 - 2019-03-28 20:32 - 001793024 _____ (Farbar) C:\Users\Vanka\Desktop\FRST.exe
2019-03-28 18:42 - 2019-03-28 18:47 - 000000000 ____D C:\AdwCleaner
2019-03-28 18:41 - 2019-03-28 18:41 - 007277776 _____ (Malwarebytes) C:\Users\Vanka\Desktop\adwcleaner_7.1.1.exe
2019-03-28 18:12 - 2019-03-28 18:12 - 000000000 ____D C:\Users\Vanka\AppData\Local\mbamtray
2019-03-28 18:12 - 2019-03-28 18:12 - 000000000 ____D C:\Users\Vanka\AppData\Local\mbam
2019-03-28 18:11 - 2019-03-28 18:11 - 000002036 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2019-03-28 18:11 - 2019-03-28 18:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2019-03-28 18:11 - 2019-03-28 18:11 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-03-28 18:11 - 2019-03-28 18:11 - 000000000 ____D C:\Program Files\Malwarebytes
2019-03-28 18:11 - 2019-01-08 16:32 - 000128552 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae.sys
2019-03-28 18:08 - 2019-03-28 18:08 - 062430768 _____ (Malwarebytes ) C:\Users\Vanka\Desktop\mb3-setup-consumer-3.7.1.2839-1.0.563-1.0.9877.exe
2019-03-28 18:07 - 2019-03-28 18:07 - 002035155 _____ C:\Users\Vanka\Desktop\virus.rar
2019-03-27 22:18 - 2019-03-27 22:18 - 000020233 _____ C:\Users\Vanka\Downloads\7313.pdf
2019-03-27 19:24 - 2019-03-28 20:37 - 000000000 ____D C:\FRST
2019-03-25 23:18 - 2019-03-25 23:18 - 000009680 _____ C:\Users\Vanka\AppData\Local\Tempastraheobd_dba_ellemeet.svgz
2019-03-25 21:49 - 2019-03-25 21:49 - 000002045 _____ C:\Users\Vanka\Desktop\HynesPro.lnk
2019-03-25 21:41 - 2019-03-25 21:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ATRis_Technik
2019-03-25 21:32 - 2019-03-25 21:46 - 000000000 ____D C:\Program Files\ATRis_Technik
2019-03-25 21:32 - 2011-04-18 20:54 - 000941568 _____ (Igor Pavlov) C:\ProgramData\7z.dll
2019-03-25 21:32 - 2011-04-18 20:34 - 000168448 _____ (Igor Pavlov) C:\ProgramData\7z.exe
2019-03-25 21:29 - 2019-03-25 21:29 - 000000295 _____ C:\Windows\Atris_STG.INI
2019-03-25 21:29 - 2019-03-25 21:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ATRis STAHLGRUBER DVD
2019-03-25 21:16 - 2019-03-25 21:16 - 000000000 ____D C:\ATRIS_ST
2019-03-25 20:40 - 2019-03-26 14:30 - 000144625 _____ C:\Users\Vanka\wirdia.svg
2019-03-23 20:12 - 2019-03-23 20:12 - 000643330 _____ C:\Users\Vanka\Desktop\nastroiki_W-router_DK.pdf
2019-03-22 20:39 - 2019-03-06 08:41 - 005679864 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2019-03-22 20:39 - 2019-03-06 08:40 - 001407120 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2019-03-22 20:39 - 2019-03-06 08:40 - 001297088 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2019-03-22 20:39 - 2019-03-06 08:40 - 001281072 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2019-03-22 20:39 - 2019-03-06 08:40 - 001181944 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2019-03-22 20:39 - 2019-03-06 07:51 - 003450368 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2019-03-22 20:39 - 2019-03-06 07:37 - 003617280 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2019-03-22 20:39 - 2019-03-06 06:39 - 002464256 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2019-03-22 20:39 - 2019-02-26 09:25 - 020281856 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2019-03-22 20:39 - 2019-02-26 09:07 - 000498176 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2019-03-22 20:39 - 2019-02-26 09:04 - 002295808 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2019-03-22 20:39 - 2019-02-26 08:57 - 000663040 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2019-03-22 20:39 - 2019-02-26 08:36 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2019-03-22 20:39 - 2019-02-26 08:35 - 004494848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2019-03-22 20:39 - 2019-02-26 08:31 - 000696320 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2019-03-22 20:39 - 2019-02-26 08:29 - 013681664 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2019-03-22 20:39 - 2019-02-26 08:12 - 004386304 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2019-03-22 20:39 - 2019-02-26 08:09 - 001332224 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2019-03-22 20:39 - 2019-02-26 08:07 - 000710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2019-03-22 20:39 - 2019-02-20 22:17 - 000313344 _____ (Microsoft Corporation) C:\Windows\system32\msrd2x40.dll
2019-03-22 20:39 - 2019-02-15 21:51 - 000449744 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2019-03-22 20:39 - 2019-02-15 21:51 - 000413576 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2019-03-22 20:39 - 2019-02-09 20:26 - 000333560 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2019-03-22 20:39 - 2019-02-09 20:21 - 001683400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2019-03-22 20:39 - 2019-02-09 18:45 - 000367104 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2019-03-22 20:39 - 2019-02-09 18:14 - 000879616 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2019-03-22 20:39 - 2019-02-09 02:33 - 001901888 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2019-03-22 20:39 - 2019-02-09 01:07 - 000889344 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2019-03-22 20:39 - 2019-02-09 01:07 - 000614040 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2019-03-22 20:39 - 2019-02-08 23:29 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Globalization.dll
2019-03-22 20:39 - 2019-02-08 19:50 - 001493504 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2019-03-22 20:39 - 2019-02-08 19:45 - 001556992 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2019-03-22 20:39 - 2019-02-07 02:34 - 001070456 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2019-03-22 20:39 - 2019-02-07 02:34 - 000849216 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2019-03-22 20:39 - 2019-02-06 20:29 - 000575488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2019-03-22 20:39 - 2019-02-01 06:25 - 001839344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2019-03-22 20:39 - 2019-01-08 07:12 - 001489704 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 001387520 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000617984 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000593408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000524800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000377856 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000361472 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000254464 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2019-03-22 20:39 - 2019-01-04 16:14 - 000205312 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2019-03-22 20:38 - 2019-03-06 07:52 - 000027392 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2019-03-22 20:38 - 2019-02-26 08:41 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2019-03-22 20:38 - 2019-02-26 08:39 - 000279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2019-03-22 20:38 - 2019-02-26 08:39 - 000128000 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2019-03-22 20:38 - 2019-02-26 08:33 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2019-03-22 20:38 - 2019-02-26 08:31 - 002059776 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2019-03-22 20:38 - 2019-02-26 08:31 - 000333312 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2019-03-22 20:38 - 2019-02-26 08:20 - 001049600 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2019-03-22 20:38 - 2019-02-15 21:51 - 000033504 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2019-03-22 20:38 - 2019-02-15 21:50 - 000372328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2019-03-22 20:38 - 2019-02-09 20:29 - 000178632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2019-03-22 20:38 - 2019-02-09 19:21 - 000260096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2019-03-22 20:38 - 2019-02-09 19:21 - 000163840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2019-03-22 20:38 - 2019-02-09 19:21 - 000073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdfs.sys
2019-03-22 20:38 - 2019-02-09 19:19 - 000229888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2019-03-22 20:38 - 2019-02-09 18:43 - 000730624 _____ (Microsoft Corporation) C:\Windows\system32\pmcsnap.dll
2019-03-22 20:38 - 2019-02-09 18:16 - 000399360 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2019-03-22 20:38 - 2019-02-08 20:32 - 000044544 _____ (Microsoft Corporation) C:\Windows\system32\mf3216.dll
2019-03-22 20:38 - 2019-02-07 20:35 - 000098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2019-03-22 20:38 - 2019-02-06 20:30 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
2019-03-22 20:38 - 2019-02-06 20:30 - 000023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msfs.sys
2019-03-22 20:38 - 2019-02-06 20:29 - 000337920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2019-03-22 20:38 - 2019-02-06 20:28 - 000187392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2019-03-22 20:38 - 2019-01-09 05:52 - 000038912 _____ (Microsoft Corporation) C:\Windows\system32\hcproviders.dll
2019-03-22 20:38 - 2019-01-09 05:45 - 000530432 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenterCPL.dll
2019-03-22 20:38 - 2019-01-09 05:40 - 000839680 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2019-03-22 20:38 - 2019-01-05 09:31 - 000131344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2019-03-22 19:56 - 2019-03-22 19:56 - 024718688 _____ ( ) C:\Users\Vanka\Downloads\AdbeRdr812_ru_RU.exe
2019-03-22 19:56 - 2019-03-22 19:56 - 015382749 _____ C:\Users\Vanka\Downloads\CAD-KAS  PDFEditor 5.5 Pro.rar
2019-03-21 18:05 - 2019-03-21 18:06 - 000000000 ____D C:\Users\Vanka\AppData\Local\Viber
2019-03-21 13:06 - 2019-03-21 13:06 - 000002511 _____ C:\Users\Public\Desktop\EmmeGas MULTI IC.lnk
2019-03-21 13:06 - 2019-03-21 13:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EmmeGas
2019-03-21 10:13 - 2019-03-21 10:16 - 000001139 _____ C:\Users\Public\Desktop\LPGTECH Gas Setting 2.0.lnk
2019-03-21 10:13 - 2019-03-21 10:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LPGTECH Gas Setting 2.0
2019-03-21 10:13 - 2019-03-21 10:16 - 000000000 ____D C:\Program Files\LPGTECH Gas Setting 2.0
2019-03-20 12:08 - 2019-03-20 12:08 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Livecare
2019-03-20 12:08 - 2019-03-20 12:08 - 000000000 ____D C:\Users\Vanka\AppData\LocalLow\livecare
2019-03-20 12:08 - 2019-03-20 12:08 - 000000000 ____D C:\ProgramData\Livecare
2019-03-20 12:03 - 2019-03-20 12:03 - 000000000 ____D C:\Users\Vanka\AppData\Local\Zavoli
2019-03-20 12:02 - 2019-03-20 12:06 - 000001567 _____ C:\Users\Public\Desktop\Zavoli.lnk
2019-03-20 12:02 - 2019-03-20 12:02 - 000000000 ____D C:\Zavoli
2019-03-19 21:09 - 2019-03-19 21:09 - 000013424 _____ C:\Users\Vanka\Downloads\FI202049G34.rar
2019-03-19 21:06 - 2019-03-19 21:06 - 000059444 _____ C:\Users\Vanka\Desktop\LR202043G34.rar
2019-03-19 20:37 - 2019-03-19 20:37 - 000000000 _____ C:\Windows\TCULR.INI
2019-03-17 21:02 - 2019-03-17 21:02 - 000179937 _____ C:\Users\Vanka\Downloads\А10.pdf
2019-03-17 20:31 - 2019-03-17 20:32 - 009824545 _____ C:\Users\Vanka\Downloads\Opel pin.rar
2019-03-17 20:30 - 2019-03-17 20:30 - 016930062 _____ C:\Users\Vanka\Downloads\VIN to PIN Opel.rar
2019-03-13 18:35 - 2019-03-13 18:41 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BlueEnergy
2019-03-13 18:35 - 2019-03-13 18:35 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\BlueEnergy
2019-03-13 18:35 - 2019-03-13 18:35 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Blue Energy
2019-03-13 18:35 - 2019-03-13 18:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BlueEnergy
2019-03-13 18:26 - 2019-03-13 18:34 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BluePower
2019-03-13 18:26 - 2019-03-13 18:26 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\BluePower
2019-03-13 18:26 - 2019-03-13 18:26 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BluePower
2019-03-07 14:35 - 2019-03-07 14:41 - 000000000 ____D C:\Program Files\Simgas2
2019-03-07 14:35 - 2019-03-07 14:35 - 000000911 _____ C:\Users\Vanka\Desktop\Simgas2.lnk
2019-03-07 14:35 - 2019-03-07 14:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Simgas2
2019-03-07 14:34 - 2019-03-07 14:34 - 000001001 _____ C:\Users\Vanka\Desktop\Simgas+.lnk
2019-03-07 14:34 - 2019-03-07 14:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SimgasPlus
2019-03-07 14:34 - 2019-03-07 14:34 - 000000000 ____D C:\Program Files\SimgasPlus
2019-03-05 18:23 - 2019-03-05 18:23 - 000001799 _____ C:\Users\Public\Desktop\AIS.lnk
2019-03-05 18:23 - 2019-03-05 18:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Romano s.r.l
2019-03-05 18:23 - 2019-03-05 18:23 - 000000000 ____D C:\Program Files\AIS
2019-03-04 12:42 - 2019-03-04 12:42 - 000002505 _____ C:\Users\Public\Desktop\Alex Sequential Injection System CAD.lnk
2019-03-04 12:42 - 2019-03-04 12:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alex
2019-03-03 15:30 - 2019-03-03 15:30 - 058773809 _____ C:\Users\Vanka\Downloads\T-NT14LDEUC_1042.0.exe
2019-03-03 14:36 - 2019-03-03 14:36 - 000000024 _____ C:\Users\Vanka\Desktop\nasko12233.txt
2019-02-28 18:21 - 2019-02-28 18:21 - 000001545 _____ C:\Users\Vanka\Desktop\VAUXCOM.exe - Shortcut.lnk
2019-02-28 18:19 - 2019-02-28 18:20 - 000000000 ____D C:\Program Files\WaxCom
2019-02-28 13:02 - 2019-02-28 13:03 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\AcGasSynchro II
2019-02-28 12:54 - 2019-02-28 12:54 - 000001046 _____ C:\Users\Vanka\Desktop\ACGasSynchro 11.2.1.1.lnk
2019-02-28 12:54 - 2019-02-28 12:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcGasSynchro II
2019-02-28 12:54 - 2019-02-28 12:54 - 000000000 ____D C:\Program Files\AcGasSynchro II
2019-02-28 12:42 - 2019-02-28 12:42 - 002938908 _____ C:\Users\Vanka\Downloads\ver2_8_9_RU_PREMIUM_manual.pdf
2019-02-27 20:21 - 2019-02-27 20:22 - 000000353 _____ C:\Users\Vanka\Desktop\STOP-updates.txt

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-03-28 19:37 - 2018-05-30 22:31 - 000000000 ____D C:\ADCDA2
2019-03-28 18:50 - 2013-08-22 08:13 - 000000187 _____ C:\Windows\win.ini
2019-03-28 18:49 - 2019-01-29 19:09 - 000000000 ____D C:\Program Files\TeamViewer
2019-03-28 18:49 - 2018-07-13 16:20 - 000000000 ____D C:\ProgramData\VMware
2019-03-28 18:48 - 2013-08-22 09:23 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-03-28 18:03 - 2015-12-25 14:45 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\uTorrent
2019-03-27 20:51 - 2014-11-21 05:17 - 000869216 _____ C:\Windows\system32\PerfStringBackup.INI
2019-03-27 20:51 - 2013-08-22 08:21 - 000000000 ____D C:\Windows\inf
2019-03-27 19:48 - 2018-04-25 19:40 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\ViberPC
2019-03-26 13:48 - 2018-12-24 14:34 - 000002188 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-03-26 13:48 - 2018-12-24 14:34 - 000002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-03-25 22:51 - 2015-12-14 02:55 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\vlc
2019-03-25 22:26 - 2015-12-12 05:09 - 000000000 ____D C:\Users\Vanka\AppData\Local\Packages
2019-03-25 21:32 - 2016-10-30 16:20 - 000000000 ____D C:\ProgramData\WorkshopData
2019-03-25 21:29 - 2016-10-30 16:19 - 000000626 _____ C:\Windows\ODBC.INI
2019-03-25 21:29 - 2016-10-30 16:19 - 000000295 _____ C:\Windows\Atris_St.INI
2019-03-25 20:40 - 2018-11-26 15:12 - 000000000 ____D C:\Users\Vanka
2019-03-24 14:34 - 2013-08-22 10:17 - 000000000 ____D C:\Windows\rescache
2019-03-23 10:39 - 2018-01-25 19:32 - 000000000 ____D C:\ProgramData\MCShield
2019-03-22 21:06 - 2013-08-22 09:22 - 000481584 _____ C:\Windows\system32\FNTCACHE.DAT
2019-03-22 21:04 - 2013-08-22 08:13 - 000262144 ___SH C:\Windows\system32\config\BBI
2019-03-22 21:01 - 2015-04-14 23:41 - 000000000 ____D C:\Windows\system32\appraiser
2019-03-22 21:01 - 2014-11-21 07:42 - 000000000 ___SD C:\Windows\system32\CompatTel
2019-03-22 21:01 - 2013-08-22 10:17 - 000000000 ___RD C:\Windows\ToastData
2019-03-22 20:53 - 2013-08-22 10:05 - 000000000 ____D C:\Windows\CbsTemp
2019-03-22 20:33 - 2018-12-12 09:01 - 000513376 _____ C:\Windows\system32\locale.nls
2019-03-21 18:05 - 2018-04-25 19:48 - 000000000 ____D C:\Users\Vanka\Documents\ViberDownloads
2019-03-21 13:06 - 2018-06-30 10:30 - 000000000 ____D C:\Program Files\MultipointInj
2019-03-20 12:47 - 2017-08-21 11:56 - 000000000 ____D C:\Users\Vanka\AppData\Local\SequentPD
2019-03-20 12:47 - 2017-05-12 22:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BRC Gas Equipment
2019-03-20 12:06 - 2018-06-30 10:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zavoli
2019-03-19 21:30 - 2015-12-13 04:41 - 000000000 ___HD C:\Program Files\InstallShield Installation Information
2019-03-19 20:27 - 2016-10-30 16:19 - 000000588 _____ C:\Windows\ODBCINST.INI
2019-03-19 19:55 - 2018-06-10 09:55 - 000000000 ____D C:\Program Files\KME
2019-03-12 19:02 - 2019-01-22 21:20 - 000000000 ____D C:\Users\Vanka\AppData\Roaming\Skype
2019-03-12 17:55 - 2013-08-22 10:17 - 000000000 ____D C:\Windows\system32\Macromed
2019-03-05 18:23 - 2019-02-18 21:16 - 000000000 ____D C:\ProgramData\AntonioInjectionSystem
2019-03-05 18:23 - 2018-11-18 13:30 - 000000000 ____D C:\Users\Vanka\AppData\Local\Downloaded Installations
2019-03-04 21:52 - 2018-07-15 16:10 - 000000000 ____D C:\Users\Vanka\AppData\LocalLow\Mozilla
2019-03-04 12:42 - 2018-12-18 21:40 - 000000000 ____D C:\Program Files\Chiave Hardware Eutron
2019-03-03 09:04 - 2015-12-25 18:58 - 000000000 ____D C:\Users\Vanka\AppData\Local\ElevatedDiagnostics
2019-03-02 12:26 - 2018-06-30 10:30 - 000000000 ____D C:\Users\Vanka\Documents\MultipointInj

==================== Files in the root of some directories =======

2019-03-25 21:32 - 2011-04-18 20:54 - 000941568 _____ (Igor Pavlov) C:\ProgramData\7z.dll
2019-03-25 21:32 - 2011-04-18 20:34 - 000168448 _____ (Igor Pavlov) C:\ProgramData\7z.exe
2018-07-02 11:56 - 2005-06-29 14:39 - 000617472 _____ () C:\Program Files\AUTRONIT.EX_
2018-07-02 11:56 - 2002-03-21 10:29 - 000289056 _____ () C:\Program Files\HDSETUP.EX_
2018-07-02 11:56 - 2002-03-21 10:29 - 000006656 _____ () C:\Program Files\SETUP.EXE
2018-07-02 11:56 - 2005-06-29 13:00 - 000000633 _____ () C:\Program Files\SETUP.INF
2018-07-02 11:56 - 2005-06-29 08:32 - 000000407 _____ () C:\Program Files\UNINSTAL.INF
2018-07-02 11:56 - 2005-06-29 11:00 - 000000004 _____ () C:\Program Files\XMON.CF_
2018-07-02 11:56 - 2005-04-27 08:59 - 000000195 _____ () C:\Program Files\XMON.DE_
2018-07-02 11:56 - 2005-06-30 14:16 - 000009832 _____ () C:\Program Files\Xmon.di_
2018-06-20 17:13 - 2018-12-09 15:27 - 000000071 _____ () C:\Users\Vanka\AppData\Local\DiegoG3-3.0.8.2.INI
2019-03-25 23:18 - 2019-03-25 23:18 - 000009680 _____ () C:\Users\Vanka\AppData\Local\Tempastraheobd_dba_ellemeet.svgz
2016-10-30 19:29 - 2016-10-30 19:29 - 000009612 _____ () C:\Users\Vanka\AppData\Local\Temppicasso eobd_dba_ellemeet.svgz

Some files in TEMP:
====================
2019-03-25 20:34 - 2019-03-28 19:39 - 000003584 _____ () C:\Users\Vanka\AppData\Local\Temp\dateinj01.dll
2019-01-27 14:31 - 2013-07-29 13:40 - 000086392 _____ () C:\Users\Vanka\AppData\Local\Temp\dp-chooser.exe
2019-01-27 14:31 - 2013-07-29 13:41 - 000676288 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\dpinst-amd64.exe
2019-01-27 14:31 - 2013-07-29 13:41 - 000550848 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\dpinst-x86.exe
2009-07-13 21:12 - 2009-07-13 21:12 - 001047632 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\DPInstx64.exe
2009-07-13 20:47 - 2009-07-13 20:47 - 000922176 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\DPInstx86.exe
2010-10-08 10:07 - 2010-10-08 10:07 - 000075672 _____ () C:\Users\Vanka\AppData\Local\Temp\DPInst_Monx64.exe
2010-10-08 10:07 - 2010-10-08 10:07 - 000075160 _____ () C:\Users\Vanka\AppData\Local\Temp\DPInst_Monx86.exe
2019-03-25 23:18 - 2019-03-25 23:18 - 000155729 _____ () C:\Users\Vanka\AppData\Local\Temp\JExplorer32.2.7.1.dll
2019-03-25 23:18 - 2019-03-25 23:18 - 000008273 _____ (TeamDev Ltd) C:\Users\Vanka\AppData\Local\Temp\JExplorer32.2.7.1.exe
2019-03-25 23:18 - 2019-03-25 23:18 - 000228864 _____ () C:\Users\Vanka\AppData\Local\Temp\JExplorer64.2.7.1.dll
2010-10-08 10:06 - 2010-10-08 10:06 - 000075152 _____ () C:\Users\Vanka\AppData\Local\Temp\OS_Detect.exe
2019-01-22 21:20 - 2015-12-31 23:00 - 000000000 __RSH () C:\Users\Vanka\AppData\Local\Temp\SkypeSetup.exe
2019-01-27 14:27 - 2019-01-23 13:38 - 000205960 _____ () C:\Users\Vanka\AppData\Local\Temp\Uninstall.exe
2019-01-21 21:05 - 2019-01-21 21:05 - 014456872 _____ (Microsoft Corporation) C:\Users\Vanka\AppData\Local\Temp\vc_redist.x86.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\dllhost.exe => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2019-03-28 08:26

==================== End of FRST.txt ============================

Addition.txt

Нищо притеснително..! Един освежаващ скрипт:

Фикс с Farbar Recovery Scan Tool
 
icon13.gif Изтеглете прикачения файл  fixlist.txtи го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Press%20the%20FIX%20button_zpsdd5zi3mt.p


Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.
 
ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на  операционната ви система

 

pfNZP4A.png  Дневници
 
В следващия си отговор, моля да включите следните дневници:

  • FixLog.txt
  • Автор

Fix result of Farbar Recovery Scan Tool (x86) Version: 17-03-2019
Ran by Vanka (28-03-2019 21:18:17) Run:1
Running from C:\Users\Vanka\Desktop
Loaded Profiles: Vanka &  (Available Profiles: Vanka)
Boot Mode: Normal

==============================================

fixlist content:
*****************
start
CreateRestorePoint:
EmptyTemp:
CloseProcesses:
AlternateDataStreams: C:\ProgramData:3f80b7866a646e [1918]
AlternateDataStreams: C:\ProgramData:fe93a19e34e9a [3410]
AlternateDataStreams: C:\Users\All Users:3f80b7866a646e [1918]
AlternateDataStreams: C:\Users\All Users:fe93a19e34e9a [3410]
AlternateDataStreams: C:\Users\Vanka:9902508f [8078]
AlternateDataStreams: C:\ProgramData\Application Data:3f80b7866a646e [1918]
AlternateDataStreams: C:\ProgramData\Application Data:fe93a19e34e9a [3410]
AlternateDataStreams: C:\Users\Vanka\Application Data:3cf1f80b7ca [2838]
AlternateDataStreams: C:\Users\Vanka\Local Settings:742a1fbdc7a52b4 [5310]
AlternateDataStreams: C:\Users\Vanka\AppData\Local:742a1fbdc7a52b4 [5310]
AlternateDataStreams: C:\Users\Vanka\AppData\Roaming:3cf1f80b7ca [2838]
AlternateDataStreams: C:\Users\Vanka\AppData\Local\Application Data:742a1fbdc7a52b4 [5310]
AlternateDataStreams: C:\Users\Vanka\AppData\Local\History:b73a4319e34f3 [4200]
AlternateDataStreams: C:\Users\Vanka\AppData\Local\Temp:73189872e0f51 [3664]
FirewallRules: [{49C91707-2771-49C9-BA75-D09547359749}] => (Allow) E:\soft\Skype-4.2\Skype4.exe No File
reboot:
end

*****************

Restore point was successfully created.
Processes closed successfully.
C:\ProgramData => ":3f80b7866a646e" ADS removed successfully.
C:\ProgramData => ":fe93a19e34e9a" ADS removed successfully.
"C:\Users\All Users" => ":3f80b7866a646e" ADS not found.
"C:\Users\All Users" => ":fe93a19e34e9a" ADS not found.
C:\Users\Vanka => ":9902508f" ADS removed successfully.
"C:\ProgramData\Application Data" => ":3f80b7866a646e" ADS not found.
"C:\ProgramData\Application Data" => ":fe93a19e34e9a" ADS not found.
C:\Users\Vanka\Application Data => ":3cf1f80b7ca" ADS removed successfully.
C:\Users\Vanka\Local Settings => ":742a1fbdc7a52b4" ADS removed successfully.
"C:\Users\Vanka\AppData\Local" => ":742a1fbdc7a52b4" ADS not found.
"C:\Users\Vanka\AppData\Roaming" => ":3cf1f80b7ca" ADS not found.
"C:\Users\Vanka\AppData\Local\Application Data" => ":742a1fbdc7a52b4" ADS not found.
C:\Users\Vanka\AppData\Local\History => ":b73a4319e34f3" ADS removed successfully.
C:\Users\Vanka\AppData\Local\Temp => ":73189872e0f51" ADS removed successfully.
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{49C91707-2771-49C9-BA75-D09547359749}" => removed successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 12582912 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 15145746 B
Java, Flash, Steam htmlcache => 1124 B
Windows/system/drivers => 6946979 B
Edge => 0 B
Chrome => 433199940 B
Firefox => 745120580 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
LocalService => 9140 B
NetworkService => 117833496 B
Vanka => 621473575 B

RecycleBin => 0 B
EmptyTemp: => 1.8 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 21:20:40 ====

Чудесно...!   :)

Остана само да премахнем програмите които използвахме :

image.png.6d53a07c1944beb85ec26100f70024f6.png  За да премахнете правилно инструмента Farbar Recovery Scan Tool  , преименувайте изпълнимия файл FRST64.exe (или FRST.exe) в Uninstall.exe..!

image.png.9cf9e0ab76b122782aff3552f54c5829.png     =>     image.png.44f957ce25ef61c76206655a46425152.png

Стартирайте  файла Uninstall.exe. Ще бъдете уведомени, че трябва да рестартирате системата, за да изтриете инструмента ..!

image.png.abcc20b28654d54fae08e7451bb5dc3b.png

 

image.png.ac7ea1786f9d972ad8f756c5c960b8c6.png  За да премахнете правилно инструмента AdwCleaner :

Моля, стартирайте adwcleaner.exe 
В Настройки - Премахване на AdwCleaner - изберете Премахване. 
Потвърдете изтриването, като натиснете бутона: Да

image.png.2ac970fbc165454bc4cda9d91b197697.png 

 

image.png.b3002e35d6905db4765e403edd8611aa.png  Деинсталирайте Malwarebytes Anti-Malware от Control Panel...или по ваше желание оставете   програмата на вашия компютър и периодично да сканирате системата си с нея (поне един -два пъти в седмицата),като не забравяйте да обновите дефинициите и преди всяко сканиране..както и да изключите защитата в реално време на програмата.

 

Ако няма друго да се ориентираме към финал..! Маркирам случая за "Решен"...! Пожелавам лека вечер и  безопасен интернет..!  :)

 

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.