Проблемен Windows 7 ..! Вероятен вирус..?

23 декември 20196 г.

FRST.txtZdraveite!Sujalqvam che pisha na latinica, no sistemata e strashno omazana i dori ne moga da mu sloja kirilicata za da pisha. Ne znam dali e ot virus ili ot programi koito sum instaliral i zatova prikachvam logovete ot farbar.Addition.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 декември 20196 г.

Здравейте...Да ..системата ви е заразена ....но и тотално омазана....със зловредния софтуер ще се оправим но с операционната система ...много трудно.... Само да ви кажа че сте използвали разни оптимизатори и точно от там е това окаяно състояние на системата ви...! Не работят много услуги ....повредени системни файлове ...Зловредния софтуер ще почистим ,обаче със състоянието на операционната система ..не....!Така че си решавайте ...дали ще работим по премахване на зловредния софтуер или си преинсталирайте системата ..!

Като за начало:

Деинсталиране на нежелани / ненужни програми:

Натиснете клавишна комбинация + R на клавиатурата си едновременно. Напишете (копирайте) в полето appwiz.cpl и кликнете върху OK.
В отворилия се списък с инсталирани програми, деинсталирайте програмите от карето по долу:

Цитат


Advanced System Optimizer

+

CKScanner

Изтеглете CKScanner от askey127 от тук:

Важно: Запазете го на работния плот.

Щракнете двукратно върху CKScanner.exe и щракнете върху Search For Files .
След много кратко време, когато часовникът на курсора изчезне, щракнете върху Save List To File .
Съобщение ще потвърди, че файлът е запазен.
Щракнете двукратно върху иконата на CKFiles.txt на вашия работен плот и копирайте / поставете съдържанието в следващия си отговор.

+

Сканиране с SecurityCheck by glax24

Изтеглете SecurityCheck by glax24 от тук и запомнете инструмента на десктопа .
Стартирате програмата (ако използвате Windows XP) или стартирате с десен бутон на мишката от името на администратор (ако използватеWindows Vista/7/8/10)
Изчакайте да приключи сканирането.Ще се отвори в текстов файл с име SecurityCheck.txt. Копирайте съдържанието на този файл следващия си пост
Можете да намерите този файл в основната директория на системния диск в папка с име SecurityCheck, напр. C:\SecurityCheck\SecurityCheck.txt

+

FRST сканиране

    Щракнете двукратно върху FRST.exe / FRST64.exe, за да го стартирате.
    Натиснете бутона за сканиране.
    Когато приключи, той ще създаде два лог файла с името FRST.txt и Addition.txt, в същата директория, от която е стартиран инструментът.
    Моля, копирайте и поставете журналите в следващия си отговор.

Дневници

В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

SecurityCheck.txt
CKFiles.txt
FRST.txt (копирате цялото съдържание)
Addition.txt (копирате цялото съдържание)

23 декември 20196 г.

Автор

Predi da zapochna samo da popitam ako izchistim zlovredniq software ima li nachin bez preinstalaciq da opravq uslugite na sistemata?

Shte chistim! Zapochvam i shte publikuvam dnevnicite.

Prilagam dnevnici, no samo ot frst zashtoto drugite programi ne se izpulniha korektno. CKScanner e s nezavurshen dnevnik ne znam po kakvi prichini, a Security Check izobshto ne poiska da se startira.

CKScanner 2.5 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11.COLBW0
----- EOF -----

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2019
Ran by John (administrator) on JOHN-PC (Acer Extensa 5235) (23-12-2019 15:47:18)
Running from C:\Users\John\Desktop
Loaded Profiles: John (Available Profiles: John)
Platform: Windows 7 Ultimate (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Freedom Scientific Inc -> Freedom Scientific BLV Group, LLC) C:\Program Files\Freedom Scientific\JAWS\10.0\jfw.exe
(Freedom Scientific Inc -> Freedom Scientific LLC.) C:\Program Files\Freedom Scientific\JAWS\10.0\fsATProxy.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Run: [GUDelayStartup] => D:\Glary Utilities_Portable\Portable\StartupManager.exe [37152 2015-06-23] (Glarysoft Ltd -> Glarysoft Ltd)
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\...\Providers\lha4638w: C:\Program Files\Serfcultqertosp Debuger\local32spl.dll <==== ATTENTION
BootExecute: autocheck autochk * sh4native Sh4Removal
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {16D89A24-6883-47A1-B623-850F2355C1D1} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [1542536 2019-10-02] (AVAST Software s.r.o. -> AVAST Software)
Task: {65B180D4-9FF0-4049-8139-82E3692FA64E} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_303_Plugin.exe [1457720 2019-12-15] (Adobe Inc. -> Adobe)
Task: {70DF1333-5053-4E3F-AB34-C3C1F95B0A58} - System32\Tasks\{33C6514F-C6D3-4D84-886B-6C3951664A53} => C:\Program Files\NVDA\nvda.exe [45144 2017-02-22] (NV Access Limited -> NV Access)
Task: {773B96F8-0E0E-4027-8BAA-59038B0E01A8} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {A0244773-4A80-49D0-861F-26295EAB10C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-12-15] (Adobe Inc. -> Adobe)
Task: {F7188883-9111-4897-B8BF-4EE4EF8E8A87} - System32\Tasks\{89AEC490-EE9C-440E-A8D5-C07A30381FE8} => C:\Program Files\NVDA\nvda.exe [45144 2017-02-22] (NV Access Limited -> NV Access)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Winsock: Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL => No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4796E6B0-038D-402E-B49C-E028570C55F2}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
URLSearchHook: [S-1-5-21-3988584367-4034529715-610683126-1000] ATTENTION => Default URLSearchHook is missing
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF DefaultProfile: 2al0s2pk.default
FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\2al0s2pk.default [2019-12-23]
FF Extension: (Adblock Plus — безплатен блокер на реклами) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\2al0s2pk.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-12-22]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_32_0_0_303.dll [2019-12-15] (Adobe Inc. -> )
FF Plugin: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 DigitalWave.Update.Service; C:\Program Files\Common Files\DVDVideoSoft\lib\app_updater.exe [388968 2016-03-21] (Digital Wave Ltd -> Digital Wave Ltd.) [File not signed]
S3 JTVNCProxy_10.0; C:\Program Files\Freedom Scientific\JAWS\10.0\JTVNCProxy.exe [16152 2009-06-09] (Freedom Scientific Inc -> )
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [5570712 2019-12-23] (Malwarebytes Inc -> Malwarebytes)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [217192 2016-01-14] (Synaptics Incorporated -> Synaptics Incorporated)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Windows -> Microsoft Corporation)
S2 wscsvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION (no ServiceDLL)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ampa; C:\Windows\system32\ampa.sys [14448 2013-12-18] (ChengDu AoMei Tech Co., Ltd -> ) [File not signed]
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [1096704 2009-07-14] (Microsoft Windows -> Atheros Communications, Inc.)
R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRT32.sys [488448 2009-08-11] (Microsoft Windows Hardware Compatibility Publisher -> Conexant Systems Inc.)
R2 Freedom Scientific Kernel Manager; C:\Windows\System32\fsKMgr.dll [26680 2012-10-17] (Freedom Scientific Inc -> Freedom Scientific, Inc.)
U5 fsvidmir; C:\Windows\System32\Drivers\fsvidmir.sys [14368 2012-10-17] (Freedom Scientific Inc -> Freedom Scientific, Inc.)
R3 fsvidmir_service; C:\Windows\System32\DRIVERS\fsvidmir.sys [14368 2012-10-17] (Freedom Scientific Inc -> Freedom Scientific, Inc.)
R1 gtkrnl; C:\Windows\System32\drivers\gtkrnl.sys [108936 2018-04-07] (CMO SOLUTIONS LTD -> )
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17472 2017-03-30] (Glarysoft Ltd -> Glarysoft Ltd)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x86.sys [110280 2013-07-18] (Qualcomm Atheros -> Qualcomm Atheros Co., Ltd.)
R2 Sentinel; C:\Windows\System32\Drivers\sentkey.sys [15648 2013-07-24] () [File not signed]
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [35432 2016-01-14] (Synaptics Incorporated -> Synaptics Incorporated)
S3 WDC_SAM; C:\Windows\System32\DRIVERS\wdcsam.sys [11520 2008-05-06] (Microsoft Windows Hardware Compatibility Publisher -> Western Digital Technologies)
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwusb_cdcacm; system32\DRIVERS\ew_cdcacm.sys [X]
S3 hwusb_wwanecm; system32\DRIVERS\ew_wwanecm.sys [X]
U3 Partizan; system32\drivers\Partizan.sys [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam32.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard32.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-12-23 15:47 - 2019-12-23 15:47 - 000009795 _____ C:\Users\John\Desktop\FRST.txt
2019-12-23 15:41 - 2019-12-23 15:46 - 000000000 ____D C:\SecurityCheck
2019-12-23 15:39 - 2019-12-23 15:39 - 000000127 _____ C:\Users\John\Desktop\ckfiles.txt
2019-12-23 15:35 - 2019-12-23 15:35 - 000530431 _____ (glax24 (safezone.cc)) C:\Users\John\Desktop\SecurityCheck.exe
2019-12-23 15:34 - 2019-12-23 15:34 - 000468480 _____ () C:\Users\John\Desktop\CKScanner.exe
2019-12-23 13:58 - 2019-12-23 15:47 - 000000000 ____D C:\FRST
2019-12-23 13:56 - 2019-12-23 13:56 - 001989120 _____ (Farbar) C:\Users\John\Desktop\FRST.exe
2019-12-23 13:40 - 2019-12-23 13:40 - 000002574 _____ C:\Users\John\Documents\centar.reg
2019-12-23 13:39 - 2019-12-23 13:39 - 000002574 _____ C:\Users\John\Documents\ce.txt
2019-12-23 12:56 - 2012-06-01 06:47 - 000010752 _____ (Microsoft Corporation) C:\Windows\system32\wamregps.dll
2019-12-23 12:56 - 2012-06-01 06:44 - 000154624 _____ (Microsoft Corporation) C:\Windows\system32\iisRtl.dll
2019-12-23 12:56 - 2012-06-01 06:44 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\iisrstap.dll
2019-12-23 12:56 - 2012-06-01 06:43 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\admwprox.dll
2019-12-23 12:56 - 2012-06-01 06:43 - 000026624 _____ (Microsoft Corporation) C:\Windows\system32\ahadmin.dll
2019-12-23 12:56 - 2012-06-01 06:42 - 000015360 _____ (Microsoft Corporation) C:\Windows\system32\iisreset.exe
2019-12-23 12:08 - 2019-12-23 12:08 - 000000000 ____D C:\Windows\system32\BestPractices
2019-12-23 12:08 - 2019-12-23 12:08 - 000000000 ____D C:\inetpub
2019-12-23 11:51 - 2019-12-23 11:51 - 000000000 ____D C:\ProgramData\TSR7Settings
2019-12-23 11:05 - 2019-12-23 11:08 - 000001652 _____ C:\Windows\system32\ASOROSet.bin
2019-12-23 10:10 - 2019-12-23 10:10 - 000015106 _____ C:\Windows\system32\results.xml
2019-12-23 10:10 - 2019-12-23 10:10 - 000000000 ____D C:\Users\John\AppData\Roaming\Synaptics
2019-12-23 09:58 - 2019-12-23 09:58 - 000001148 _____ C:\Users\Public\Desktop\Dolby Setting.lnk
2019-12-23 09:58 - 2019-12-23 09:58 - 000000000 ____D C:\Program Files\CONEXANT
2019-12-23 09:58 - 2013-07-30 15:53 - 000053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\system32\CSVer.dll
2019-12-23 09:56 - 2019-12-23 09:56 - 000000000 ___HD C:\Program Files\InstallShield Installation Information
2019-12-23 09:56 - 2019-12-23 09:56 - 000000000 ____D C:\Windows\system32\Atheros_L1e
2019-12-23 09:56 - 2013-07-18 13:54 - 000110280 _____ (Qualcomm Atheros Co., Ltd.) C:\Windows\system32\Drivers\L1C62x86.sys
2019-12-23 09:54 - 2019-12-23 09:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2019-12-23 09:54 - 2019-12-23 09:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2019-12-23 09:54 - 2019-12-23 09:54 - 000000000 ____D C:\Program Files\Synaptics
2019-12-23 09:51 - 2019-12-23 11:03 - 000000000 ____D C:\temp
2019-12-23 07:39 - 2019-12-23 15:38 - 000000000 ____D C:\Users\John\AppData\Roaming\Systweak
2019-12-23 07:39 - 2019-12-23 07:39 - 000000000 ____D C:\Windows\Repair
2019-12-23 07:33 - 2019-12-23 15:38 - 000000000 ____D C:\ProgramData\Systweak
2019-12-23 07:22 - 2019-12-23 07:22 - 000129056 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae.sys
2019-12-23 07:22 - 2019-12-23 07:22 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-12-23 07:22 - 2019-12-23 07:22 - 000000000 ____D C:\Program Files\Malwarebytes
2019-12-23 06:56 - 2019-12-23 06:56 - 000000000 ____D C:\Users\John\AppData\LocalLow\uTorrent
2019-12-23 06:32 - 2019-12-23 09:58 - 000000000 ____D C:\Program Files\Intel
2019-12-23 06:32 - 2019-12-23 09:51 - 000000000 ____D C:\Intel
2019-12-23 06:32 - 2019-12-23 06:35 - 000000000 ____D C:\Windows\system32\MRT
2019-12-23 06:32 - 2019-12-23 06:32 - 127229528 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2019-12-23 06:32 - 2019-12-23 06:32 - 127229528 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2019-12-23 06:28 - 2016-06-25 17:43 - 000301056 _____ (Microsoft Corporation) C:\Windows\system32\EOSNotify.exe
2019-12-23 06:28 - 2011-04-09 08:13 - 003957632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2019-12-23 06:28 - 2011-04-09 08:13 - 003901824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2019-12-23 06:28 - 2011-04-09 07:56 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2019-12-23 06:28 - 2010-12-18 07:29 - 000541184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2019-12-23 06:28 - 2009-12-08 10:05 - 000310784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2019-12-23 06:28 - 2009-12-08 10:05 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2019-12-22 17:59 - 2019-12-22 22:00 - 000000000 ____D C:\Program Files\Mozilla Firefox

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-12-23 15:41 - 2019-08-09 10:00 - 000000000 ____D C:\bc
2019-12-23 15:38 - 2018-02-22 17:14 - 000000000 ____D C:\Users\John\AppData\LocalLow\Mozilla
2019-12-23 15:36 - 2018-02-22 17:14 - 000000000 ____D C:\Users\John\AppData\Roaming\Mozilla
2019-12-23 14:41 - 2009-07-14 06:34 - 000014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-12-23 14:41 - 2009-07-14 06:34 - 000014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-12-23 14:35 - 2009-07-14 06:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-12-23 13:52 - 2014-12-09 20:14 - 000000000 ____D C:\Users\John\AppData\Local\ElevatedDiagnostics
2019-12-23 13:27 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\system32\inetsrv
2019-12-23 12:36 - 2018-02-22 13:12 - 000000000 ____D C:\Users\John\AppData\Local\CrashDumps
2019-12-23 12:08 - 2014-12-01 14:39 - 000815588 _____ C:\Windows\system32\PerfStringBackup.INI
2019-12-23 12:08 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\inf
2019-12-23 11:42 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\Help
2019-12-23 11:10 - 2014-12-01 14:36 - 000000000 ____D C:\Users\John
2019-12-23 11:09 - 2009-07-14 04:03 - 033554432 _____ C:\Windows\system32\config\SOFTWARE.bak
2019-12-23 11:09 - 2009-07-14 04:03 - 016777216 _____ C:\Windows\system32\config\SYSTEM.bak
2019-12-23 11:09 - 2009-07-14 04:03 - 000024576 _____ C:\Windows\system32\config\SECURITY.bak
2019-12-23 11:07 - 2009-07-14 04:03 - 000028672 _____ C:\Windows\system32\config\SAM.bak
2019-12-23 10:26 - 2015-07-30 11:32 - 000000000 ____D C:\Users\John\AppData\Roaming\GlarySoft
2019-12-23 09:05 - 2014-12-12 13:54 - 000000000 ____D C:\Windows\Minidump
2019-12-23 07:51 - 2016-11-06 16:07 - 000000400 __RSH C:\ProgramData\ntuser.pol
2019-12-23 07:05 - 2014-12-01 17:32 - 000000000 ____D C:\Users\John\AppData\Roaming\uTorrent
2019-12-23 06:56 - 2019-04-08 22:08 - 000000000 ____D C:\Users\John\AppData\Local\BitTorrentHelper
2019-12-23 06:56 - 2018-08-09 00:43 - 000000000 ___SD C:\Users\John\AppData\LocalLow\Temp
2019-12-23 06:42 - 2015-01-24 19:33 - 000000000 ____D C:\Windows\pss
2019-12-23 06:20 - 2017-04-01 09:09 - 000057560 _____ C:\Users\John\AppData\Local\GDIPFONTCACHEV1.DAT
2019-12-23 06:19 - 2017-03-30 19:41 - 000266808 _____ C:\Windows\system32\FNTCACHE.DAT
2019-12-23 06:18 - 2009-07-14 09:49 - 000000000 ____D C:\Windows\CSC
2019-12-23 04:54 - 2009-07-14 06:53 - 000032628 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2019-12-22 22:00 - 2018-02-22 17:14 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
2019-12-22 18:10 - 2014-12-01 14:43 - 000000000 ____D C:\Windows\system32\Macromed
2019-12-15 14:36 - 2018-04-07 09:24 - 000004458 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier
2019-12-15 14:36 - 2017-08-21 15:55 - 000004324 _____ C:\Windows\system32\Tasks\Adobe Flash Player Updater
2019-12-15 14:36 - 2014-12-01 14:43 - 000842296 _____ (Adobe) C:\Windows\system32\FlashPlayerApp.exe
2019-12-15 14:36 - 2014-12-01 14:43 - 000175160 _____ (Adobe) C:\Windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories ========

2017-03-19 15:57 - 2017-03-19 15:57 - 000000001 _____ () C:\Users\John\AppData\Local\llftool.4.40.agreement

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

LastRegBack: 2019-12-22 20:21
==================== End of FRST.txt ========================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-12-2019
Ran by John (23-12-2019 15:48:13)
Running from C:\Users\John\Desktop
Windows 7 Ultimate (X86) (2014-12-01 12:36:52)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3988584367-4034529715-610683126-500 - Administrator - Disabled)
Guest (S-1-5-21-3988584367-4034529715-610683126-501 - Limited - Disabled)
John (S-1-5-21-3988584367-4034529715-610683126-1000 - Administrator - Enabled) => C:\Users\John

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\uTorrent) (Version: 3.5.5.45311 - BitTorrent Inc.)
Absolute MP3 Splitter version 2.8.7 (HKLM\...\Absolute MP3 Splitter_is1) (Version: - )
AC3Filter 2.6.0b (HKLM\...\AC3Filter_is1) (Version: 2.6.0b - Alexander Vigovsky)
Adobe Flash Player 32 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 32.0.0.303 - Adobe)
Adobe Flash Player 32 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 32.0.0.303 - Adobe)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.98.9.0 - Conexant)
Cool Edit Pro 2.1 (HKLM\...\Cool Edit Pro 2.1) (Version: - )
DC++ 0.866 (HKLM\...\DC++) (Version: 0.866 - Jacek Sieka)
FileZilla Client 3.29.0 (HKLM\...\FileZilla Client) (Version: 3.29.0 - Tim Kosse)
Free YouTube Download (HKLM\...\Free YouTube Download_is1) (Version: 4.1.4.317 - DVDVideoSoft Ltd.)
Freedom Scientific Admin Tool (HKLM\...\{9E33B8CC-B305-44F0-96FB-0D03A39CECBA}) (Version: 12.0.1062.0 - Freedom Scientific) Hidden
Freedom Scientific Admin Tool (HKLM\...\AdminTool) (Version: 12.0.1062.0 - Freedom Scientific)
Freedom Scientific Braille (HKLM\...\{967C1374-BCB3-42AA-AE08-A5C56A956ACE}) (Version: 10.18.3105.0 - Freedom Scientific) Hidden
Freedom Scientific Document Server (HKLM\...\{7E65FA7D-7F45-4C3B-80B0-FC5EF7B53153}) (Version: 10.19.4213.0 - Freedom Scientific) Hidden
Freedom Scientific Document Server (HKLM\...\{8EAD3089-C011-4C75-9322-6EB7E68C1C1B}) (Version: 12.0.1062.0 - Freedom Scientific) Hidden
Freedom Scientific Document Server (HKLM\...\{9FAB7FA0-1BCC-4F37-9EAD-5C2F05C5EAA4}) (Version: 10.18.3120.0 - Freedom Scientific) Hidden
Freedom Scientific Document Server (HKLM\...\{EDAD6EEB-C0D0-4BDF-8055-0F3244D2FE7E}) (Version: 10.20.1175.0 - Freedom Scientific) Hidden
Freedom Scientific Elevation (HKLM\...\{CA2B6BBA-5430-4388-99E8-DAC2748ED248}) (Version: 12.0.1062.0 - Freedom Scientific) Hidden
Freedom Scientific FSRibbonSrv 1.0 (HKLM\...\{9FDFA3D9-C04C-4123-811D-DBD3F574F431}) (Version: 12.0.1062.0 - Freedom Scientific) Hidden
Freedom Scientific JAWS 10.0 (HKLM\...\{70B5D5E8-9673-41B2-9168-2E4E0782DC57}) (Version: 10.0.1154.400 - Freedom Scientific) Hidden
Freedom Scientific JAWS 10.0 (HKLM\...\JAWS10.0) (Version: 10.0.1154.400 - Freedom Scientific)
Freedom Scientific Ocr (HKLM\...\{9CBFFF67-CB9F-4D77-9093-1B456381EC9D}) (Version: 12.0.112.0 - Freedom Scientific) Hidden
Freedom Scientific Ocr (HKLM\...\FSOcr) (Version: 12.0.112.0 - Freedom Scientific)
Freedom Scientific OOMHelper 1.0 (HKLM\...\{F79E654D-08F8-43F6-BCD7-0002BD09AFBE}) (Version: 1.0.0 - Freedom Scientific) Hidden
Freedom Scientific Synthesizer Eloquence (HKLM\...\{F4DA19E5-A560-4313-8623-3493DCE3C681}) (Version: 6.1.004 - Freedom Scientific)
Freedom Scientific Talking Installer 10.0 (HKLM\...\{2FD70F8A-9C87-4438-9F6F-22246EEBC4CF}) (Version: 10.0.1154.400 - Freedom Scientific)
Freedom Scientific UIAHooks 1.0 (HKLM\...\{6C654742-DA97-4B78-B1CA-A0859A9B1243}) (Version: 12.0.1062.0 - Freedom Scientific) Hidden
Freedom Scientific Utilities (HKLM\...\{1F19423A-6072-44BC-8E03-3C645ED2301F}) (Version: 10.14.000.0 - Freedom Scientific) Hidden
Freedom Scientific Video Intercept (HKLM\...\{9405D653-B254-4D6F-BE81-8B34FBCC2E5B}) (Version: 12.3.75.0 - Freedom Scientific) Hidden
Freedom Scientific Video Intercept (HKLM\...\FSVI) (Version: 12.3.75.0 - Freedom Scientific)
Freedom Scientific XQilla 2.0 (HKLM\...\{283F4698-9A83-4D53-976C-0A6D29ACC6E7}) (Version: 12.0.1062.0 - Freedom Scientific) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2869 - Intel Corporation)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 71.0 (x86 bg) (HKLM\...\Mozilla Firefox 71.0 (x86 bg)) (Version: 71.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 71.0.0.7275 - Mozilla)
NVDA (HKLM\...\NVDA) (Version: 2017.1 - NV Access)
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Revo Uninstaller 2.0.2 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.2 - VS Revo Group, Ltd.)
Sentinel System Driver Installer 7.5.0 (HKLM\...\{FAEE61D3-2A5E-4F7F-926F-77AAC08CE4DD}) (Version: 7.5.0 - SafeNet, Inc.)
Skype version 8.18 (HKLM\...\Skype_is1) (Version: 8.18 - Skype Technologies S.A.)
SoulSeek 157 NS 13e (HKLM\...\Soulseek2) (Version: - )
SpeechLab (HKLM\...\{319A3CA9-DA63-4D65-8B25-403CF9CBF087}) (Version: 1.0.0 - BACL)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.17.59 - Synaptics Incorporated)
The KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version: - )
VLC media player (HKLM\...\VLC media player) (Version: 3.0.7.1 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.666 - Nullsoft, Inc)
Windows 7 Manager (HKLM\...\{59490235-997B-40C5-A1C3-75753D52B3E8}) (Version: 5.1.9 - Yamicsoft)
WinRAR 5.50 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.50.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\wpdshserviceobj.dll (Microsoft Windows -> Microsoft Corporation)
ShellExecuteHooks: No Name - {920415EC-0595-11E7-A038-64006A5CFC35} - -> No File
ContextMenuHandlers1: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers4: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} => -> No File
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell.dll [2016-06-06] (Piriform Ltd -> Piriform Ltd)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2012-11-13] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell.dll [2016-06-06] (Piriform Ltd -> Piriform Ltd)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2017-08-11] (win.rar GmbH -> Alexander Roshal)

==================== Codecs (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [msacm.ac3filter] => C:\Windows\system32\ac3filter.acm [1679360 2013-04-05] () [File not signed]

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

Shortcut: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC++\Деинсталиране.lnk -> C:\Program Files\DC++\uninstall.exe () <==== Cyrillic
Shortcut: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC++\Лиценз.lnk -> C:\Program Files\DC++\License.txt () <==== Cyrillic
Shortcut: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC++\Помощ.lnk -> C:\Program Files\DC++\DCPlusPlus.chm () <==== Cyrillic
Shortcut: C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC++\Списък с промените.lnk -> C:\Program Files\DC++\changelog.txt () <==== Cyrillic

==================== Loaded Modules (Whitelisted) =============

2013-07-24 11:37 - 2013-07-24 11:37 - 000151552 _____ () [File not signed] C:\Program Files\BACL\SpeechLab\BACLTTSBG.dll
2009-06-09 12:38 - 2009-06-09 12:38 - 000796672 _____ (Freedom Scientific BLV Group, LLC) [File not signed] C:\Program Files\Freedom Scientific\JAWS\10.0\jfw.enu
2009-06-09 12:04 - 2009-06-09 12:04 - 000032768 _____ (Freedom Scientific BLV Group, LLC.) [File not signed] C:\Program Files\Freedom Scientific\JAWS\10.0\FSComRes.enu
2009-06-09 12:32 - 2009-06-09 12:32 - 000259864 _____ (Freedom Scientific Inc -> Freedom Scientific BLV Group, LLC) [File not signed] C:\Program Files\Freedom Scientific\JAWS\10.0\jhook.dll
2014-12-01 14:51 - 2014-12-01 14:51 - 000097280 _____ (Microsoft Corporation) [File not signed] C:\Windows\WinSxS\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1\ATL80.DLL
2014-12-01 14:51 - 2014-12-01 14:51 - 001093120 _____ (Microsoft Corporation) [File not signed] C:\Windows\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_cbf21254470d8752\MFC80U.DLL
2014-12-01 14:51 - 2014-12-01 14:51 - 000057344 _____ (Microsoft Corporation) [File not signed] C:\Windows\WinSxS\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.4053_none_03ca5532205cb096\MFC80ENU.DLL
2009-06-09 11:52 - 2009-06-09 11:52 - 000176128 _____ (SpeechWorks International, Inc.) [File not signed] C:\Program Files\Freedom Scientific\Shared\Eloquence\6.1\ECI.DLL
2009-06-09 11:52 - 2009-06-09 11:52 - 001744896 _____ (SpeechWorks International, Inc.) [File not signed] C:\Program Files\Freedom Scientific\Shared\Eloquence\6.1\enu.syn

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\drmkaud => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HdAudAddService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HDAudBus => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MMCSS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96C-E325-11CE-BFC1-08002BE10318} => ""="[6cFgE][Şοûпđ, νìδ℮ô άήδ ğªмè ¢őήťřόℓŀèґš !!! !!! !]"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{640167b4-59b0-47a6-b335-a6b3c0695aea} => ""="Portable Media Devices"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\drmkaud => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HdAudAddService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HDAudBus => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MMCSS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96C-E325-11CE-BFC1-08002BE10318} => ""="[6cFgE][Şοûпđ, νìδ℮ô άήδ ğªмè ¢őήťřόℓŀèґš !!! !!! !]"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{640167b4-59b0-47a6-b335-a6b3c0695aea} => ""="Portable Media Devices"

==================== Association (Whitelisted) =================

==================== Internet Explorer trusted/restricted ==========

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-09-06 10:56 - 2019-12-23 06:10 - 000000855 _____ C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\John\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\startupreg: cAudioFilterAgent => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{0ADA4F15-B390-48F3-BF20-4A9051C56107}] => (Allow) C:\Users\John\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [{203B729E-5768-4D4C-A9CB-93CD5E7BA2A2}] => (Allow) C:\Users\John\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [{EFAD95E1-409A-4E49-9B62-C3232653012F}] => (Allow) C:\Users\John\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [{7A6D24D5-3271-422B-8D82-1EB9D553D9FA}] => (Allow) C:\Users\John\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc -> BitTorrent Inc.)
FirewallRules: [{675DF657-98F3-44D2-B01B-068599CBDADC}] => (Allow) C:\Program Files\Winamp\winamp.exe (Nullsoft Inc. -> Nullsoft, Inc.)
FirewallRules: [{B087FEC4-B746-4E03-A1EF-29651D62F6A3}] => (Allow) C:\Program Files\Winamp\winamp.exe (Nullsoft Inc. -> Nullsoft, Inc.)
FirewallRules: [TCP Query User{09C5D1EC-6A47-438B-9B23-55B2D96C8314}C:\program files\soulseekns\slsk.exe] => (Allow) C:\program files\soulseekns\slsk.exe () [File not signed]
FirewallRules: [UDP Query User{CE2D3F75-5F2E-4E64-A69B-8B050A3AC1EA}C:\program files\soulseekns\slsk.exe] => (Allow) C:\program files\soulseekns\slsk.exe () [File not signed]
FirewallRules: [{1B5ED002-3042-4115-95FB-85ABDAEB69D2}] => (Allow) C:\Program Files\FormatFactory\FormatFactory.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{E0180607-6E77-44EF-92D8-D607674D9FCF}] => (Allow) C:\Program Files\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{24787C21-1D6D-403A-8446-5770F750E58D}] => (Allow) C:\Program Files\FormatFactory\FormatFactory.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [{44BEE44C-E3C7-47E8-BFEA-A634E59D2590}] => (Allow) C:\Program Files\FormatFactory\FFModules\Encoder\Doc\EBookCodec.exe (Free Time Co., Ltd. -> Free Time Co., Ltd.)
FirewallRules: [TCP Query User{87092C2D-0730-4368-87B8-62DE576CC4CB}C:\program files\dc++\dcplusplus.exe] => (Allow) C:\program files\dc++\dcplusplus.exe () [File not signed]
FirewallRules: [UDP Query User{1A20885C-CCF5-4F0D-A8FC-B7F644B4FA24}C:\program files\dc++\dcplusplus.exe] => (Allow) C:\program files\dc++\dcplusplus.exe () [File not signed]
FirewallRules: [TCP Query User{7D02B5F4-363E-4B33-BB93-9A977D0835E7}C:\program files\dc++\dcplusplus.exe] => (Block) C:\program files\dc++\dcplusplus.exe () [File not signed]
FirewallRules: [UDP Query User{F124AEE1-962B-49C9-91C7-14232FAD6093}C:\program files\dc++\dcplusplus.exe] => (Block) C:\program files\dc++\dcplusplus.exe () [File not signed]
FirewallRules: [{9B8D3BD4-8F6D-456C-8CEC-3729B7717C9B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{E4770264-193F-4348-AF3A-4D1272F87F23}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{008C58A5-44D9-4D01-A9B7-5F1125F04D26}] => (Allow) C:\Program Files\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{EA5402AF-5A5D-4260-B8F1-365B0EE8382E}] => (Allow) C:\Program Files\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)

==================== Restore Points =========================

ATTENTION: System Restore is disabled (Total:48.73 GB) (Free:32.27 GB) (66%)
Could not list restore points
Check "winmgmt" service or repair WMI.

==================== Faulty Device Manager Devices ============

==================== Event log errors: ========================

Application errors:
==================
Error: (12/23/2019 12:36:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 52.9.0.6746, time stamp: 0x5b2bc061
Faulting module name: mozglue.dll, version: 52.9.0.6746, time stamp: 0x5b2bbbde
Exception code: 0x80000003
Fault offset: 0x0000fb33
Faulting process id: 0xd98
Faulting application start time: 0x01d5b97cc3790755
Faulting application path: C:\Browsers\FirefoxPortable\App\firefox\plugin-container.exe
Faulting module path: C:\Browsers\FirefoxPortable\App\firefox\mozglue.dll
Report Id: 2174d39e-2570-11ea-9a6a-00269eb406b0

Error: (12/23/2019 06:19:19 AM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

Error: (12/23/2019 06:14:28 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3009) (User: John-PC)
Description: Installing the performance counter strings for service .NET Data Provider for Oracle () failed. The first DWORD in the Data section contains the error code.

Error: (12/23/2019 06:08:11 AM) (Source: WinMgmt) (EventID: 4) (User: )
Description: Error 0x8004401e encountered when trying to load MOF C:\7WORK\DVD\SOURCES\WMI_TRACING.MOF while recovering .MOF file marked with autorecover.

Error: (12/23/2019 06:08:11 AM) (Source: WinMgmt) (EventID: 4) (User: )
Description: Error 0x8004401e encountered when trying to load MOF C:\AS.MOF while recovering .MOF file marked with autorecover.

Error: (12/23/2019 06:08:11 AM) (Source: WinMgmt) (EventID: 4) (User: )
Description: Error 0x80041002 encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\TSCFGWMI.MOF while recovering .MOF file marked with autorecover.

Error: (12/23/2019 06:07:43 AM) (Source: WinMgmt) (EventID: 4) (User: )
Description: Error 0x80041002 encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\VDS.MOF while recovering .MOF file marked with autorecover.

Error: (12/23/2019 06:07:43 AM) (Source: WinMgmt) (EventID: 4) (User: )
Description: Error 0x80041002 encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\VSS.MOF while recovering .MOF file marked with autorecover.

System errors:
=============
Error: (12/23/2019 03:36:15 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1083" attempting to start the service winmgmt with arguments "" in order to run the server:
{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Error: (12/23/2019 02:38:40 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error:
The executable program that this service is configured to run in does not implement the service.

Error: (12/23/2019 02:38:40 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.

Error: (12/23/2019 02:36:29 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1083" attempting to start the service winmgmt with arguments "" in order to run the server:
{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Error: (12/23/2019 02:36:10 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1083" attempting to start the service winmgmt with arguments "" in order to run the server:
{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Error: (12/23/2019 02:36:09 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80070420'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

Error: (12/23/2019 02:36:05 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The IP Helper service depends on the Windows Management Instrumentation service which failed to start because of the following error:
The executable program that this service is configured to run in does not implement the service.

Error: (12/23/2019 01:50:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Security Center service depends on the Windows Management Instrumentation service which failed to start because of the following error:
The executable program that this service is configured to run in does not implement the service.

CodeIntegrity:
===================================

Date: 2016-09-08 11:39:14.367
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-08 11:39:14.070
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-08 01:03:02.988
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-08 01:03:02.863
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-06 07:12:19.114
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-06 07:12:18.974
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-02 20:43:24.460
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-09-02 20:43:24.336
Description:
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

BIOS: Phoenix V0.3305 08/14/2009
Motherboard: Acer BA50-MV
Processor: Intel(R) Core(TM)2 Duo CPU T7300 @ 2.00GHz
Percentage of memory in use: 58%
Total physical RAM: 3000.93 MB
Available physical RAM: 1243.35 MB
Total Virtual: 6000.13 MB
Available Virtual: 4275.33 MB

==================== Drives ================================

Drive b: (Резервирана за системата) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive c: () (Fixed) (Total:48.73 GB) (Free:32.27 GB) NTFS
Drive d: () (Fixed) (Total:416.93 GB) (Free:112.53 GB) NTFS

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 465.8 GB) (Disk ID: 7C12E647)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=48.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=416.9 GB) - (Type=07 NTFS)

==================== End of Addition.txt =======================

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 декември 20196 г.

Фикс с Farbar Recovery Scan Tool

Изтеглете прикачения файл fixlist.txt и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

Дневници

В следващия си отговор, моля да включите следните дневници:

FixLog.txt

23 декември 20196 г.

Автор

Fixlog.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 декември 20196 г.

Някаква промяна ...? Ще ви помоля след всяка стъпка да ме информирате какво е състоянието и как се държи системата ви ..!

Нови свежи дневници да изготвите...:

FRST сканиране

    Щракнете двукратно върху FRST.exe / FRST64.exe, за да го стартирате.
    Натиснете бутона за сканиране.
    Когато приключи, той ще създаде два лог файла с името FRST.txt и Addition.txt, в същата директория, от която е стартиран инструментът.
    Моля, копирайте и поставете журналите в следващия си отговор.

==============================================================================================================================

Дневници

В следващия си отговор, моля да включите (като копирате целите съдържания ) следните дневници:

FRST.txt (копирате цялото съдържание)
Addition.txt (копирате цялото съдържание)

23 декември 20196 г.

Автор

Sistemata se durji dosta po dobre, no ne moga da instaliram bulgarskiq ezik. Po tochno moga, no kato mu zadam komandite za klavishnite kombinacii za smqna na ezika vse edno ne sum mu zadal nishto. Inache naistina mnogo golqma chast ot uslugite ne rabotqt, no zasega nqma da preinstalirame.
Sega shte izgotvq i novite dnevnici.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-12-2019
Ran by John (administrator) on JOHN-PC (Acer Extensa 5235) (23-12-2019 21:02:03)
Running from C:\Users\John\Desktop
Loaded Profiles: John (Available Profiles: John)
Platform: Windows 7 Ultimate (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Freedom Scientific Inc -> Freedom Scientific BLV Group, LLC) C:\Program Files\Freedom Scientific\JAWS\10.0\jfw.exe
(Freedom Scientific Inc -> Freedom Scientific LLC.) C:\Program Files\Freedom Scientific\JAWS\10.0\fsATProxy.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated -> Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Run: [GUDelayStartup] => D:\Glary Utilities_Portable\Portable\StartupManager.exe [37152 2015-06-23] (Glarysoft Ltd -> Glarysoft Ltd)
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
BootExecute: autocheck autochk * sh4native Sh4Removal

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {65B180D4-9FF0-4049-8139-82E3692FA64E} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_303_Plugin.exe [1457720 2019-12-15] (Adobe Inc. -> Adobe)
Task: {70DF1333-5053-4E3F-AB34-C3C1F95B0A58} - System32\Tasks\{33C6514F-C6D3-4D84-886B-6C3951664A53} => C:\Program Files\NVDA\nvda.exe [45144 2017-02-22] (NV Access Limited -> NV Access)
Task: {A0244773-4A80-49D0-861F-26295EAB10C7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2019-12-15] (Adobe Inc. -> Adobe)
Task: {F7188883-9111-4897-B8BF-4EE4EF8E8A87} - System32\Tasks\{89AEC490-EE9C-440E-A8D5-C07A30381FE8} => C:\Program Files\NVDA\nvda.exe [45144 2017-02-22] (NV Access Limited -> NV Access)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4796E6B0-038D-402E-B49C-E028570C55F2}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
HKU\S-1-5-21-3988584367-4034529715-610683126-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
URLSearchHook: [S-1-5-21-3988584367-4034529715-610683126-1000] ATTENTION => Default URLSearchHook is missing
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF DefaultProfile: 2al0s2pk.default
FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\2al0s2pk.default [2019-12-23]
FF Extension: (Adblock Plus — безплатен блокер на реклами) - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\2al0s2pk.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2019-12-22]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_32_0_0_303.dll [2019-12-15] (Adobe Inc. -> )
FF Plugin: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 DigitalWave.Update.Service; C:\Program Files\Common Files\DVDVideoSoft\lib\app_updater.exe [388968 2016-03-21] (Digital Wave Ltd -> Digital Wave Ltd.) [File not signed]
S3 JTVNCProxy_10.0; C:\Program Files\Freedom Scientific\JAWS\10.0\JTVNCProxy.exe [16152 2009-06-09] (Freedom Scientific Inc -> )
S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [5570712 2019-12-23] (Malwarebytes Inc -> Malwarebytes)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [217192 2016-01-14] (Synaptics Incorporated -> Synaptics Incorporated)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Windows -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ampa; C:\Windows\system32\ampa.sys [14448 2013-12-18] (ChengDu AoMei Tech Co., Ltd -> ) [File not signed]
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [1096704 2009-07-14] (Microsoft Windows -> Atheros Communications, Inc.)
R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRT32.sys [488448 2009-08-11] (Microsoft Windows Hardware Compatibility Publisher -> Conexant Systems Inc.)
R2 Freedom Scientific Kernel Manager; C:\Windows\System32\fsKMgr.dll [26680 2012-10-17] (Freedom Scientific Inc -> Freedom Scientific, Inc.)
U5 fsvidmir; C:\Windows\System32\Drivers\fsvidmir.sys [14368 2012-10-17] (Freedom Scientific Inc -> Freedom Scientific, Inc.)
R3 fsvidmir_service; C:\Windows\System32\DRIVERS\fsvidmir.sys [14368 2012-10-17] (Freedom Scientific Inc -> Freedom Scientific, Inc.)
R1 gtkrnl; C:\Windows\System32\drivers\gtkrnl.sys [108936 2018-04-07] (CMO SOLUTIONS LTD -> )
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [17472 2017-03-30] (Glarysoft Ltd -> Glarysoft Ltd)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x86.sys [110280 2013-07-18] (Qualcomm Atheros -> Qualcomm Atheros Co., Ltd.)
R2 Sentinel; C:\Windows\System32\Drivers\sentkey.sys [15648 2013-07-24] () [File not signed]
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [35432 2016-01-14] (Synaptics Incorporated -> Synaptics Incorporated)
S3 WDC_SAM; C:\Windows\System32\DRIVERS\wdcsam.sys [11520 2008-05-06] (Microsoft Windows Hardware Compatibility Publisher -> Western Digital Technologies)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One month (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-12-23 21:02 - 2019-12-23 21:02 - 000008486 _____ C:\Users\John\Desktop\FRST.txt
2019-12-23 17:36 - 2019-12-23 17:37 - 000006148 _____ C:\Users\John\Desktop\Fixlog.txt
2019-12-23 15:56 - 2019-12-23 15:56 - 000000127 _____ C:\Users\John\Desktop\ckfiles.txt
2019-12-23 15:41 - 2019-12-23 15:46 - 000000000 ____D C:\SecurityCheck
2019-12-23 15:35 - 2019-12-23 15:35 - 000530431 _____ (glax24 (safezone.cc)) C:\Users\John\Desktop\SecurityCheck.exe
2019-12-23 15:34 - 2019-12-23 15:34 - 000468480 _____ () C:\Users\John\Desktop\CKScanner.exe
2019-12-23 13:58 - 2019-12-23 21:02 - 000000000 ____D C:\FRST
2019-12-23 13:56 - 2019-12-23 13:56 - 001989120 _____ (Farbar) C:\Users\John\Desktop\FRST.exe
2019-12-23 13:40 - 2019-12-23 13:40 - 000002574 _____ C:\Users\John\Documents\centar.reg
2019-12-23 13:39 - 2019-12-23 13:39 - 000002574 _____ C:\Users\John\Documents\ce.txt
2019-12-23 12:56 - 2012-06-01 06:47 - 000010752 _____ (Microsoft Corporation) C:\Windows\system32\wamregps.dll
2019-12-23 12:56 - 2012-06-01 06:44 - 000154624 _____ (Microsoft Corporation) C:\Windows\system32\iisRtl.dll
2019-12-23 12:56 - 2012-06-01 06:44 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\iisrstap.dll
2019-12-23 12:56 - 2012-06-01 06:43 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\admwprox.dll
2019-12-23 12:56 - 2012-06-01 06:43 - 000026624 _____ (Microsoft Corporation) C:\Windows\system32\ahadmin.dll
2019-12-23 12:56 - 2012-06-01 06:42 - 000015360 _____ (Microsoft Corporation) C:\Windows\system32\iisreset.exe
2019-12-23 12:08 - 2019-12-23 12:08 - 000000000 ____D C:\Windows\system32\BestPractices
2019-12-23 12:08 - 2019-12-23 12:08 - 000000000 ____D C:\inetpub
2019-12-23 11:51 - 2019-12-23 11:51 - 000000000 ____D C:\ProgramData\TSR7Settings
2019-12-23 11:05 - 2019-12-23 11:08 - 000001652 _____ C:\Windows\system32\ASOROSet.bin
2019-12-23 10:10 - 2019-12-23 10:10 - 000015106 _____ C:\Windows\system32\results.xml
2019-12-23 10:10 - 2019-12-23 10:10 - 000000000 ____D C:\Users\John\AppData\Roaming\Synaptics
2019-12-23 09:58 - 2019-12-23 09:58 - 000001148 _____ C:\Users\Public\Desktop\Dolby Setting.lnk
2019-12-23 09:58 - 2019-12-23 09:58 - 000000000 ____D C:\Program Files\CONEXANT
2019-12-23 09:58 - 2013-07-30 15:53 - 000053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\system32\CSVer.dll
2019-12-23 09:56 - 2019-12-23 09:56 - 000000000 ___HD C:\Program Files\InstallShield Installation Information
2019-12-23 09:56 - 2019-12-23 09:56 - 000000000 ____D C:\Windows\system32\Atheros_L1e
2019-12-23 09:56 - 2013-07-18 13:54 - 000110280 _____ (Qualcomm Atheros Co., Ltd.) C:\Windows\system32\Drivers\L1C62x86.sys
2019-12-23 09:54 - 2019-12-23 09:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2019-12-23 09:54 - 2019-12-23 09:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2019-12-23 09:54 - 2019-12-23 09:54 - 000000000 ____D C:\Program Files\Synaptics
2019-12-23 09:51 - 2019-12-23 11:03 - 000000000 ____D C:\temp
2019-12-23 07:39 - 2019-12-23 15:38 - 000000000 ____D C:\Users\John\AppData\Roaming\Systweak
2019-12-23 07:39 - 2019-12-23 07:39 - 000000000 ____D C:\Windows\Repair
2019-12-23 07:33 - 2019-12-23 15:38 - 000000000 ____D C:\ProgramData\Systweak
2019-12-23 07:22 - 2019-12-23 07:22 - 000129056 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbae.sys
2019-12-23 07:22 - 2019-12-23 07:22 - 000000000 ____D C:\ProgramData\Malwarebytes
2019-12-23 07:22 - 2019-12-23 07:22 - 000000000 ____D C:\Program Files\Malwarebytes
2019-12-23 06:56 - 2019-12-23 06:56 - 000000000 ____D C:\Users\John\AppData\LocalLow\uTorrent
2019-12-23 06:32 - 2019-12-23 09:58 - 000000000 ____D C:\Program Files\Intel
2019-12-23 06:32 - 2019-12-23 09:51 - 000000000 ____D C:\Intel
2019-12-23 06:32 - 2019-12-23 06:35 - 000000000 ____D C:\Windows\system32\MRT
2019-12-23 06:32 - 2019-12-23 06:32 - 127229528 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2019-12-23 06:32 - 2019-12-23 06:32 - 127229528 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2019-12-23 06:28 - 2016-06-25 17:43 - 000301056 _____ (Microsoft Corporation) C:\Windows\system32\EOSNotify.exe
2019-12-23 06:28 - 2011-04-09 08:13 - 003957632 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2019-12-23 06:28 - 2011-04-09 08:13 - 003901824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2019-12-23 06:28 - 2011-04-09 07:56 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2019-12-23 06:28 - 2010-12-18 07:29 - 000541184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2019-12-23 06:28 - 2009-12-08 10:05 - 000310784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2019-12-23 06:28 - 2009-12-08 10:05 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2019-12-22 17:59 - 2019-12-22 22:00 - 000000000 ____D C:\Program Files\Mozilla Firefox

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-12-23 21:01 - 2018-02-22 17:14 - 000000000 ____D C:\Users\John\AppData\Roaming\Mozilla
2019-12-23 18:52 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\rescache
2019-12-23 18:23 - 2019-08-24 20:37 - 000000000 ____D C:\Users\John\AppData\Roaming\vlc
2019-12-23 18:22 - 2019-08-15 22:30 - 000001024 _____ C:\Users\Public\Desktop\VLC media player.lnk
2019-12-23 18:13 - 2018-02-22 17:14 - 000000000 ____D C:\Users\John\AppData\Local\Mozilla
2019-12-23 17:45 - 2009-07-14 06:34 - 000014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-12-23 17:45 - 2009-07-14 06:34 - 000014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-12-23 17:40 - 2016-11-06 16:07 - 000000008 __RSH C:\ProgramData\ntuser.pol
2019-12-23 17:40 - 2009-07-14 06:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-12-23 17:36 - 2019-08-09 10:00 - 000000000 ____D C:\bc
2019-12-23 17:36 - 2015-08-19 17:45 - 000000000 ____D C:\Windows\system32\Tasks\AVAST Software
2019-12-23 17:36 - 2009-07-14 04:37 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2019-12-23 17:09 - 2019-04-09 23:57 - 000000000 ____D C:\Users\John\Documents\The KMPlayer
2019-12-23 15:38 - 2018-02-22 17:14 - 000000000 ____D C:\Users\John\AppData\LocalLow\Mozilla
2019-12-23 13:52 - 2014-12-09 20:14 - 000000000 ____D C:\Users\John\AppData\Local\ElevatedDiagnostics
2019-12-23 13:27 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\system32\inetsrv
2019-12-23 12:36 - 2018-02-22 13:12 - 000000000 ____D C:\Users\John\AppData\Local\CrashDumps
2019-12-23 12:08 - 2014-12-01 14:39 - 000815588 _____ C:\Windows\system32\PerfStringBackup.INI
2019-12-23 12:08 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\inf
2019-12-23 11:42 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\Help
2019-12-23 11:10 - 2014-12-01 14:36 - 000000000 ____D C:\Users\John
2019-12-23 11:09 - 2009-07-14 04:03 - 033554432 _____ C:\Windows\system32\config\SOFTWARE.bak
2019-12-23 11:09 - 2009-07-14 04:03 - 016777216 _____ C:\Windows\system32\config\SYSTEM.bak
2019-12-23 11:09 - 2009-07-14 04:03 - 000024576 _____ C:\Windows\system32\config\SECURITY.bak
2019-12-23 11:07 - 2009-07-14 04:03 - 000028672 _____ C:\Windows\system32\config\SAM.bak
2019-12-23 10:26 - 2015-07-30 11:32 - 000000000 ____D C:\Users\John\AppData\Roaming\GlarySoft
2019-12-23 09:05 - 2014-12-12 13:54 - 000000000 ____D C:\Windows\Minidump
2019-12-23 07:05 - 2014-12-01 17:32 - 000000000 ____D C:\Users\John\AppData\Roaming\uTorrent
2019-12-23 06:56 - 2019-04-08 22:08 - 000000000 ____D C:\Users\John\AppData\Local\BitTorrentHelper
2019-12-23 06:56 - 2018-08-09 00:43 - 000000000 ___SD C:\Users\John\AppData\LocalLow\Temp
2019-12-23 06:42 - 2015-01-24 19:33 - 000000000 ____D C:\Windows\pss
2019-12-23 06:20 - 2017-04-01 09:09 - 000057560 _____ C:\Users\John\AppData\Local\GDIPFONTCACHEV1.DAT
2019-12-23 06:19 - 2017-03-30 19:41 - 000266808 _____ C:\Windows\system32\FNTCACHE.DAT
2019-12-23 06:18 - 2009-07-14 09:49 - 000000000 ____D C:\Windows\CSC
2019-12-23 04:54 - 2009-07-14 06:53 - 000032628 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2019-12-22 22:00 - 2018-02-22 17:14 - 000000000 ____D C:\Program Files\Mozilla Maintenance Service
2019-12-22 18:10 - 2014-12-01 14:43 - 000000000 ____D C:\Windows\system32\Macromed
2019-12-15 14:36 - 2018-04-07 09:24 - 000004458 _____ C:\Windows\system32\Tasks\Adobe Flash Player NPAPI Notifier
2019-12-15 14:36 - 2017-08-21 15:55 - 000004324 _____ C:\Windows\system32\Tasks\Adobe Flash Player Updater
2019-12-15 14:36 - 2014-12-01 14:43 - 000842296 _____ (Adobe) C:\Windows\system32\FlashPlayerApp.exe
2019-12-15 14:36 - 2014-12-01 14:43 - 000175160 _____ (Adobe) C:\Windows\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories ========

2017-03-19 15:57 - 2017-03-19 15:57 - 000000001 _____ () C:\Users\John\AppData\Local\llftool.4.40.agreement

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

LastRegBack: 2019-12-22 20:21
==================== End of FRST.txt ========================Addition.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

23 декември 20196 г.

Последните дневници не показват наличие на активен зловреден софтуер..! Да направим контролни проверки:

Сканиране с AdwCleaner

Изтеглете AdwCleaner и го запишете на вашия работен плот.

Кликнете два пъти върху AdwCleaner.exe, за да го стартирате.
Кликнете върху Сканиране (Scan Now ) ...

- Когато сканирането приключи, ще се отвори прозорецът с резултати от сканиране.
- Кликнете върху Отказ ( Cancel ) (в този момент не се опитвайте да поставите под карантина нищо, което е намерено)

Сега щракнете върху раздела Log Files ...

- Кликнете два пъти върху най-новия дневник на сканиране (в дневниците за сканиране има префикс [S0 *], където * се заменя с число)
- Ще се отвори файл , съдържащ резултатите от сканирането.

Моля, публикувайте съдържанието на файла в следващия си отговор.

ESET онлайн скенер

Изтеглете ESET Online Scanner и го запишете на вашия работен плот.

Щракнете с десния бутон върху esetonlinescanner_enu.exe и изберете Run as Administrator ( Изпълни като администратор).
Когато инструментът се отвори, щракнете върху Get Started ( Започнете).
Прочетете и приемете лицензионното споразумение.
В прозореца Welcome to ESET Online Scanner щракнете върху Get Started (Започнете).
Изберете дали искате да изпратите анонимни данни на ESET.
Забележка: Ако видите екрана Welcome Back to ESET Online Scanner" (Добре дошли в онлайн скенера на ESET) , щракнете върху Computer Scan ( Сканиране на компютър ) > Full Scan (Пълно сканиране).
Кликнете върху опцията за Full Scan ( Пълно сканиране).
Изберете Enable ESET to detect and remove potentially unwanted applications (Активиране на ESET, за да открие и премахне потенциално нежелани приложения), след което щракнете върху Start scan (Старт на сканиране).
ESET ще започне да сканира вашия компютър. Това може да отнеме известно време.
Когато сканирането приключи и ако са открити заплахи, изберете Save scan log (Запазване на дневника на сканиране). Запазете го на работния плот като eset.txt. Кликнете върху Continue (Продължи).
ESET Онлайн скенер може да попита дали искате да включите функцията за периодично сканиране. Кликнете върху Continue ( Продължи).
На следващия екран можете да оставите отзиви за програмата, ако желаете. Поставете отметка в квадратчето за Delete application data on closing ( изтриване на данни от приложението при затваряне). Ако оставите обратна връзка, щракнете върху Submit and continue (Изпращане и продължете). Ако не, Close without feedback (Затворете без обратна връзка).
Отворете дневника от сканирането от вашия работен плот (eset.txt) и копирайте и поставете съдържанието му в следващия си отговор.

===============================================================================================================================================

В следващия си отговор, моля, включете:

AdwCleaner [S0 *]. ТХТ
eset.txt

24 декември 20196 г.

Автор

Dobro utro! Eto i vuprosnite dnevnici. Eset izchisti 9 neshta.

Eset.txt

AdwCleaner[S00].txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

24 декември 20196 г.

Добро утро...! :)

AdwCleaner - почистване

Кликнете два пъти върху AdwCleaner.exe, за да го стартирате.
Щракнете върху Scan Now (Сканиране )
Когато сканирането приключи, ще се отвори прозорецът с резултати от сканиране.
Моля, уверете се, че всички квадратчета са маркирани и щракнете върху Quarantine ( Карантина)

- Щракнете върху Next ( Напред)

- Ако на вашето устройство е намерен някакъв предварително инсталиран софтуер, ще се отвори прозорец с подкана ...

- Кликнете върху OK, за да го затворите

- Проверете всички предварително инсталирани софтуерни елементи, които искате да премахнете (ако не ви създават проблем, препоръчвам да не избирате никакви)

- Кликнете върху Quarantine (Карантина)

Ще се появи подкана да запазите работата си ...

- Щракнете върху Continue (Продължи) , когато сте готови да продължите.

Ще се появи подкана за рестартиране на вашия компютър ...

- Щракнете върху Restart Now (Рестартиране сега)

След като компютърът ви се рестартира ...

- Ако не се отвори автоматично, моля, стартирайте ADWCleaner ...

- Кликнете върху раздела Log Files ( Файлове...)

- Щракнете двукратно върху най-новия дневник ( дневници имат префикс [C0 *], където * се заменя с число, най-новото сканиране ще има най-голям брой)

- Ще се отвори файл , съдържащ резултатите от премахването.

- Моля, публикувайте съдържанието на файла в следващия си отговор.

=====================================================================================================================================================

В следващия си отговор, моля, включете:

AdwCleaner [C0 *]. ТХТ

24 декември 20196 г.

Автор

Zapovqdai! Inache sistemata se durji dosta po dobre ot purvonachalnoto!AdwCleaner[C01].txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

24 декември 20196 г.

Чудесно..!

Фикс с Farbar Recovery Scan Tool

Изтеглете прикачения файл fixlist.txt и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

+

Моля изтеглете Farbar Service Scanner и я стартирайте.

Сложете всички отметки и натиснете бутона "Scan".
Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента.
Копирайте съдържанието на лог файла в следващия си пост.

+

Сканиране с SecurityCheck by glax24

Изтеглете SecurityCheck by glax24 от тук и запомнете инструмента на десктопа .
Стартирате програмата (ако използвате Windows XP) или стартирате с десен бутон на мишката от името на администратор (ако използватеWindows Vista/7/8/10)
Изчакайте да приключи сканирането.Ще се отвори в текстов файл с име SecurityCheck.txt. Копирайте съдържанието на този файл следващия си пост
Можете да намерите този файл в основната директория на системния диск в папка с име SecurityCheck, напр. C:\SecurityCheck\SecurityCheck.txt

Дневници

В следващия си отговор, моля да включите следните дневници:

FixLog.txt
FSS.txt
SecurityCheck.txt

24 декември 20196 г.

Автор

Predi da postna dnevnicite iskam da ti blagodarq Ico za ogromnata pomosht! Na vsichki ot foruma pojelavame az i jena mi Veseli praznici! Da ste jivi, zdravi, mnogo usmihnati i shtastlivi! Prez novata godina mnogo kusmet i kolkoto se moje po malko qdove!

SecurityCheck.txt

Fixlog.txt FSS.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 декември 20196 г.

Фикс с Farbar Recovery Scan Tool

Изтеглете прикачения файл fixlist.txt и го запазете там, където сте свалили FRST.exe
Стартирайте отново FRST.exe и натиснете бутона Fix веднъж и изчакайте.

Ще се създаде нов лог файла FixLog.txt. Прикачете съдържанието му в следващия си коментар.

ЗАБЕЛЕЖКА: Този скрипт е написан специално за този потребител,и за тази конкретна машина. Изпълнението на фикса, на друг компютър може да доведе до увреждане на операционната ви система

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 декември 20196 г.

+

Изтеглете на вашия Desktop тези .reg файлове, от тази страница с услуги на Windows 7 ( http://download.bleepingcomputer.com/win-services/7/ )

wscsvc.reg

Winmgmt.reg

Стартирайте файловете един по един като след всяко стартиране на файл - рестартирате и вашия компютър..

След това подгответе свеж дневник с програмата:

Моля изтеглете Farbar Service Scanner и я стартирайте.

Сложете всички отметки и натиснете бутона "Scan".
Ще се създаде лог файл с името (FSS.txt) в папката откъдето стартирате инструмента.
Копирайте съдържанието на лог файла в следващия си пост.

Дневници

В следващия си отговор, моля да включите следните дневници:

FixLog.txt
FSS.txt

26 декември 20196 г.

Автор

Оправих си кирилицата, така, че няма да се тормозите с мойте писания.

Ето и въпросните дневници!FSS.txt

Fixlog.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 декември 20196 г.

Супер ...и другите услуги са вече са наред..! Така ..сега следва да видим какво става със системните файлове:

System File Checker (SFC)

Натиснете клавишна комбинация Windows + R. Това ще отвори полето Run.
Напишете CMD и натиснете клавишна комбинация Ctrl + Shift + Enter, за да отворите command prompt като администратор
В командния ред копирайте :

Цитат

sfc /scannow

.... и натиснете Enter.

SFC ще започне да сканира вашата система за повредени системни файлове. Това може да отнеме известно време.

След като приключи, моля, отворете командния ред, като натиснете клавишна комбинация Windows + R, въведете cmd и натиснете Enter, след което поставете съдържанието на полето по-долу в Command Prompt.

Цитат


findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >> "%userprofile%\desktop\sfcdetails.txt"

Натиснете Enter, след като го поставите в командния ред.

След като процедурата завърши, файлът, наречен sfcdetails.txt ще бъде запазен на работния ви плот. Моля, публикувайте го в следващия си отговор.

Дневници

В следващия си отговор, моля да включите следните дневници:

sfcdetails.txt

26 декември 20196 г.

Автор

Заповядай!sfcdetails.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 декември 20196 г.

Как е пациента сега ...преди да продължим ....?!?

Цитат

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 24.12.2019 17:54:25
Path starting: C:\Users\John\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: John
VersionXML: 7.04is-23.12.2019
___________________________________________________________________________

Windows 7(6.1.7600) (x86) Ultimate Lang: English(0409)
Installation date OS: 01.12.2014 12:36:52
Boot Mode: Normal
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
SystemDrive: 😄 FS: [NTFS] Capacity: [48.7 Gb] Used: [15.4 Gb] Free: [33.3 Gb]
------------------------------- [ Windows ] -------------------------------
Service Pack not Installed Warning! Download Update
Possible re-activation of Windows will be needed.
Internet Explorer 8.0.7600.16385 Warning! Download Update
Online installation. Last version available when Windows update is enabled throught the Internet.
User Account Control disabled (Level 1)
^It is recommended to enable (default): Win+R typing UserAccountControlSettings and Enter^
Never check for updates
Date install updates: 2019-12-23 11:05:12
Windows Update (wuauserv) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service is running
World Wide Web Publishing Service (W3SVC) - The service is running
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
System Restore Disable
------------------------------- [ HotFix ] --------------------------------
HotFix KB3177467 Warning! Download Update
HotFix KB3125574 Warning! Download Update
HotFix KB4012212 Warning! Download Update
HotFix KB4499175 Warning! Download Update
HotFix KB4474419 Warning! Download Update
HotFix KB4490628 Warning! Download Update
HotFix KB4512486 Warning! Download Update
HotFix KB4530734 Warning! Download Update
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ OtherUtilities ] ----------------------------
FileZilla Client 3.29.0 v.3.29.0 Warning! Download Update
VLC media player v.3.0.8
-------------------------------- [ Arch ] ---------------------------------
WinRAR 5.50 (32-bit) v.5.50.0 Warning! Download Update
--------------------------------- [ IM ] ----------------------------------
Skype version 8.18 v.8.18 Warning! Download Update
--------------------------------- [ P2P ] ---------------------------------
µTorrent v.3.5.5.45311 Warning! P2P-client.
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 32 ActiveX v.32.0.0.303
Adobe Flash Player 32 NPAPI v.32.0.0.303
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox 71.0 (x86 bg) v.71.0
------------------ [ AntivirusFirewallProcessServices ] -------------------
MBAMService (MBAMService) - The service has stopped
Windows Defender (WinDefend) - The service is running
Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

Тук нещатат също не са добре ...! Операционната ви система е не е обновявана защото Windows Update са изключени:

Цитат

Never check for updates

Нямате инсталиран Service Pack..!

За тази цел горещо ви препоръчвам да използвате UpdatePack7R2 для Windows 7 SP1 и Server 2008 R2 SP1 на simplix

Този пакет помага лесно да обновите операционната система до етапа на действителното състояние. Значително елиминира времето за обновяване, за разлика от Windows Update. Съдържа уникални алгоритми за по-бързо търсене и анализ на актуализации.Пакета може да се използва за актуализиране на всяко издание на Windows 7.

Пакета поддържа както 32-битови, така и 64-битови системи, актуализациите са многоезични.
Той е преносим и може да се използва без интернет връзка.
Всички актуализации са внимателно тествани и оценени, преди да бъдат добавени към пакета.
Той съдържа актуализации за всички версии на IE, включително IE11 с всички езици.
Нежеланите актуализации (шпионски софтуер, получаване на Windows 10) са изключени от пакета.
Той опростява процеса на пълното актуализиране на Windows.

26 декември 20196 г.

Автор

Доктор Тонев, златен си! Пациентът е направо пушка! Ти го съживи от смъртта, а сега и като пусна пакета дето прати за ъпдейта и ще пиша после за резултата!

Всичко е 6, има само още една грешка. Като натисна да отворя нещо и се бави известно време, след което излиза надписа: Explorer.EXE
Server execution failed
OK

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

26 декември 20196 г.

Хе ...утре ще се опитам да го оправиме и това..! Между другото тук в този урок показват как може да се поправи проблема:

https://www.thewindowsclub.com/fix-explorer-exe-server-execution-failed-on-windows-7

...и понеже се пипа в регистрите задължително преди да правиш каквото и да е - backup of your registry

27 декември 20196 г.

Автор

Добро утро! Този урок съм го гледал, ама съм стигал до снимката и дотам. Защото аз съм незрящ и говорящата програма не чете надписите които са по снимки, графики или гифове. Иначе благодаря много!

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

28 декември 20196 г.

Цитат

System Restore Disable

Включете System Restore задължително ...! Изтеглете Enable_System_Restore.reg , и го запазете на вашия на работния плот . Щракнете два пъти върху изтегления .reg файл и маркирайте merge ...! Когато бъдете подканени, кликнете върху Пусни, Да (UAC), Да и OK, за да одобрите сливането. После можете да изтриете изтегления .reg файл, ако желаете .

След рестарта на компютъра създайте точка за възстановяване на системата:

https://www.lifewire.com/how-to-use-system-restore-in-windows-2626131

След това направете бекъп на вашите регистри:

https://www.thewindowsclub.com/backup-restore-and-opimize-windows-registry-with-new-eruntgui

...и чак сега много внимателно:

Натиснете + R и поставете regedit в диалоговия прозорец и шракнете върху OK.

В левия прозорец на редактора на системния регистър отидете на следния ключ на системния регистър

Цитат


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

В десния прозорец, , навигирайте надолу и потърсете SeparateProcess с име DWORD на регистъра (REG_DWORD). Той най - вероятно ще бъде настроен на 1. Кликнете два пъти върху DWORD, за да промените неговите стойности.. В Редактиране на стойност на DWORD поставете 0 като стойност и щракнете върху ОК. Затворете редактора на системния регистър. Рестартирайте вашата система и пишете дали проблемът е решен.

Инструкцията е преведена от тук:

https://www.kapilarya.com/fix-server-execution-failed-error-in-windows-10

28 декември 20196 г.

Автор

Ицо! Златен си! Всичко вече е 6 точки, така, че можеш да маркираш случая за приключен. :) Много големи благодарности! А иначе скоро ще ви занимавам, бях послушен тая година и дядо Коледа ми подари нов комп, ама още го чакам понеже каляската с елените закъса щото нямаме сняг и им даде голям зор. :) Ама то ще е за друг раздел от форума, щото става въпрос как на чисто нов комп да инсталирам доброто старо XP.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

28 декември 20196 г.

преди 1 минута, Ivan Zangagolev написа:

Ицо! Златен си! Всичко вече е 6 точки, така, че можеш да маркираш случая за приключен.

Благодарая..! ..но имаме още малко работа ....! Да премахнем всичко което използвахме в процеса на работа и приключваме..!

KpRm

Изтеглете KpRm от kernel-panik и го запишете на вашия работен плот.

Щракнете с десния бутон върху kprm_ (версия) .exe и изберете Изпълни като администратор.
Когато инструментът се отвори, уверете се, че всички квадратчета са отметнати и изберете Изпълни ( Run ).

След като приключите, щракнете върху OK.
В Notepad ще се отвори журнал, озаглавен kprm- (date) .txt.
Моля, копирайте и поставете съдържанието му в следващия си отговор.

Добре дошли!

Проблемен Windows 7 ..! Вероятен вирус..?

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)