Здравей. Имам 64-битов лаптоп с Windows 10, чийто основен AV е Defender.
Източник на инфекцията е СПАМ. Defender идентифицира зловреден софтуер веднага, когато докоснах файла в Thunderbird. Открих, че получавам множество нежелани съобщения с тема, започваща с долна черта (_) и всеки път, когато имейлът пристигаше във входящата ми кутия, предупреждаваше Defender. Проблемът беше, че Defender обикновено се опитваше да премахне или постави под карантина, но последното резюме беше това
trojan.JPG 57,7 KB0 изтегляния
Най-накрая го контролирах, като влязох в уеб пощата си и изтрих всички съобщения с _subject от сървъра на доставчиците, преди да ги изтегля на моя лаптоп. Използвах и инструментите за спам на доставчиците, за да отхвърля всяка тема, започваща с долна черта. Не съм сигурен дали това ще го покрие, но днес няма _subjects. Отново дишам, тъй като тази заплаха е описана като колектор на пароли. Но това е грозно импровизирано решение и Defender ме оставя с неясен статус Remediation Incomplete. Нито Housecall, нито MBAM можеха да видят вируса, когато сканирах с тях.
Друг симптом беше, че след първия сигнал от Defender започнах да изпитвам затруднения да виждам имейлите си във входящата кутия (всички празни) и не можах да изпразня кошчето. Системата отговори със странното съобщение „Няма достатъчно дисково пространство за изтегляне на нови съобщения“. За съжаление не съм направил екранна снимка и не съм сигурен дали е съобщение на Thunderbird или Windows.
В крайна сметка единственото нещо, което премахна червения X от Defender, беше офлайн сканиране. Благодаря.
Е, ето го FRST:
Резултат от сканиране на Farbar Recovery Scan Tool (FRST) (x64) Версия: 13-04-2022 01Изпълни се от cope (администратор) на LAPTOP-PV813QTR (LENOVO 80X4) (14-04-2022 21:04:50) Изпълнява се от C: \Users\cope\DownloadsLoaded Profiles: copeПлатформа: Microsoft Windows 10 Home Version 21H2 19044.1645 (X64) Език: Английски (САЩ) Браузър по подразбиране: Chrome Режим на стартиране: Нормален ================== ==== Процеси (в белия списък) ================= (Ако запис е включен в списъка с корекции, процесът ще бъде затворен. Файлът няма да бъде преместен.) ( Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe(C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe -> ;) (Node.js Foundation -> Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\libs\node.exe(C:\Program Files (x86)\Common Files\Adobe\ Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe(C:\Program Files (x86) )\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe(C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe(C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe -> ;) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe(C:\Program Files\Adobe\Adobe Creative Cloud \ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe <2>(C :\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe ->) (Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Creative Cloud Libraries\CCLibrary.exe (C:\Program Files\Common Files\Adobe\Creative Cloud Libraries\CCLibrary.exe ->) (Node.js Foundation -> Node.js) C:\Program Files\Common Files\Adobe\Creative Cloud Libraries\ libs\node.exe(C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe <3>(C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCopyAccelerator.exe(C:\Windows\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe -> ;) (Lenovo -> Lenovo Group Ltd.) C:\Windows\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe <3>(C:\Windows\Lenovo\ImController\Service\ Lenovo.Modern.ImController.exe ->) (Lenovo -> Lenovo Group Ltd.) C:\Windows\Lenovo\ImController\PluginHost86\Lenovo.Modern.ImController.PluginHost.Device.exe(explorer.exe -> ) (Dolby Laboratories, Inc. -> ) C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files ( x86)\Google\Chrome\Application\chrome.exe <17>(explorer.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(explorer.exe ->) (SatoshiLabs, s.r.o. -> ) C:\Program Files (x86)\TREZOR Bridge\trezord.exe( Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7948ecc1af5c27e1\igfxEM.exe(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Файлове (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\ Adobe\ARM\1.0\armsvc.exe(services.exe ->) (Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe(services .exe ->) (Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe(services.exe ->) (Apple Inc. - > Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(services.exe ->) (Dolby Laboratories, Inc. -> Dolby Laboratories, Inc.) C:\Program Files\Dolby\Dolby DAX2 \DAX2_API\DolbyDAX2API.exe(services.exe ->) (Intel Corporation - pGFX -> Intel Corporation) C:\Windows\System32\ibtsiva.exe(services.exe ->) (Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7948ecc1af5c27e1\igfxCUIService.exe( services.exe ->) (Intel® pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7948ecc1af5c27e1\IntelCpHDCPSvc.exe(services.exe ->) (Intel® pGFX ->Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7948ecc1af5c27e1\IntelCpHeciSvc.exe(services.exe ->) (Intel® Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel ® Rapid Storage Technology\IAStorDataMgrSvc.exe(services.exe ->) (Lenovo -> Lenovo Group Ltd.) C:\Windows\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe(services.exe -> ;) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\ Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\Locator.exe(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\NisSrv.exe(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Program Files\Realtek \Audio\HDA\RtkAudioService64.exe(svchost.exe ->) (Adobe Systems Incorporated) C:\Program Files\WindowsApps\AdobeNotificationClient_1.0.1.22_x86__enpm4xejd91yc\AdobeNotificationClient.exe(svchost.exe ->) (Microsoft Corporation - > Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings. exe(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C :\Windows\System32\smartscreen.exe(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe =============== ====== Регистър (в белия списък) ==================== (Ако даден запис е включен в списъка с корекции, елементът в системния регистър ще бъде възстановен по подразбиране или премахнат. Файлът няма да бъде преместен.) HKLM\...\Run: [LenovoUtility] => C:\Program Files\Lenovo\LenovoUtility\utility.exe [791848 2017-05-25] (LENOVO -> )HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [19677488 2020-04-16] (Realtek Semiconductor Corp. -> Realtek Semiconductor)HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [3617584 2020-04-16] (Realtek Semiconductor Corp. -> Realtek Semiconductor)HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [3617584 2020-04-16] (Realtek Semiconductor Corp. -> Realtek Semiconductor)HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-11] (Adobe Systems Incorporated -> Adobe Systems Incorporated)HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3426560 2021-11-23] (Adobe Inc. -> Adobe Systems, Incorporated)HKLM\...\Изпълни: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [321592 2019-03-11] (Intel® Rapid Storage Technology -> Intel Corporation)HKLM\...\Run: [DAX2_APP] => ; C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [849928 2016-09-19] (Dolby Laboratories, Inc. -> )HKLM-x32\...\Изпълни: [Adobe Creative Cloud] = > C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2084920 2019-09-27] (Adobe Inc. -> Adobe Inc.)HKU\S-1-5-21-313246963-3037881445 -1802910-1001\...\Изпълни: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [35888256 2022-03-10] (Piriform Software Ltd -> Piriform Software Ltd)HKU\S-1-5-21-313246963-3037881445-1802910-1001\.. .\Изпълни: [CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [144008 2019-10-22] (Adobe Inc. -> Adobe Systems Incorporated)HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\100.0.4896.88\Installer\chrmstp.exe [2022-04-11] (Google LLC -> Google LLC) Стартиране: C:\ProgramData\Microsoft\Windows \Start Menu\Programs\Startup\TREZOR Bridge.lnk [2019-11-20]ShortcutTarget: TREZOR Bridge.lnk -> C:\Program Files (x86)\TREZOR Bridge\trezord.exe (SatoshiLabs, s.r.o. -> )GroupPolicy: Ограничение? <==== ВНИМАНИЕПравила: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ ===================== Планирани задачи (в белия списък) ============ (Ако даден запис е включен в списъка с корекции, той ще бъде премахнат от системния регистър. Файлът няма да бъде преместен, освен ако не е посочен отделно.) Задача: {01694321-4C2C-4B51-A741-C99F3943D56A} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\469cb482-fd66-4cac-a870-9e68a5ff8e59 => C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [84240 2022-01-28] (Lenovo -> Lenovo Group Ltd.) Задача: {0209A36C-E368-4F8F-96C7-809B70BCC558} - System32\Tasks\Optimize Push Notification Data File-S-1-5-21-313246963-3037881445-1802910-1001 => {201600D8-6EFF-48CE-B842-E14D37A0682D} C:\WINDOWS\System32\wpninprc.dll [24064 2019-12-07] (Microsoft Windows -> Microsoft Corporation) Задача: {039F46E7-8402-4106-B901-FA84A31F9D5 } - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3426560 2021-11-23] (Adobe Inc. -> Adobe Systems, Incorporated) Задача: {0427B744-2090-47A1-AA79- 457E90E93D2A} - System32\Tasks\CCleanerSkipUAC - справяне => C:\Program Files\CCleaner\CCleaner.exe [30053504 2022-03-10] (Piriform Software Ltd -> Piriform Software Ltd) Задача: {25B4348D-CED6-416E-9BEF-DF9A86294C99} - System32\Tasks\Microsoft\ Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [111512 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)Задача: {3A8E30CB-3EF6-456E-B935-050089915D39} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => "%windir%\system32\sc.exe" СТАРТ ImControllerServiceTask: {3E5ECBD8-CAE4-4C32-9C17-DA2DD1F96B8D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Планирано сканиране => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation) Задача: {435DDE76-E3F5-47C2-A1AC- BDEBD879376B} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Monitor => C:\WINDOWS\system32\ImController.InfInstaller.exe [64256 2022-01-28] (Lenovo -> Lenovo Group Ltd.) Задача: {570AABD4-1BC4-4217-9BF0-E338143FC28C} - System32\Tasks\Microsoft\ Автоматични актуализации на Office\Office 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22865832 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)Задача: {59C536E1-F8BA-46DE-BFCB-7EEAEB5E1998} - System32\ Tasks\Lenovo\BatteryGauge\BatteryGaugeMaintenance => C:\ProgramData\Lenovo\ImController\Plugins\LenovoBatteryGaugePackage\x64\BGHelper.exe [145480 2021-09-09] (Lenovo -> Lenovo Group Ltd.) Задача: {5ED1416D-084D-46C2-BD02-71129D53B410} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-01-16] (Google Inc -> Google Inc.)Задача: {61003686-87EA-4D45-B710-7488F4AFE5BA} - System32\ Задачи\Задача за актуализиране на Adobe Acrobat => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1564424 2021-11-18] (Adobe Inc. -> Adobe Inc.) Задача: {6B7D48DC-91EE-42E0-B746 -4130DA6A431B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation) Задача: {8788E93F-6B8D-4BE9-A8C2- BA338897109B} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Проверка => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation) Задача: {89C093CF-4F70-4CBB-AC64- 07D696629E0C} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"Task: {91045D90-E7DA-4F50-BEEC-F7E8A471B5A4} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MpCmdRun.exe [993000 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation) Задача: {98D2CD6D-7566-4F48-B962- 899F38081515} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\14db7110-c370-4e33-89b4-e4ffc69aa531 => C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [84240 2022-01-28] (Lenovo -> Lenovo Group Ltd.) Задача: {9DABA2BB-DF3F-4C0B-8FEB-C9D0E337A386} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2018-01-16] (Google Inc -> Google Inc.)Задача: {B1257E74-0889-4670-94E1-E4F70C559F07} - System32\ Tasks\Lenovo\ImController\TimeBasedEvents\4c4b4016-eb07-4017-b034-a65ffb94f6de => C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [84240 2022-01-28] (Lenovo -> Lenovo Group Ltd.) Задача: {BDD1FDDA-B2AE-4028-AAC0-3518E7AE810D} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\1eb6cb73-2891-429f-837f-cdaf935c00d6 => C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [84240 2022-01-28] (Lenovo -> Lenovo Group Ltd.)Задача: {C244C3C6-AFAD-41A6-B2A3-434EDF30FB4F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22865832 2022-04-05] (Microsoft Corporation -> Microsoft Corporation) Задача: {C3278433-4829-48AB-A745-A0AC38150AC6} - System32\ Tasks\Lenovo\ImController\TimeBasedEvents\88bf197c-fd62-4ae3-a5e9-4a2b348cce3e => C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [84240 2022-01-28] (Lenovo -> Lenovo Group Ltd.) Задача: {C4AF5A87-C19F-47C1-8663-BEC7452AC4E0} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [684976 2022-03-10] (Piriform Software Ltd -> Piriform)Задача: {EA22C148-B71A-46AF-AAD9-62DF4B7E65CD} - System32\Tasks\Microsoft\Office\ Актуализации на функции на Office Влизане => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [111512 2022-04-05] (Microsoft Corporation -> Microsoft Corporation)Задача: {FE749972-32D7-49A7-8D15-71279A350F08} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32 (Ако запис е включен в fixlist, задачата (.job) файлът ще бъде преместен. Файлът, който се изпълнява от задачата, няма да бъде преместен.)===================== Интернет (в белия списък) ======= ============= (Ако даден елемент е включен в списъка с корекции, ако е елемент от регистъра, той ще бъде премахнат или възстановен по подразбиране.) Winsock: Catalog5 08 C:\Program Files (x86 )\Bonjour\mdnsNSP.dll [122128 2015-08-12] (Apple Inc. -> Apple Inc.)Winsock: Catalog5-x64 08 C:\Program Files\Bonjour\mdnsNSP.dll [133392 2015-08-12 ] (Apple Inc. -> Apple Inc.)Tcpip\Параметри: [DhcpNameServer] 192.168.1.254Tcpip\..\Interfaces\{a324593e-2193-40e1-81d6-51cbd21b84a1}: [DhcpNameServer] 169.259T.cpip .\Интерфейси\{b3dfa0c7-b6eb-438c-bd53-91ce6540439c}: [DhcpNameServer] 192.168.1.254 Edge: =======Edge Extension: (Без име) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [не е намерено]Edge разширение: (без име) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [не е намерено]Edge разширение: (без име) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [не е намерено]Edge разширение: (без име) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [не е намерен]Профил на Edge: C:\Users\cope\AppData\Local\Microsoft\Edge\User Data\Default [2022-04-11]Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee] FireFox:========FF DefaultProfile: f81ixan5.default-1602258033880FF ProfilePath: C:\Users\cope\AppData\Roaming\Mozilla\Firefox\ Profiles\f81ixan5.default-1602258033880 [2022-04-13]FF Разширение: (Video DownloadHelper) - C:\Users\cope\AppData\Roaming\Mozilla\Firefox\Profiles\f81ixan5.default-1602258033880\Extensions\{b9db16a4- 6edc-47ec-a1f4-b86292ed211d}.xpi [2022-01-09]FF плъгин: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2022-04-07] (Adobe Inc. -> Adobe Systems Inc.)FF плъгин: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [27.09.2019] (Adobe Inc. -> Adobe Systems)FF Plugin-x32: @microsoft.com/SharePoint,версия =14,0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-03-04] (Microsoft Corporation -> Microsoft Corporation)FF Plugin-x32: @videolan.org/vlc,version=2.2 .8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-11-29] (VideoLAN -> VideoLAN)FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2019-09-27] (Adobe Inc. -> Adobe Systems) Chrome: =======CHR профил: C :\Users\cope\AppData\Local\Google\Chrome\User Data\Default [2022-04-14]CHR Известия: По подразбиране -> hxxps://calendar.google.com; hxxps://meet.google.com; hxxps://www.facebook.com; hxxps://www.netflix.com; hxxps://www.newsbreak.comCHR Начална страница: По подразбиране -> hxxp://www.google.com/CHR Възстановяване на сесия: По подразбиране -> е активиран.CHR Разширение: (Слайдове) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-01-16]CHR Разширение: (Документи) - C:\Users\cope \AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-01-16]CHR Разширение: (Google Диск) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\ Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-11-05]CHR Разширение: (YouTube) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-01-16]CHR Разширение: (Sheets) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-01-16]CHR Разширение: (Qualys BrowserCheck за Windows) - C:\Users \cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\foklmnihmhdobgonljkdamiiohnobkff [2022-04-11]CHR разширение: (Google Документи офлайн) - C:\Users\cope\AppData\Local\Google\Chrome\ Потребителски данни\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-03-23]CHR разширение: (Malwarebytes Browser Guard) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2022- 04-11]CHR разширение: (Video DownloadHelper) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjnegcaeklhafolokijcfjliaokphfk [2021-07-09]CHR разширение: (плащания в уеб магазина на Chrome ) - C:\Users\cope\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-02-09]CHR Разширение: (Gmail) - C:\Users\cope\AppData\Local\ Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-11-05]CHR HKLM-x32\...\Chrome\Разширение: [efaidnbmnnnibpcajpcglclefindmkaj]CHR HKLM-x32\...\Chrome\Разширение: [ihcjicgdanjaechkdogeeck ] ==================== Услуги (в белия списък) ==================== (Ако е включен запис в списъка с корекции, той ще бъде премахнат от системния регистър. Файлът няма да бъде преместен, освен ако не е посочен отделно.) R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169728 2021-11-18] (Adobe Inc. -> Adobe Inc.)R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [823352 2019-09-27] (Adobe Inc. -> Adobe Inc.)R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3849472 2021-11-23] (Adobe Inc. -> Adobe Systems, Incorporated)R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [3617024 2021-11-23] (Adobe Inc. -> Adobe Systems, Incorporated)S2 CCSDK; C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe [680288 2016-12-06] (LENOVO -> Lenovo)R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [11666384 2022-04-05] (Microsoft Corporation -> Microsoft Corporation) R2 Dolby DAX2 API услуга; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [189464 2019-01-21] (Dolby Laboratories, Inc. -> Dolby Laboratories, Inc.)R2 ImControllerService; C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [84240 2022-01-28] (Lenovo -> Lenovo Group Ltd.)S3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8348856 2022-04-11] (Malwarebytes Inc -> Malwarebytes)R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\NisSrv.exe [3116848 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation)R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2203.5-0\MsMpEng.exe [133544 2022-04-07] (Microsoft Windows Publisher -> Microsoft Corporation) ============ ========== Драйвери (в белия списък) ==================== (Ако даден запис е включен в списъка с корекции, той ще бъде премахнат от регистъра Файлът няма да бъде преместен, освен ако не е посочен отделно.) S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35976 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [Файлът не е подписан]S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [Файлът не е подписан]R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223688 2022-04-11] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-01-15] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)S3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-10-02] (Malwarebytes Inc -> Malwarebytes)R3 MpKsl36c8f9ba; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4958C271-110F-4CB6-8B16-AEE8B0496171}\MpKslDrv.sys [139536 2022-04-14] (Microsoft Windows -> Microsoft Corporation)R3 RSP2STOR; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [329184 2016-08-15] (Realtek Semiconductor Corp. -> Realtek Semiconductor Corp.)R3 SPUVCbv; C:\WINDOWS\System32\Drivers\SPUVCbv64.sys [937536 2017-04-09] (SUNPLUS INNOVATION TECHNOLOGY INC. -> Sunplus Innovation Technology Inc.)R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [828256 2019-12-10] (IDRIX SARL -> IDRIX)S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [49600 2022-04-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [443664 2022-04-07] (Microsoft Windows -> Microsoft Corporation)R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [90384 2022-04-07] (Microsoft Windows -> Microsoft Corporation) ==================== = NetSvcs (в белия списък) ==================== (Ако даден запис е включен в списъка с корекции, той ще бъде премахнат от системния регистър. Файлът няма да бъде преместен, освен ако не е в списъка отделно.)==================== Един месец (създадено) (В белия списък) ========= (Ако запис е включен в списъка с корекции, файлът/папката ще бъдат преместени.) 2022-04-14 21:04 - 2022-04-14 21:05 - 000024565 _____ C:\Users\cope\Downloads\FRST.txt2022-04-14 21:04 - 2022 -04-14 21:04 - 000024755 _____ C:\Users\cope\Desktop\bleeping tutorial.odt2022-04-14 20:32 - 2022-04-14 20:32 - 002365952 _____ (Farbar) C:\Users\ cope\Downloads\FRST64.exe2022-04-14 12:37 - 2022-04-14 12:37 - 000127653 _____ C:\Users\cope\AppData\Local\recently-used.xbel2022-04-13 23:33 - 2022-04-13 23:33 - 091226112 _____ C:\WINDOWS\system32\config\SOFTWARE2022-04-13 20:39 - 2022-04-13 20:39 - 000008646 _____ C:\WINDOWS\system32\AmspLogList.ini2022 -04-13 20:39 - 2022-04-13 20:39 - 000002222 _____ C:\WINDOWS\system32\AmspConfig.ini2022-04-13 20:39 - 2022-04-13 20:39 - 000002016 _____ C: \WINDOWS\system32\AmspLogFilter.ini2022-04-13 20:39 - 2022-04-13 20:39 - 000000127 _____ C:\WINDOWS\system32\trxhandler_log.ini2022-04-13 20:39 - 2022-04-13 20:39 - 000000080 _____ C:\WINDOWS\system32\log.ini2022-04-13 20:38 - 2022-04-13 20:38 - 000000000 ____D C:\WINDOWS\system32\TmAMSI2022-04-13 20:37 - 2022-04-13 21:48 - 000000000 ____D C:\Users\cope\AppData\Local\Trend Micro2022-04-13 20:37 - 2022-04-13 21:47 - 000000000 ____D C:\ProgramData\Trend Micro2022-04-13 20:11 - 2022-04-13 20:11 - 000870562 _____ C:\Users\cope\AppData\Local\census.cache2022-04-13 20:09 - 2022-04-13 20:09 - 000387211 _____ C:\Users\cope\AppData\Local\ars.cache2022-04-13 19:58 - 2022-04-13 21:48 - 000000000 ____D C:\Program Files\Trend Micro2022-04-13 19: 58 - 2022-04-13 20:40 - 000000036 _____ C:\Users\cope\AppData\Local\housecall.guid.cache2022-04-13 18:53 - 2022-04-13 18:53 - 000162883 _____ C: \Users\cope\Desktop\trojan.xcf2022-04-13 17:52 - 2022-04-14 20:29 - 001197879 _____ C:\Users\cope\Desktop\trash файл sqlite-highlights.odt2022-04-13 15 :39 - 2022-04-13 15:39 - 001196591 _____ C:\Users\cope\Desktop\trash file sqlite.odt2022-04-12 21:12 - 2022-04-12 21:12 - 000048640 _____ (Adobe Systems ) C:\WINDOWS\system32\atmlib.dll2022-04-12 21:12 - 2022-04-12 21:12 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll2022-04-12 21: 12 - 2022-04-12 21:12 - 000011803 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim2022-04-12 21:11 - 2022-04-12 21:11 - 000162816 _____ C:\WINDOWS\system32\DataStoreColmpCacheD .exe2022-04-12 21:01 - 2022-04-12 21:01 - 000000000 ___HD C:\$WinREAgent2022-04-12 20:30 - 2022-04-12 21:21 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird2022-04-11 18:17 - 2022-04-13 23:32 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware2022-04-11 14:20 - 2022-04-11 14:20 - 000223688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys2022-04-11 13:58 - 2022-04-11 13:58 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla2022-03-30 12 :14 - 2022-03-30 12:14 - 000125820 _____ C:\Users\cope\Downloads\1099DIV-2019.pdf2022-03-30 12:12 - 2022-03-30 12:12 - 000125347 _____ C:\ Users\cope\Downloads\1099DIV-2021.pdf2022-03-29 12:34 - 2022-03-29 12:34 - 002004474 _____ C:\Users\cope\Downloads\EStatement-2021-12-15-41657.pdf2022 -03-23 14:19 - 2022-03-23 14:19 - 000035924 _____ C:\Users\cope\Downloads\EnrollCode (1).pdf2022-03-23 14:18 - 2022-03-23 14:18 - 002004474 _____ C:\Users\cope\Downloads\EStatement-2021-12-15-47888.pdf ==================== Един месец (променен) == ================ (Ако запис е включен в списъка с корекции, файлът/папката ще бъдат преместени.) 2022-04-14 21:05 - 2019-08-02 12 :41 - 000000000 ____D C:\FRST2022-04-14 21:04 - 2018-01-17 15:54 - 000000000 ____D C:\Users\cope\.gimp-2.82022-04-14 21:03 - 2018-06 -22 12:22 - 000000000 ____D C:\Users\cope\AppData\LocalLow\Mozilla2022-04-14 20:46 - 2018-01-16 20:33 - 000000000 ____D C:\Program Files (x86)\Google2022- 04-14 20:28 - 2019-12-07 05:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft2022-04-14 19:08 - 2020-08-10 22:14 - 000000000 ____D C:\WINDOWS\system32\SleepStudy2022-04-14 12:37 - 2018-01-17 16:13 - 000000000 ____D C:\ Users\cope\AppData\Local\gtk-2.02022-04-14 11:51 - 2018-01-31 09:49 - 000000000 ____D C:\Program Files\CCleaner2022-04-14 01:58 - 2019-10-02 09:58 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData2022-04-14 01:54 - 2022-01-14 14:34 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864 e594e8d1fb382022-04-14 01:53 - 2018-01-16 17:06 - 000000000 __SHD C:\Users\cope\IntelGraphicsProfiles2022-04-13 21:48 - 2019-12-07 05:14 - 0000_00_HD C: WINDOWS\ELAMBKUP2022-04-13 20:52 - 2019-12-07 05:14 - 000000000 ___HD C:\Program Files\WindowsApps2022-04-13 20:52 - 2019-12-07 05:14 - 000000000 ____D C: \WINDOWS\AppReadiness2022-04-13 20:39 - 2019-12-07 05:03 - 000032768 _____ C:\WINDOWS\system32\config\ELAM2022-04-13 20:38 - 2019-12-07 05:13 - 000000000 ____D C:\WINDOWS\INF2022-04-13 19:37 - 2020-08-10 22:18 - 000842418 _____ C:\WINDOWS\system32\PerfStringBackup.INI2022-04-13 19:33 - 2020-08-10 22:19 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT2022-04-13 19:33 - 2020-08-10 22:14 - 000008192 ___SH C:\DumpStack.log.tmp2022-04-13 19:33 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\ServiceState2022-04-13 19:28 - 2019-12-07 05:03 - 000786432 _____ C:\WINDOWS\system32\config\BBI2022-04- 13 13:02 - 2019-08-02 12:36 - 000000000 ____D C:\Users\cope\AppData\Local\mbam2022-04-12 21:21 - 2020-08-10 22:14 - 000330904 _____ C:\ WINDOWS\system32\FNTCACHE.DAT2022-04-12 21:21 - 2018-01-16 20:43 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2022-04-12 21:20 - 2019-12- 07 05:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel2022-04-12 21:20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism2022-04-12 21:20 - 21:20 - 12-07 05:14 - 000000000 ____D C:\WINDOWS\SystemResources2022-04-12 21:20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\oobe2022-04-12 21:20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\system32\Dism2022-04-12 21:20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\ShellExperiences2022-04-12 21 20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\Provisioning2022-04-12 21:20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions2022-01-12 2 20 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\bcastdvr2022-04-12 21:15 - 2019-12-07 05:03 - 000000000 ____D C:\WINDOWS\CbsTemp2022-04-12 21: 00 - 2018-01-16 21:56 - 000000000 ____D C:\WINDOWS\system32\MRT2022-04-12 20:58 - 2018-01-16 21:56 - 143823848 ____C (Microsoft Corporation) C:\WINDOWS\system32 \MRT.exe2022-04-12 20:28 - 2020-08-10 22:19 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task2022-04-12 20:27 - 2021-11-19 12 :44 - 000002080 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk2022-04-12 20:27 - 2021-11-19 12:44 - 000002068 _____ C:\Users\Public\ Desktop\Adobe Acrobat DC.lnk2022-04-12 12:56 - 2020-07-06 20:42 - 000002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk2022-04-11 19: 39 - 2018-01-16 20:33 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk2022-04-11 19:39 - 2018-01-16 20:33 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk2022-04-11 14:24 - 2021-02-11 13:06 - 000000000 ____D C:\Users\cope\AppData\Local\CrashDumps2022-01-11 14: 18 - 2022-01-09 07:09 - 000000000 ____D C:\Program Files\Mozilla Firefox2022-04-11 13:58 - 2021-01-15 16:22 - 000002028 _____ C:\Users\Public\Desktop\Malwarebytes .lnk2022-04-11 13:58 - 2020-05-21 18:15 - 000002040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk2022-04-11 13:58 - 2019-01- 01 22:16 - 000000000 ____D C:\ProgramData\Mozilla2022-04-11 13:58 - 2018-06-22 12:22 - 000001012 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk2022-04-11 13:56 - 2019-08-02 12:36 - 000000000 ____D C:\ProgramData\Malwarebytes2022-04-11 13:56 - 2019-08-02 12:36 - 000000000 ____D C:\Program Files \Malwarebytes2022-04-10 14:07 - 2018-01-29 16:40 - 000000000 ____D C:\Users\cope\AppData\Roaming\Canon2022-04-10 13:58 - 2020-08-10 22:19 - 000003480 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA2022-04-10 13:58 - 2020-08-10 22:19 - 000003356 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore2022 -0540458 8 -02-17 19:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd2022-04-07 16:45 - 2021-01-24 14:05 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools2022- 04-07 10:30 - 2021-12-12 19:41 - 000003576 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-313246963-3037881445-1802910-10012022-04-07 10:30 - 2020-08-10 22:19 - 000003370 _____ C:\WINDOWS\system32\Tasks\OneDrive Самостоятелна актуализация Задача-S-1-5-21-313246963-3037881445-1802910-10012022-04-07 10: 30 - 2020-08-10 19:48 - 000002379 _____ C:\Users\cope\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk2022-04-05 13:55 - 2017-05-25 08 :08 - 000000000 ____D C:\Program Files (x86)\Microsoft Office2022-04-04 14:02 - 2018-01-17 15:48 - 000000000 ____D C:\Users\cope\AppData\Roaming\vlc2022-03- 23 21:13 - 2021-01-24 14:05 - 000601432 _____ (Microsoft Corporation) C:\WINDOWS\system32\sedplugins.dll2022-03-23 21:12 - 2021-01-24 14:05 - 000483664 _____ ( Microsoft Corporation) C:\WINDOWS\system32\QualityUpdateAssistant.dll2022-03-22 18:43 - 2019-12-07 05:14 - 000000000 ____D C:\WINDOWS\LiveKernelReports ============= ======== Файлове в корена на някои директории ======== 2022-04-13 20:09 - 2022-04-13 20:09 - 000387211 _____ () C:\Users\ cope\AppData\Local\ars.cache2022-04-13 20:11 - 2022-04-13 20:11 - 000870562 _____ () C:\Users\cope\AppData\Local\census.cache2022-04-13 19: 58 - 2022-04-13 20:40 - 000000036 _____ () C:\Users\cope\AppData\Local\housecall.guid.cache2019-01-29 05:28 - 2019-01-29 05:28 - 000066717 _____ () C:\Users\cope\AppData\Local\logo.jpg2019-06-13 16:04 - 2019-06-13 16:04 - 000000410 _____ () C:\Users\cope\AppData\Local\oobelibMkey. log2018-01-18 20:41 - 2018-01-18 22:11 - 000000600 _____ () C:\Users\cope\AppData\Local\PUTTY.RND2022-04-14 12:37 - 2022-04-14 12 :37 - 000127653 _____ () C:\Users\cope\AppData\Local\recently-used.xbel2019-07-29 20:42 - 2019-07-29 20:52 - 000007605 _____ () C:\Users\cope \AppData\Local\resmon.resmoncfg ===================== SigCheck ====================== ======= (Няма автоматична корекция за файлове, които не преминават проверка.) ==================== Край на FRST.txt === ===================== А ето и Addition.txt Допълнителен резултат от сканиране на Farbar Recovery Scan Tool (x64) Версия: 13-04-2022 01Ran от cope (14 -04-2022 21:06:21) Изпълнява се от C:\Users\cope\Downloads Microsoft Windows 10 Home Version 21H2 19044.1645 (X64) (2020-08-11 02:19:48)Режим на зареждане: нормален===== ===================================================== ======================= Акаунти: =========================== ====(Ако запис е включен в списъка с корекции, той ще бъде премахнат.) Администратор (S-1-5-21-313246963-3037881445-1802910-500 - Администратор - Дезактивирано)работа (S-1-5- 21-313246963-3037881445-1802910-1001 - Администратор - Активиран) => C:\Users\copeDefaultAccount (S-1-5-21-313246963-3037881445-1802910-503 - Ограничен - Деактивиран) Гост (S-1-5-21-313246963-3037881445-1802910-501 - Ограничен - Деактивиран)WDAGUtilityAccount (S-1-5-21-313246963-3037881445-1802910-504 - Ограничен - Дезактивиран) ==================== Център за сигурност ======= ================= (Ако запис е включен в списъка с корекции, той ще бъде премахнат.) AV: Windows Defender (Активиран - Актуализиран) {D68DDC3A-831F-4fae -9E44-DA132C1ACF46}AS: Windows Defender (Активиран - Актуализиран) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ===================== Инсталирани програми = ===================== (Само програмите за рекламен софтуер с флаг „Скрити“ могат да бъдат добавени към списъка с корекции, за да ги покажете. Програмите за рекламен софтуер трябва да се деинсталират ръчно.) 7-Zip 18.05 (x64) (HKLM\...\7-Zip) (Версия: 18.05 - Игор Павлов)Adobe Acrobat DC (64-bit) (HKLM\...\{AC76BA86-1033-1033-7760- BC15014EA700}) (Версия: 22.001.20117 - Adobe) Adobe Animate 2019 (HKLM-x32\...\FLPR_19_2_1) (Версия: 19.2.1 - Adobe Systems Incorporated) Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Версия: 5.0.0.354 - Adobe Systems Incorporated) Adobe Genuine Service (HKLM-x32\...\AdobeGenuineService) (Версия: 7.6.0.52 - Adobe Inc.)Adobe Media Encoder 2019 (HKLM-x32\.. .\AME_13_1) (Версия: 13.1 - Adobe Systems Incorporated) Angry Birds (HKLM-x32\...\{01509AB1-84BB-4AB9-A142-38AFA0BBDA25}) (Версия: 4.0.0 - Rovio Entertainment Ltd.)balenaEtcher 1.5 .114 (HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\d2f3b6c7-6f49-59e2-b8a5-f72e33900c2b) (Версия: 1.5.114 - Balena Inc.)Bonjour (HKLM\ ...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Версия: 3.1.0.1 - Apple Inc.)CanoScan Toolbox Ver4.6 (HKLM-x32\...\{088A077A-8028-408C-AE7B-4512AE2A65A0}) (Версия:- )CCleaner (HKLM\...\CCleaner) (Версия: 5.91 - Piriform)CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Версия: 4.5.8.6795 - CDBurnerXP)Dolby Audio X2 Windows API SDK (HKLM\...\{F290F786-5F69-48D4 -B20B-D21C7DE56EF0}) (Версия: 0.8.8.88 - Dolby Laboratories, Inc.) Dolby Audio X2 Windows APP (HKLM\...\{DBC4388A-9417-41DB-85CF-DF4993B84D5A}) (Версия: 0.7.5.67 - Dolby Laboratories, Inc.) EZ Vinyl/Tape Converter от Ion Audio 11.7.0 (HKLM-x32\...\EZ Vinyl/Tape Converter от Ion Audio_is1) (Версия: 11.7.0 - Ion Audio LLC)GIMP 2.8.22 (HKLM\...\GIMP-2_is1) (Версия: 2.8.22 - Екипът на GIMP) Glary Undelete 5.0.1.19 (HKLM-x32\...\Glary Undelete) (Версия: 5.0.1.19 - Glarysoft Ltd)Google Chrome (HKLM-x32\...\Google Chrome) (Версия: 100.0.4896.88 - Google LLC) Google Earth Pro (HKLM\...\{9BFB06CD-3925-49E2-BAB7-EA695821CE4C}) (Версия: 7.3. 4.8248 - Google) Intel® Chipset Device Software (HKLM-x32\...\{bb0592a7-5772-4736-9d55-2402740085db}) (Версия: 10.1.1.38 - Intel® Corporation) HiddenIntel® Management Engine Components (HKLM\. ..\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Версия: 11.6.0.1039 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Версия: 23.20.16.4973 - Intel Corporation) HiddenIntel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Версия: 15.9.6.1044 - Intel Corporation) IrfanView 4.51 (64-битов) ) (HKLM\...\IrfanView64) (Версия: 4.51 - Irfan Skiljan)Jaxx Liberty 2.5.0 (HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\5947781c-9863- 579f-b9db-91554a22cc65) (Версия: 2.5.0 - decentral.ca)LenovoUtility (HKLM-x32\...\{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Версия: 3.0.0.4 - Lenovo) HiddenLenovoUtility ( HKLM-x32\...\InstallShield_{6ADA7E88-8D16-4D0D-BC90-2B93AC5E56DA}) (Версия: 3.0.0.4 - Lenovo)Malwarebytes версия 4.5.7.186 (HKLM\...\{35065F43-4BB2-439A-BFF7 -0F1014F2E0CD}_is1) (Версия: 4.5.7.186 - Malwarebytes)Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Версия: 100.0.1185.39 - Microsoft Corporation)Microsoft Office Home and Student 2016 - en-us (HKLM \...\HomeStudentRetail - en-us) (Версия: 16.0.15028.20160 - Microsoft Corporation)Microsoft OneDrive (HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\OneDriveSetup.exe) (Версия: 22.055.0313.0001 - Microsoft Corporation) Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Версия: 3.67.0.0 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM) -x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Версия: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621 -a0ac-3f809523288f}) (Версия: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Версия: 9.0. 30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Версия: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Версия: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\ ...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Версия: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441 -6616F567A0F7}) (Версия: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Версия: 10.0.4021 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Версия: 11.0.61030.0 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Версия: 11.0.61030.0 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x64) - 12.0 .30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Версия: 12.0.30501.0 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 (HKLM-x32\ ...\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}) (Версия: 12.0.40660.0 - Microsoft Corporation)Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027- aff3-4070-886a-0d87064aabb1}) (Версия: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (HKLM-x32\...\{61087a79-ac85-455c-934d-1fa22cc64f36 }) (Версия: 12.0.40660.0 - Microsoft Corporation)Microsoft Visual C++ 2017 Redistributable (x64) - 14.15.26706 (HKLM-x32\...\{95ac1cfa-f4fb-4d1b-8912-7f9d5fbb140d}) (Версия: 14.15. 26706.0 - Microsoft Corporation)Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (HKLM-x32\...\{7e9fae12-5bbf-47fb-b944-09c49e75c061}) (Версия: 14.15.26706.0 - Microsoft Corporation)Mozilla Firefox 87.0 (x64 en-US) (HKLM\...\Mozilla Firefox 87.0 (x64 en-US)) (Версия: 87.0 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Версия: 81.0.1 - Mozilla)Mozilla Thunderbird (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 100.0 (x86 en-US)) (Версия: 100.0 - Mozilla)MultiDoge 0.1.7 (HKLM-x32\...\MultiDoge 0.1.7) (Версия: 0.1.7 - ) Компонент за разширяване на Office 16 Click-to-Run (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Версия: 16.0.15028.20050 - Microsoft Corporation) HiddenOffice 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Версия: 16.0.15028.20094 - Microsoft Corporation) HiddenOffice 16 Click-to- Изпълнение на компонент за лицензиране (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Версия: 16.0.15028.20160 - Microsoft Corporation) Компонент за локализация HiddenOffice 16 Click-to-Run (HKLM-x32\...\ {90160000-008C-0409-0000-0000000FF1CE}) (Версия: 16.0.14131.20278 - Microsoft Corporation) HiddenOpenOffice 4.1.5 (HKLM-x32\...\{ABCAD346-4F4B-49E9-9AA1-28EF8C26059D:}) (Версия 4.15.9789 - Apache Software Foundation)Puran File Recovery 1.2.1 (HKLM\...\Puran File Recovery_is1) (Версия:- Puran Software)PuTTY версия 0.70 (64-битова) (HKLM\...\{45B3032F- 22CC-40CD-9E97-4DA7095FA5A2}) (Версия: 0.70.0.0 - Саймън Татъм) Recuva (HKLM\...\Recuva) (Версия: 1.53 - Piriform) Shotcut (HKLM-x32\...\Shotcut) (Версия :- )Spotify (HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\Spotify) (Версия: 1.1.62.583.gdac868ed - Spotify AB)Възстановяване на 360 (HKLM-x32\.. .\Undelete 360_is1) (Версия:- File Recovery Ltd.) Актуализация за Windows 10 за x64-базирани системи (KB4023057) (HKLM\...\{32DC821E-4A7D-4878-BEE8-337FA153D7F2}) (Версия: 2.63. 0.0 - Microsoft Corporation) HiddenVdhCoApp 1.5.0 (HKLM\...\weh-iss-net.downloadhelper.coapp_is1) (Версия:- DownloadHelper)VeraCrypt (HKLM-x32\...\VeraCrypt) (Версия: 1.24-Hotfix1) - IDRIX)VLC медиен плейър (HKLM-x32\...\VLC медиен плейър) (Версия: 2.2.8 - VideoLAN)VNC Viewer 6.17.1113 (HKLM\...\{26DEBF7F-3876-43C3-8365-5A2B4C604DFA }) (Версия: 6.17.1113.31799 - RealVNC Ltd) Vulkan Run Time Libraries 1.0.33.0 (HKLM\...\VulkanRT1.0.33.0) (Версия: 1.0.33.0 - LunarG, Inc.) HiddenVulkan Run Time Libraries 1.0. 33.0 (HKLM\...\VulkanRT1.0.33.0-4) (Версия: 1.0.33.0 - LunarG, Inc.)Vulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1) (Версия : 1.0.65.1 - LunarG, Inc.) HiddenVulkan Run Time Libraries 1.0.65.1 (HKLM\...\VulkanRT1.0.65.1-2) (Версия: 1.0.65.1 - LunarG, Inc.) HiddenVulkan Run Time Libraries 1.0. 65.1 (HKLM\...\VulkanRT1.0.65.1-3) (Версия: 1.0.65.1 - LunarG, Inc.) HiddenWindows 7 Games за Windows 10 и 8 (HKLM\...\Win7Games) (Версия: 2.0 - hxxp://winaero.com) Windows Migration Assistant (HKLM-x32\...\{96EAB2F7-9D1F-4426-BA58-9D9D101FDC2C}) (Версия: 2.2.0.1 - Apple Inc.)Windows PC Health Check (HKLM\ ...\{B1E7D0FD-7CFE-4E0C-A5DA-0F676499DB91}) (Версия: 3.2.2110.14001 - Microsoft Corporation) Увеличаване (HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\ ZoomUMX) (Версия: 5.4.6 (59296.1207) - Zoom Video Communications, Inc.) Пакети:==========Adobe Notification Client -> C:\Program Files\WindowsApps\AdobeNotificationClient_1.0.1.22_x86__enpm4xejd91yc [2019-07-22] (Adobe Systems Incorporated)Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2019-11-07] (Autodesk Inc.)Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.215.400.0_x64__kgqvnymyfvs32 [2022-04-07] (king.com)Настройки на Lenovo -> C:\Program Files\WindowsApps\LenovoCorporation.LenovoSettings_3.177.0.0_x86__4642shxvsv8s2 [2018-01-16] (LENOVO INCORPORATED.)Microsoft Advertising SDK за XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe [2020-08-10] (Microsoft Corporation) [MS Ad]Microsoft Advertising SDK за XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-01-28] (Microsoft Corporation) [MS Ad]Microsoft Advertising SDK за XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-28] (Microsoft Corporation) [MS Ad]Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.12.3171.0_x64__8wekyb3d8bbwe [2022-03-25] (Microsoft Studios) [MS Ad]Minecraft за Windows 10 -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.18.1201.0_x64__8wekyb3d8bbwe [2022-02-17] (Microsoft Studios) Добавка за снимки -> C:\Program Files\WindowsApps\Microsoft.Windows.Photos.DLC.Main_2021.39122.10110.0_x64__8wekyb3d8bbwe [2021-03-14] (Microsoft Corporation) Добавка Photos Media Engine -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-12-01] (Microsoft Corporation) ===================== Персонализиран CLSID (В белия списък): ============== (Ако запис е включен в списъка с корекции, той ще бъде премахнат от системния регистър. Файлът няма да бъде преместен, освен ако не е посочен отделно.) CustomCLSID: HKU \S-1-5-21-313246963-3037881445-1802910-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-6DFA1F2F56A0} -> [Creative Cloud Files] => C:\Users\cope\Creative Cloud Files [2019-06-13 16:07]CustomCLSID: HKU\S-1-5-21-313246963-3037881445-1802910-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9 -ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems)ShellIconOverlayIdentifiers: [FSOverlayIcon] -> {C0829D19-E5A0-44F5-B56E-D15030C53BB9} =>-> Няма FileShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Игор Павлов) [Файлът не е подписан]ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Игор Павлов) [Файлът не е подписан]ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd -> Piriform Ltd)ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>-> Няма FileContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7948ecc1af5c27e1\igfxDTCM.dll [2018-03-16] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Игор Павлов) [Файлът не е подписан]ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2018-03-05] (Adobe Systems Incorporated -> )ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2019-06-26] (Malwarebytes Corporation -> Malwarebytes)ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd -> Piriform Ltd) ===================== Кодеци (в белия списък ) ==================== ===================== Преки пътища & WMI ======================== ===================== Заредени модули (в белия списък) ============= 2018-11-18 15:29 - 2018-04-30 08:00 - 000075776 _____ (Игор Павлов) [Файлът не е подписан] C:\Program Files\7- Zip\7-zip.dll2020-04-20 16:15 - 2020-04-20 16:15 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems32.dll] C:\Program Files (x86)\Microsoft Office\Root\Office16\AppVIsvSubsystems32.dll2020-04-20 16:15 - 2020-04-20 16:15 - 000000000 ____L (Microsoft Corporation) [simlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R32.dll] C:\Program Files (x86)\Microsoft Office\Root\Office16\c2r32.dll ============== ======= Алтернативни потоци от данни (в белия списък) ======== (Ако даден запис е включен в списъка за корекции, само ADS ще бъде премахнат.) AlternateDataStreams: C:\ProgramData\TEMP:260575F1 [246]AlternateDataStreams: C:\ProgramData\TEMP:55F44B88 [99]AlternateDataStreams: C:\ProgramData\TEMP:78E0DF72 [98]AlternateDataStreams: C:\ProgramData\TEMPA:C5DF04 [130]AlternateDataStreams: C:\ProgramData\TEMP:D31BE97C [115] ===================== Безопасен режим (в белия списък) ========== ========= (Ако запис е включен в списъка с корекции, той ще бъде премахнат от системния регистър. „AlternateShell“ ще бъде възстановен.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService = > ""="Service"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Услуга" ==================== Асоциация (в белия списък) ================== === ================= Internet Explorer (в белия списък) ========== HKU\S-1-5-21-313246963-3037881445-1802910-1001\ Software\Microsoft\Internet Explorer\Main, Начална страница = hxxp://lenovo17win10.msn.com/?pc=LCTEHKU\S-1-5-21-313246963-3037881445-1802910-1001\Software\Microsoft\Internet Explorer\ Main,Default_Page_URL = hxxp://lenovo17win10.msn.com/?pc=LCTEHKU\S-1-5-21-313246963-3037881445-1802910-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp: //mystart.lenovo.comОбхвати на търсене: HKU\S-1-5-21-313246963-3037881445-1802910-1001 -> DefaultScope {2552A28A-33CC-4A93-99ED-6DD1722480C4} URL = SearchScopes: HKU\S-1-5-21-313246963-3037881445-1802910-1001 -> {2552A28A-33CC-4A93-99ED-6DD1722480C4} URL = BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)DPF: HKLM {8AD9C840-044E- 11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_281-windows-i586.cabDPF: HKLM {CAFEEFAC-0018-0000-00281-ABCDEFFEDCBA} hxxp://java. sun.com/update/1.8.0/jinstall-1_8_0_281-windows-i586.cabDPF: HKLM {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall- 1_8_0_281-windows-i586.cabDPF: HKLM-x32 {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_281-windows-i586.cabDPF: HKLM- x32 {CAFEEFAC-0018-0000-00281-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_281-windows-i586.cabDPF: HKLM-x32 {CAFEEFAC-FFFF-FFFF-FFFF- ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_281-windows-i586.cabHandler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2022-04-05 ] (Microsoft Corporation -> Microsoft Corporation)Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB. DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation)Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root \Office16\MSOSB.DLL [2022-04-05] (Microsoft Corporation -> Microsoft Corporation) ==================== Съдържание на хостове: ===== ===================== (Ако е необходимо Hosts: директивата може да бъде включена в fixlist за нулиране на Hosts.) 2016-07-16 07:47 - 2016-07- 16 07:45 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts ==================== Други области ========== ================== (В момента няма автоматична корекция за този раздел.) HKU\S-1-5-21-313246963-3037881445-1802910-1001\Контролен панел \Desktop\\Wallpaper -> c:\windows\web\wallpaper\theme1\img2.jpgDNS сървъри: 192.168.1.254HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin) Защитната стена на Windows е активирана. ==================== MSCONFIG/TASK MANAGER забранени елементи == (Ако даден запис е включен в списъка с корекции, той ще бъде премахнат.) HKLM\...\ StartupApproved\Run: => "LenovoUtility"HKLM\...\StartupApproved\Run: => "IAStorIcon"HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\StartupApproved\Run: => "CCXProcess"HKU\S-1-5-21-313246963-3037881445-1802910-1001\...\StartupApproved\Run: => „CCleaner Smart Cleaning“ ==================== Правила на защитната стена (в белия списък) ================= (Ако даден запис е включен в списъка с корекции, той ще бъде премахнат от системния регистър. Файлът няма да бъде преместен, освен ако не е посочен отделно.) FirewallRules: [{0EE6D0C8-5FE9-46D0-BFA7-01E4908FACCE}] => (Разрешаване) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)FirewallRules: [{3657F959-6729-4EE7-8353-A5BF881ABA64}] => (Разрешаване) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation ->Mozilla Corporation) Правила за защитна стена: [{5587DD7A-DD3C-4D87-A496-669895187FD1}] => (Разрешаване) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform)FirewallRules: [{CB1F87EF-CC4A-4C4A-9037-80E60BCC265D}] => (Разрешаване) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform)FirewallRules: [{1A173FB9-1ED7-46D4-953B-4D8A52F4AB97}] => (Разрешаване) C:\Users\cope\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)FirewallRules: [{A7043DCB-CAD4-4FD5-AA87- D2B38D040A90}] => (Разрешаване) C:\Users\cope\AppData\Roaming\Zoom\bin\airhost.exe => Няма FileFirewallRules: [{E7EFDF58-496A-4E00-B15B-F00235FE5D53}] => (Разрешаване) C:\Users\cope\AppData\Roaming\Zoom\bin\airhost.exe => Няма FileFirewallRules: [TCP Query User{BAC8CBA3-1EB2-44DA-A8CE-0AFB3C7AD3F6}C:\users\cope\appdata\roaming\spotify\spotify.exe] => (Разрешаване) C:\users\cope\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)FirewallRules: [UDP Query User{D33A6DA1-156E-4125-8B05-A3D5C73B3F2F}C:\users\ cope\appdata\roaming\spotify\spotify.exe] => (Разрешаване) C:\users\cope\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)FirewallRules: [{1E681063-4801-4337-9508-650B76283440}] => (Разрешаване) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)FirewallRules: [{189DBEFC-7BA4-4F00-BE42-9A5AB4374394}] => (Разрешаване) C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)FirewallRules: [{78390EFF-61E5-48E6-87D3-CF0E2788A042}] => (Разрешаване) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)FirewallRules: [{B1C67094-F0BC-4EB2-8694-08615EA4C33F}] => (Разрешаване) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (Apple Inc. -> Apple Inc.)FirewallRules: [{2CBAEA16-BE84-4B3A-BB72-8C74FB8DF0C7}] => (Разрешаване) C:\Program Files (x86)\Common Files\Apple\Windows Migration Assistant\MigrationAssistant.exe (Apple Inc. -> Apple Inc.)FirewallRules: [{BC938E21-A3EA-40C8-99FC-7F02DB97AF9D}] => (Разрешаване) C:\Program Files (x86)\Common Files\Apple\Windows Migration Assistant\MigrationAssistant.exe (Apple Inc. -> Apple Inc.)FirewallRules: [{3DD206E7-56FE-4C0E-8421-EF8B7A7989C9}] => (Разрешаване) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)FirewallRules: [{75E75CBF-7B1A-4C25-94024D40] => (Разрешаване) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) Правила за защитна стена: [{AB3FF2BD-4046-49D7-B952-8D624A18] => (Разрешаване) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)FirewallRules: [{7FEE010E-D9F4-48CA-BF22BB-1A77B4}] => (Разрешаване) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.82.404.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)FirewallRules: [{12D4D4EB-3E6D-4271-B14EC-8D6] => (Разрешаване) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC) ===================== Точки за възстановяване =============================================== Дефектен диспечер на устройства Устройства ================================ Грешки в регистъра на събитията: ============== =========== Грешки в приложението:===================Грешка: (14.04.2022 г. 19:08:59) (Източник: Bonjour Service) (EventID: 100) (Потребител: )Описание: Локално име на хост LAPTOP-PV813QTR.local вече се използва; вместо това ще опита LAPTOP-PV813QTR-2.local Грешка: (14.04.2022 г. 19:08:59 ч.) (Източник: Bonjour Service) (Идент. № на събитие: 100) (Потребител: )Описание: mDNSCoreReceiveResponse: ProbeCount 2; ще дерегистрира4 LAPTOP-PV813QTR.local. Addr 192.168.1.88 Грешка: (04/14/2022 07:08:59 PM) (Източник: Bonjour Service) (EventID: 100) (Потребител: )Описание: mDNSCoreReceiveResponse: Получено от 192.168.1.88:5353 16 LAPTOP-PV813QTR. местен. AAAA 2600:1700:EFF0:1BD0:0000:0000:0000:0047 Грешка: (14.04.2022 г. 17:21:44 ч.) (Източник: Bonjour Service) (Идент. № на събитие: 100) (Потребител: )Описание: Локално име на хост LAPTOP-PV813QTR.local вече се използва; вместо това ще опита LAPTOP-PV813QTR-2.local Грешка: (14.04.2022 г. 17:21:44 ч.) (Източник: Bonjour Service) (Идент. № на събитие: 100) (Потребител: )Описание: mDNSCoreReceiveResponse: ProbeCount 2; ще дерегистрира4 LAPTOP-PV813QTR.local. Addr 192.168.1.88 Грешка: (04/14/2022 05:21:44 PM) (Източник: Bonjour Service) (EventID: 100) (Потребител: )Описание: mDNSCoreReceiveResponse: Получено от 192.168.1.88:5353 16 LAPTOP-PV813QTR. местен. AAAA 2600:1700:EFF0:1BD0:0000:0000:0000:0047 Грешка: (13.04.2022 г. 19:33:21 ч.) (Източник: Bonjour Service) (Идент. № на събитие: 100) (Потребител: )Описание: Локално име на хост LAPTOP-PV813QTR.local вече се използва; ще пробвам LAPTOP-PV813QTR-2.локално вместо Грешка: (04/13/2022 19:33:21 PM) (Източник: Bonjour Service) (EventID: 100) (Потребител: )Описание: mDNSCoreReceiveResponse: ProbeCount 2; ще дерегистрира4 LAPTOP-PV813QTR.local. Addr 192.168.1.88Системни грешки:==============Грешка: (04/13/2022 20:39:51 PM) (Източник: Service Control Manager) (EventID: 7011) (Потребител: )Описание: Беше достигнато време за изчакване (30 000 милисекунди) при изчакване на отговор на транзакция от услугата Platinum Host Service. Грешка: (04/13/2022 08:39:01 PM) (Източник: Service Control Manager) (EventID: 7000) (Потребител: )Описание: Услугата TMUMH не успя да стартира поради следната грешка: Нивото на ревизия е неизвестно . Грешка: (04/13/2022 08:39:01 PM) (Източник: Service Control Manager) (EventID: 7000) (Потребител: )Описание: Услугата TMUMH не успя да стартира поради следната грешка: Нивото на ревизия е неизвестно . Грешка: (04/13/2022 07:28:39 PM) (Източник: DCOM) (EventID: 10010) (Потребител: LAPTOP-PV813QTR)Описание: Сървърът {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} не се регистрира с DCOM в рамките на необходимото време за изчакване. Грешка: (04/13/2022 07:28:39 PM) (Източник: DCOM) (EventID: 10010) (Потребител: LAPTOP-PV813QTR)Описание: Сървърът {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} не се регистрира с DCOM в рамките на необходимото време за изчакване. Грешка: (04/13/2022 07:28:39 PM) (Източник: DCOM) (EventID: 10010) (Потребител: LAPTOP-PV813QTR)Описание: Сървърът {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} не се регистрира с DCOM в рамките на необходимото време за изчакване. Грешка: (04/13/2022 07:28:39 PM) (Източник: DCOM) (EventID: 10010) (Потребител: LAPTOP-PV813QTR)Описание: Сървърът {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} не се регистрира с DCOM в рамките на необходимото време за изчакване. Грешка: (04/13/2022 07:28:39 PM) (Източник: DCOM) (EventID: 10010) (Потребител: LAPTOP-PV813QTR)Описание: Сървърът {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} не се регистрира с DCOM в рамките на необходимото време за изчакване.Windows Defender:================Дата: 2022-04-13 21:48:59Описание: Антивирусното сканиране на Microsoft Defender е спряно преди завършване.Сканиране Тип: AntimalwareScan Параметри: Бързо сканиране Дата: 2022-04-13 19:26:13Описание: Microsoft Defender Antivirus е открил злонамерен софтуер или друг потенциално нежелан софтуер. За повече информация, моля, вижте следното:https://go.microsoft.com/ fwlink/?linkid=37020&name=Trojan:HTML/Phish.RA!MTB&threatid=2147756354&enterprise=0Name: Trojan:HTML/Phish.RA!MTBSeverity: SevereCategory: TrojanPath: file:_C:\Users\cope\ Documents\Frequent Backup\Thunderbird\xdm7wbge.default\Mail\incoming.gwi.net\TrashDetection Произход: Local machineDetection Тип: ConcreteDetection Източник: Real-Time ProtectionProcess Име: C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exeSecurity интелигентна версия: AV: 1.363.336.0, AS: 1.363.336.0, NIS: 1.363.336.0 Версия на двигателя: AM: 1.1.19100.5, NIS: 1.1.19100.5 Дата: 2022-04-13 19:26:04Описание: Microsoft Defender Antivirus е открил злонамерен софтуер или друг потенциално нежелан софтуер. За повече информация, моля, вижте следното: https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:HTML/Phish.RA!MTB&threatid=2147756354& enterprise=0Name: Trojan:HTML/Phish.RA!MTBSeverity: SevereCategory: TrojanPath: file:_C:\Users\cope\Documents\Frequent Backup\Thunderbird\xdm7wbge.default\Mail\incoming.gwi.net\InboxDetection Произход: Локален machineDetection Тип: ConcreteDetection Източник: Real-Time ProtectionProcess Име: C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe Интелигентна версия на сигурността: AV: 1.363.336.0, AS: 1.363.336.0, NIS: 1.363.336.0 Версия на двигателя: AM: 1.1.19100.5, NIS: 1.1.19100.5 Дата: 2022-04-13 18:34:46 Описание: Microsoft Defender Antivirus е открил злонамерен софтуер или друг потенциално нежелан софтуер. За повече информация, моля, вижте следното: https://go. microsoft.com/fwlink/?linkid=37020&name=PUABundler:Win32/PiriformBundler&threatid=311950&enterprise=0Name: PUABundler:Win32/PiriformBundlerSeverity: LowCategory: Potentially Unwanted SoftwarePath: containerfile:_C:\downloads\scanners6.ccsetup56 exe; контейнерен файл:_C:\Users\cope\Documents\Frequent Backup\document files\RGC\VR\Shanahan\shanahan\ccsetup405.exe; файл:_C:\изтегляния\скенери\ccsetup566.exe->(nsis-instdata); file:_C:\Users\cope\Documents\Frequent Backup\document files\RGC\VR\Shanahan\shanahan\ccsetup405.exe->(nsis-instdata)Произход на откриване: Локална машина Тип на откриване: ConcreteDetection Източник: Име на UserProcess: UnknownSecurity интелигентна версия: AV: 1.363.336.0, AS: 1.363.336.0, NIS: 1.363.336.0 Версия на двигателя: AM: 1.1.19100.5, NIS: 1.1.19100.5 Дата: 2022-04-13 15:11:37Описание: Microsoft Defender Antivirus е открил злонамерен софтуер или друг потенциално нежелан софтуер. За повече информация, моля, вижте следното: https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:HTML/Phish.RA!MTB&threatid=2147756354& предприятие=0Име: Троян:HTML/Phish.RA!MTBSeverity: SevereCategory: TrojanPath: file:_C:\Users\cope\Documents\Frequent Backup\Thunderbird\xdm7wbge.default\Mail\incoming.gwi.net\TrashDetection Произход: Local machineDetection Тип: ConcreteDetection Източник: Real-Time ProtectionProcess Име: C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe Интелигентна версия на сигурността: AV: 1.363.323.0, AS: 1.363.323.0, NIS: 1.363.323.0 Версия на двигателя: AM: 1.1.19100.5, NIS: 1.1. 19100.5CodeIntegrity:================Дата: 2022-04-14 20:54:01Описание: CodeIntegrity определи, че процес (\Device\HarddiskVolume3\Windows\System32\svchost. exe) се опита да зареди \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll, който не отговаря на изискванията за ниво на подписване на Microsoft. Дата: 2022-04-14 20:51:02Описание: Целостта на кода установи, че процес (\Device\HarddiskVolume3\Windows\System32\svchost.exe) се е опитал да зареди \Device\HarddiskVolume3\Program Files\Bonjour\mdnsNSP.dll, който не отговаря на изискванията за ниво на подписване на Windows.==================== Информация за паметта ===================== ========BIOS: LENOVO 4QCN23WW(V1.04) 13.04.2017 г. Дънна платка: LENOVO Lenovo ideapad 320S-14IKBПроцесор: Intel® Core i5-7200U CPU @ 2,50 GHz Процент на използваната памет: 64%Обща физическа RAM: 8050.39 MBA Налична физическа RAM: 2891.09 MB Общо виртуална: 13426.39 MBA Налична виртуална: 7512.41 MB ==================== Дискове ============= ==================== Drive c: (Windows) (Фиксиран) (Общо: 212,23 GB) (Безплатен: 26,75 GB) NTFSDrive d: (LENOVO) (Фиксиран) (Общо: 25 GB) (Безплатно: 23,47 GB) NTFS \\?\Том{ac8a2942-1e08-4e42-ba35-57f084b86e93}\ (WINRE_DRV) (Фиксиран) (Общо: 0,98 GB) (Безплатно: 0,49 GB) NTFS\ \?\Том{1a4ec879-1c42-4b67-89f6-c2d3c35972bd}\ (SYSTEM_DRV) (Фиксиран) (Общо: 0,25 GB) (Безплатно: 0,22 GB) FAT32 ================ ===== MBR & Разделителна маса ==================== ============================= ===============================Диск: 0 (Размер: 238,5 GB) (ID на диска: 973C58E1) Дял: GPT. ==================== Край на добавянето.
