MyCity » Ambulanta -> Arhiva Ambulante » Pomoc...

Pomoc...

Napisano na dan: 28.4.2007

Pomoc...

Odgovori

biljkaljubicica Poslao: 28 Apr 2007 09:45 Idi na vrh
offline biljkaljubicica Novi MyCity građanin Pridružio: 28 Apr 2007 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Logfile of HijackThis v1.99.1 Scan saved at 09:25:55, on 28/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Biljka\Desktop\New Folder\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing) O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe Antivirus registruje nesto, ali ne moze da skine. Kasperski ga i ne registruje, vec TrojanRemover i AVG (juce sam ih stavila u pokusaju da nesto sama uradimo, ali...). AVG ga je stavio u karantin, ja obrisala, restartovala racunar i isto. Racunar pisti kao svinjce kad naidje na to. Nestalo mi je "hide inactive icons" i ponekad "language bar" a ti programi iz desnog ugla, pored sata se u opste ne dizu. A da, to je sver pocelo posle odlaska na Plan Plus(ko mi je kriv kad ne znam sve ulice u Beogradu). Konekcija ADSL.

Profil

rapha Poslao: 28 Apr 2007 12:14 Idi na vrh
offline rapha Mod u pemziji Cigarette Smoking Man Pridružio: 14 Feb 2005 Poruke: 9113 Gde živiš: Beograd	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Pogledaću log pa ti se javljam.. Dopuna: 28 Apr 2007 12:14 Skeniraj komp sa GMER-om i postavi log da proverimo da nema nekih rootkitova... Uradi sledeće: Preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u. Raspakuj ga u neki folder. Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu. Klikni na Scan. Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard. Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt. Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt. Iskopiraj nam ovde sadrzaj ta dva fajla koja smo malopre snimili. Uz ova dva loga postavi i svež HijackThis log ali ovog puta preimenuj HijackThis.exe i sam folder u kojem se nalazi u neko drugo ime koje nema veze sa imenom HijackThis (ht3, ili tvoje ime recimo..).

Profil

biljkaljubicica Poslao: 29 Apr 2007 19:00 Idi na vrh
offline biljkaljubicica Novi MyCity građanin Pridružio: 28 Apr 2007 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! GMER 1.0.12.12244 - gmer.net Rootkit scan 2007-04-29 18:55:06 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT \??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys ZwClose SSDT \??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys ZwCreateProcess SSDT \??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys ZwCreateProcessEx SSDT \??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys ZwCreateSection SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess SSDT \??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys ZwTerminateProcess ---- Kernel code sections - GMER 1.0.12 ---- ? C:\WINDOWS\system32\DRIVERS\update.sys ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_FILE_SYSTEM_CONTROL [AA91D92A] DLAIFS_M.SYS Device \FileSystem\meiudf \MeiUDF_Disk IRP_MJ_FILE_SYSTEM_CONTROL [AA91D942] DLAIFS_M.SYS Device \FileSystem\meiudf \MeiUDF_CdRom IRP_MJ_FILE_SYSTEM_CONTROL [AA91D942] DLAIFS_M.SYS Device \FileSystem\Udfs \UdfsDisk IRP_MJ_FILE_SYSTEM_CONTROL [AA91D92A] DLAIFS_M.SYS Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [AA91D912] DLAIFS_M.SYS Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN AA055C74 Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP AA052400 Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP AA052400 Device \FileSystem\Cdfs \Cdfs FastIoCheckIfPossible AA055BCE ---- Files - GMER 1.0.12 ---- ADS C:\System Volume Information\_restore{30EA9DCE-4F35-48A8-8E81-2737DE9DE0CC}\RP30\A0005840.dll:fork2 ---- EOF - GMER 1.0.12 ---- GMER 1.0.12.12244 - gmer.net Autostart scan 2007-04-29 18:56:34 Windows 5.1.2600 Service Pack 2 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe, HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@DLLName = igfxdev.dll HKLM\SYSTEM\CurrentControlSet\Services\ >>> AVG Anti-Spyware Guard /AVG Anti-Spyware Guard/@ = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe AVPCC /AVP Control Centre Service/@ = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service CFSvcs /ConfigFree Service/@ = C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe DVD-RAM_Service /DVD-RAM_Service/@ = C:\WINDOWS\system32\DVDRAMSV.exe EvtEng /Intel(R) PROSet/Wireless Event Log/@ = C:\Program Files\Intel\Wireless\Bin\EvtEng.exe KAVMonitorService /KAV Monitor Service/@ = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service RegSrvc /Intel(R) PROSet/Wireless Registry Service/@ = C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe S24EventMonitor /Intel(R) PROSet/Wireless Service/@ = C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe Spooler /Print Spooler/@ = %SystemRoot%\system32\spoolsv.exe UMWdf /Windows User Mode Driver Framework/@ = C:\WINDOWS\system32\wdfmgr.exe HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>> @TrojanScannerC:\Program Files\Trojan Remover\Trjscan.exe = C:\Program Files\Trojan Remover\Trjscan.exe @!AVG Anti-Spyware"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized HKCU\Software\Microsoft\Windows\CurrentVersion\Run@ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks@{57B86673-276A-48B2-BAE7-C6DBB3020EB8} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>> @{42071714-76d4-11d1-8b24-00a0c9068ff3} /Display Panning CPL Extension/deskpan.dll /file not found/ = deskpan.dll /file not found/ @{596AB062-B4D2-4215-9F74-E9109B0A8153} /Previous Versions Property Page/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll @{9DB7A13C-F208-4981-8353-73CC61AE2783} /Previous Versions/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll @{30D02401-6A81-11d0-8274-00C04FD5AE38} /IE Search Band/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /Shell DocObject Viewer/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{FBF23B40-E3F0-101B-8488-00AA003E56F8} /InternetShortcut/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /Microsoft Url History Service/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{FF393560-C2A7-11CF-BFF4-444553540000} /History/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /Temporary Internet Files/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /Temporary Internet Files/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /Microsoft Url Search Hook/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /The Internet/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{871C5380-42A0-1069-A2EA-08002B30309D} /Internet Name Space/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /Autoplay for SlideShow/(null) = @{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /Extensions Manager Folder/C:\WINDOWS\system32\extmgr.dll = C:\WINDOWS\system32\extmgr.dll @{2F603045-309F-11CF-9774-0020AFD0CFF6} /Synaptics Control Panel/C:\Program Files\Synaptics\SynTP\SynTPCpl.dll = C:\Program Files\Synaptics\SynTP\SynTPCpl.dll @{2F5AC606-70CF-461C-BFE1-6063670C3484} /Display CPL Extension/C:\Program Files\Toshiba\TouchED\TouchED.DLL = C:\Program Files\Toshiba\TouchED\TouchED.DLL @{DEE12703-6333-4D4E-8F34-738C4DCC2E04} /RecordNow! SendToExt/C:\Program Files\Sonic\RecordNow!\shlext.dll = C:\Program Files\Sonic\RecordNow!\shlext.dll @{E91B2703-013E-4A99-AD33-2B6FB00AA356} /RecordNow! ContextMenuExt/C:\Program Files\Sonic\RecordNow!\shlext.dll = C:\Program Files\Sonic\RecordNow!\shlext.dll @{5CA3D70E-1895-11CF-8E15-001234567890} /DriveLetterAccess/C:\WINDOWS\System32\DLA\DLASHX_W.DLL = C:\WINDOWS\System32\DLA\DLASHX_W.DLL @{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /Web Folders/C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL @{42042206-2D85-11D3-8CFF-005004838597} /Microsoft Office HTML Icon Handler/C:\Program Files\Microsoft Office\OFFICE11\msohev.dll = C:\Program Files\Microsoft Office\OFFICE11\msohev.dll @{00020D75-0000-0000-C000-000000000046} /Microsoft Office Outlook Desktop Icon Handler/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL @{0006F045-0000-0000-C000-000000000046} /Microsoft Office Outlook Custom Icon Handler/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL @{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /IE Microsoft BrowserBand/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /IE Fade Task/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{205D7A97-F16D-4691-86EF-F3075DCCA57D} /IE Menu Desk Bar/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{3028902F-6374-48b2-8DC6-9725E775B926} /IE AutoComplete/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{43886CD5-6529-41c4-A707-7B3C92C05E68} /IE Navigation Bar/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{44C76ECD-F7FA-411c-9929-1B77BA77F524} /IE Menu Site/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{4B78D326-D922-44f9-AF2A-07805C2A3560} /IE Menu Band/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /IE Microsoft History AutoComplete List/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /IE Tracking Shell Menu/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{6CF48EF8-44CD-45d2-8832-A16EA016311B} /IE IShellFolderBand/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{73CFD649-CD48-4fd8-A272-2070EA56526B} /IE BandProxy/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /IE MRU AutoComplete List/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /IE RSS Feeder Folder/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /IE Microsoft Shell Folder AutoComplete List/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{B31C5FAE-961F-415b-BAF0-E697A5178B94} /IE Microsoft Multiple AutoComplete List Container/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /Microsoft Browser Architecture/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /IE Shell Rebar BandSite/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{E6EE9AAC-F76B-4947-8260-A9F136138E11} /IE Shell Band Site Menu/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{F2CF5485-4E02-4f68-819C-B92DE9277049} /&Links/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /IE Registry Tree Options Utility/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /IE User Assist/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /IE Custom MRU AutoCompleted List/C:\WINDOWS\system32\ieframe.dll = C:\WINDOWS\system32\ieframe.dll @{44440D00-FF19-4AFC-B765-9A0970567D97} /TuneUp Theme Extension/%SystemRoot%\system32\uxtuneup.dll = %SystemRoot%\system32\uxtuneup.dll @{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} /TuneUp Shredder Shell Extension/C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll = C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll @{52B87208-9CCF-42C9-B88E-069281105805} /Trojan Remover Shell Extension/C:\PROGRA~1\TROJAN~1\Trshlex.dll = C:\PROGRA~1\TROJAN~1\Trshlex.dll HKLM\Software\Classes\\shellex\ContextMenuHandlers\ >>> AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll Kaspersky Anti-Virus@{dd230880-495a-11d1-b064-008048ec2fc5} = C:\Program Files\Common Files\KAV Shared Files\AvpShlEx.dll Trojan Remover@{52B87208-9CCF-42C9-B88E-069281105805} = C:\PROGRA~1\TROJAN~1\Trshlex.dll TuneUp Shredder Shell Extension@{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} = C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>> AVG Anti-Spyware@{8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll TuneUp Shredder Shell Extension@{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} = C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>> Kaspersky Anti-Virus@{dd230880-495a-11d1-b064-008048ec2fc5} = C:\Program Files\Common Files\KAV Shared Files\AvpShlEx.dll Trojan Remover@{52B87208-9CCF-42C9-B88E-069281105805} = C:\PROGRA~1\TROJAN~1\Trshlex.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>> @{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll @{5CA3D70E-1895-11CF-8E15-001234567890}C:\WINDOWS\System32\DLA\DLASHX_W.DLL = C:\WINDOWS\System32\DLA\DLASHX_W.DLL @{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\system32\logon.scr HKLM\Software\Microsoft\Internet Explorer\Main >>> @Default_Page_URLhttp://go.microsoft.com/fwlink/?LinkId=69157 = go.microsoft.com/fwlink/?LinkId=69157 @Start Pagehttp://go.microsoft.com/fwlink/?LinkId=69157 = go.microsoft.com/fwlink/?LinkId=69157 @Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm HKCU\Software\Microsoft\Internet Explorer\Main >>> @Start Pagehttp://www.google.com = google.com @Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL HKLM\Software\Classes\PROTOCOLS\Handler\ >>> dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll its@CLSID = C:\WINDOWS\system32\itss.dll mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll ms-its@CLSID = C:\WINDOWS\system32\itss.dll mso-offdap@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL mso-offdap11@CLSID = C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL tv@CLSID = C:\WINDOWS\system32\msvidctl.dll HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = C:\WINDOWS\system32\wiascr.dll ---- EOF - GMER 1.0.12 ---- Logfile of HijackThis v1.99.1 Scan saved at 19:04:58, on 29/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Biljka\Desktop\New Folder\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing) O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe Nadam se da sam sve uradila kako treba...

Profil

bobby Poslao: 29 Apr 2007 19:31 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Klikni desno dugme na ikonicu programa HijackThis, pa odaberi opciju Rename, i promeni ime programu u T3.exe, pa napravi novi log koji ces ovde postaviti.

Profil

biljkaljubicica Poslao: 29 Apr 2007 20:18 Idi na vrh
offline biljkaljubicica Novi MyCity građanin Pridružio: 28 Apr 2007 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Logfile of HijackThis v1.99.1 Scan saved at 20:18:02, on 29/04/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Biljka\Desktop\New Folder\T3.exe.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing) O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe Evo...

Profil

bobby Poslao: 29 Apr 2007 21:39 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Nista, cist log... Ajde sledeci put kada antivirus registruje to sto registruje, zapisi sta je tacno prijavio, i napisi nam to ovde. Ne vidim drugi nacin da saznamo o cemu se radi.

Profil

biljkaljubicica Poslao: 30 Apr 2007 13:00 Idi na vrh
offline biljkaljubicica Novi MyCity građanin Pridružio: 28 Apr 2007 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Ja i dalje imam iste simptome. Ne radi mi "hide inactive icons", a racunar pisti kao svinjce kada se aktivira neki antivirus. Trojan Remover prijavljuje sledece ali nista sa tim ne radi C:\WINDOWS\system32\main.sys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EXAMPLE\"ImagePath" C:\WINDOWS\system32\Drivers\hflt_ipf.sys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hflt_ipf\"ImagePath" C:\WINDOWS\System32\drivers\runtime.sys HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Runtime\"ImagePath" C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UIUSys\"ImagePath" Ostali antivirusi vise ne registruju vise nista. Nesto sa njim nije u redu, ali stvarno ne nam sta. Evo i ceo log koji daje Trojan Remover. *** NORMAL SCAN FOR ACTIVE MALWARE * Trojan Remover Ver 6.6.0.2465. For information, email simplysupsupport@aol.com [Unregistered version] Scan started at: 30/04/2007 12:12:35 Using Database v6783 Operating System: Windows XP Professional Service Pack 2 (Build 2600) Using data directory: C:\Documents and Settings\Biljka\Application Data\Simply Super Software\Trojan Remover\ Logfile directory: C:\Documents and Settings\Biljka\My Documents\Simply Super Software\Trojan Remover Logfiles\ Running with Administrator privileges ********************************************** Checking Registry exefile command for modifications Checking Registry comfile command for modifications Checking Registry piffile command for modifications Checking Registry batfile command for modifications Checking Registry regfile command for modifications Checking Registry cmdfile command for modifications Checking Registry scrfile command for modifications ********************************************** 12:12:35: Scanning ----------WIN.INI----------- WIN.INI found in C:\WINDOWS ********************************************** 12:12:35: Scanning --------SYSTEM.INI--------- SYSTEM.INI found in C:\WINDOWS ********************************************** 12:12:35: ----- SCANNING FOR ROOTKIT SERVICES ----- No hidden Services were detected. ********************************************** 12:12:36: Scanning -----WINDOWS REGISTRY----- -------------------- Checking HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon This key's "Shell" value calls the following program(s): Explorer.exe - this entry has been left in place ---------- This key's "Userinit" value calls the following program(s): C:\WINDOWS\system32\userinit.exe - this entry has been left in place ---------- This key's "System" value appears to be blank ---------- -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows -------------------- Checking HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Value Name = load The Data Value for this entry appears to be blank -------------------- -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run This Registry Key attempts to run the following program(s): Value Name = TrojanScanner Value Data = C:\Program Files\Trojan Remover\Trjscan.exe - this program is Trojan Remover's own scan file -------------------- Value Name = !AVG Anti-Spyware Value Data = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized - this command has been left in place -------------------- -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce This Registry Key appears to be empty -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx This Registry Key appears to be empty -------------------- Checking HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run This Registry Key attempts to run the following program(s): Value Name = ctfmon.exe Value Data = C:\WINDOWS\system32\ctfmon.exe - this command has been left in place -------------------- -------------------- Checking HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce This Registry Key appears to be empty ********************************************** 12:12:37: Scanning -----SHELLEXECUTEHOOKS----- ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972} File: shell32.dll - this file is expected and has been left in place ---------- ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} Value: AVG Anti-Spyware 7.5 File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll - this ShellExecuteHook has been left in place ---------- ********************************************** 12:12:37: Scanning -----HIDDEN REGISTRY ENTRIES----- Taskdir check completed ---------- No Registry Run Keys Hidden Entries found ---------- ********************************************** 12:12:38: Scanning -----ACTIVE SCREENSAVER----- ScreenSaver=C:\WINDOWS\system32\logon.scr - this command has been left in place -------------------- ********************************************** 12:12:38: Scanning ----- REGISTRY ACTIVE SETUP KEYS ----- Checking the StubPath calls in the Active Setup\Installed Components registry keys: Key=<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} StubPath=C:\WINDOWS\system32\ieudinit.exe - this reference has been left in place ---------- Key=>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} StubPath=C:\WINDOWS\inf\unregmp2.exe - this reference has been left in place ---------- Key=>{26923b43-4d38-484f-9b9e-de460746276c} StubPath=C:\WINDOWS\system32\ie4uinit.exe - this reference has been left in place ---------- Key=>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} StubPath=C:\WINDOWS\system32\shmgrate.exe - this reference has been left in place ---------- Key={2C7339CF-2B09-4501-B3F3-F3508C9228ED} StubPath=C:\WINDOWS\system32\regsvr32.exe - this reference has been left in place ---------- Key={44BBA840-CC51-11CF-AAFA-00AA00B6015C} StubPath=C:\Program Files\Outlook Express\setup50.exe - this reference has been left in place ---------- Key={7790769C-0471-11d2-AF11-00C04FA35D02} StubPath=C:\Program Files\Outlook Express\setup50.exe - this reference has been left in place ---------- Key={89820200-ECBD-11cf-8B85-00AA005B4340} StubPath=regsvr32.exe - this reference has been left in place ---------- Key={89820200-ECBD-11cf-8B85-00AA005B4383} StubPath=C:\WINDOWS\system32\ie4uinit.exe - this reference has been left in place ---------- ********************************************** 12:12:39: Scanning ----- SERVICEDLL REGISTRY KEYS ----- Checking DLL files called from the CurrentControlSet\Services Keys: -------------------- Key=Alerter ServiceDLL=%SystemRoot%\system32\alrsvc.dll - this reference has been left in place -------------------- Key=AppMgmt ServiceDLL=%SystemRoot%\System32\appmgmts.dll - this reference has been left in place -------------------- Key=AudioSrv ServiceDLL=%SystemRoot%\System32\audiosrv.dll - this reference has been left in place -------------------- Key=BITS ServiceDLL=C:\WINDOWS\system32\qmgr.dll - this reference has been left in place -------------------- Key=Browser ServiceDLL=%SystemRoot%\System32\browser.dll - this reference has been left in place -------------------- Key=CryptSvc ServiceDLL=%SystemRoot%\System32\cryptsvc.dll - this reference has been left in place -------------------- Key=DcomLaunch ServiceDLL=%SystemRoot%\system32\rpcss.dll - this reference has been left in place -------------------- Key=Dhcp ServiceDLL=%SystemRoot%\System32\dhcpcsvc.dll - this reference has been left in place -------------------- Key=dmserver ServiceDLL=%SystemRoot%\System32\dmserver.dll - this reference has been left in place -------------------- Key=Dnscache ServiceDLL=%SystemRoot%\System32\dnsrslvr.dll - this reference has been left in place -------------------- Key=ERSvc ServiceDLL=%SystemRoot%\System32\ersvc.dll - this reference has been left in place -------------------- Key=EventSystem ServiceDLL=C:\WINDOWS\system32\es.dll - this reference has been left in place -------------------- Key=FastUserSwitchingCompatibility ServiceDLL=%SystemRoot%\System32\shsvcs.dll - this reference has been left in place -------------------- Key=helpsvc ServiceDLL=%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll - this reference has been left in place -------------------- Key=HidServ ServiceDLL=%SystemRoot%\System32\hidserv.dll - this reference has been left in place -------------------- Key=HTTPFilter ServiceDLL=%SystemRoot%\System32\w3ssl.dll - this reference has been left in place -------------------- Key=lanmanserver ServiceDLL=%SystemRoot%\System32\srvsvc.dll - this reference has been left in place -------------------- Key=lanmanworkstation ServiceDLL=%SystemRoot%\System32\wkssvc.dll - this reference has been left in place -------------------- Key=LmHosts ServiceDLL=%SystemRoot%\System32\lmhsvc.dll - this reference has been left in place -------------------- Key=Messenger ServiceDLL=%SystemRoot%\System32\msgsvc.dll - this reference has been left in place -------------------- Key=Netman ServiceDLL=%SystemRoot%\System32\netman.dll - this reference has been left in place -------------------- Key=Nla ServiceDLL=%SystemRoot%\System32\mswsock.dll - this reference has been left in place -------------------- Key=NtmsSvc ServiceDLL=%SystemRoot%\system32\ntmssvc.dll - this reference has been left in place -------------------- Key=RasAuto ServiceDLL=%SystemRoot%\System32\rasauto.dll - this reference has been left in place -------------------- Key=RasMan ServiceDLL=%SystemRoot%\System32\rasmans.dll - this reference has been left in place -------------------- Key=RemoteAccess ServiceDLL=%SystemRoot%\System32\mprdim.dll - this reference has been left in place -------------------- Key=RemoteRegistry ServiceDLL=%SystemRoot%\system32\regsvc.dll - this reference has been left in place -------------------- Key=RpcSs ServiceDLL=%SystemRoot%\system32\rpcss.dll - this reference has been left in place -------------------- Key=Schedule ServiceDLL=%SystemRoot%\system32\schedsvc.dll - this reference has been left in place -------------------- Key=seclogon ServiceDLL=%SystemRoot%\System32\seclogon.dll - this reference has been left in place -------------------- Key=SENS ServiceDLL=%SystemRoot%\system32\sens.dll - this reference has been left in place -------------------- Key=SharedAccess ServiceDLL=%SystemRoot%\System32\ipnathlp.dll - this reference has been left in place -------------------- Key=ShellHWDetection ServiceDLL=%SystemRoot%\System32\shsvcs.dll - this reference has been left in place -------------------- Key=srservice ServiceDLL=C:\WINDOWS\system32\srsvc.dll - this reference has been left in place -------------------- Key=SSDPSRV ServiceDLL=%SystemRoot%\System32\ssdpsrv.dll - this reference has been left in place -------------------- Key=stisvc ServiceDLL=%SystemRoot%\system32\wiaservc.dll - this reference has been left in place -------------------- Key=TapiSrv ServiceDLL=%SystemRoot%\System32\tapisrv.dll - this reference has been left in place -------------------- Key=TermService ServiceDLL=%SystemRoot%\System32\termsrv.dll - this reference has been left in place -------------------- Key=Themes ServiceDLL=%SystemRoot%\System32\shsvcs.dll - this reference has been left in place -------------------- Key=TrkWks ServiceDLL=%SystemRoot%\system32\trkwks.dll - this reference has been left in place -------------------- Key=upnphost ServiceDLL=%SystemRoot%\System32\upnphost.dll - this reference has been left in place -------------------- Key=UxTuneUp ServiceDLL=%SystemRoot%\System32\uxtuneup.dll - this reference has been left in place -------------------- Key=W32Time ServiceDLL=C:\WINDOWS\system32\w32time.dll - this reference has been left in place -------------------- Key=WebClient ServiceDLL=%SystemRoot%\System32\webclnt.dll - this reference has been left in place -------------------- Key=winmgmt ServiceDLL=%SystemRoot%\system32\wbem\WMIsvc.dll - this reference has been left in place -------------------- Key=WmdmPmSN ServiceDLL=C:\WINDOWS\system32\MsPMSNSv.dll - this reference has been left in place -------------------- Key=Wmi ServiceDLL=%SystemRoot%\System32\advapi32.dll - this reference has been left in place -------------------- Key=wscsvc ServiceDLL=%SYSTEMROOT%\system32\wscsvc.dll - this reference has been left in place -------------------- Key=wuauserv ServiceDLL=C:\WINDOWS\system32\wuauserv.dll - this reference has been left in place -------------------- Key=WZCSVC ServiceDLL=%SystemRoot%\System32\wzcsvc.dll - this reference has been left in place -------------------- Key=xmlprov ServiceDLL=%SystemRoot%\System32\xmlprov.dll - this reference has been left in place ********************************************** 12:12:44: Scanning ----- SERVICES REGISTRY KEYS ----- Checking files called from the CurrentControlSet\Services Keys: Key=ACPI ImagePath=system32\DRIVERS\ACPI.sys - this reference has been left in place ---------- Key=ACPIEC ImagePath=system32\DRIVERS\ACPIEC.sys - this reference has been left in place ---------- Key=aec ImagePath=system32\drivers\aec.sys - this reference has been left in place ---------- Key=AegisP ImagePath=system32\DRIVERS\AegisP.sys - this reference has been left in place ---------- Key=AFD ImagePath=\SystemRoot\System32\drivers\afd.sys - this reference has been left in place ---------- Key=ALG ImagePath=%SystemRoot%\System32\alg.exe - this reference has been left in place ---------- Key=aspnet_state ImagePath=%SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe - this reference has been left in place ---------- Key=AsyncMac ImagePath=system32\DRIVERS\asyncmac.sys - this reference has been left in place ---------- Key=atapi ImagePath=system32\DRIVERS\atapi.sys - this reference has been left in place ---------- Key=Atmarpc ImagePath=system32\DRIVERS\atmarpc.sys - this reference has been left in place ---------- Key=audstub ImagePath=system32\DRIVERS\audstub.sys - this reference has been left in place ---------- Key=AVG Anti-Spyware Driver ImagePath=\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys - this reference has been left in place ---------- Key=AVG Anti-Spyware Guard ImagePath=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe - this reference has been left in place ---------- Key=AvgAsCln ImagePath=System32\DRIVERS\AvgAsCln.sys - this reference has been left in place ---------- Key=AVPCC ImagePath="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service - this reference has been left in place ---------- Key=avpg ImagePath=\??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys - this reference has been left in place ---------- Key=BoiHwsetup ImagePath=system32\drivers\BoiHwSetup.sys - this reference has been left in place ---------- Key=CCDECODE ImagePath=system32\DRIVERS\CCDECODE.sys - this reference has been left in place ---------- Key=Cdrom ImagePath=system32\DRIVERS\cdrom.sys - this reference has been left in place ---------- Key=CFSvcs ImagePath=C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe - this reference has been left in place ---------- Key=CiSvc ImagePath=%SystemRoot%\system32\cisvc.exe - this reference has been left in place ---------- Key=ClipSrv ImagePath=%SystemRoot%\system32\clipsrv.exe - this reference has been left in place ---------- Key=CmBatt ImagePath=system32\DRIVERS\CmBatt.sys - this reference has been left in place ---------- Key=Compbatt ImagePath=system32\DRIVERS\compbatt.sys - this reference has been left in place ---------- Key=COMSysApp ImagePath=C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} - this reference has been left in place ---------- Key=Disk ImagePath=system32\DRIVERS\disk.sys - this reference has been left in place ---------- Key=DLABOIOM ImagePath=System32\DLA\DLABOIOM.SYS - this reference has been left in place ---------- Key=DLACDBHM ImagePath=System32\Drivers\DLACDBHM.SYS - this reference has been left in place ---------- Key=DLADResN ImagePath=System32\DLA\DLADResN.SYS - this reference has been left in place ---------- Key=DLAIFS_M ImagePath=System32\DLA\DLAIFS_M.SYS - this reference has been left in place ---------- Key=DLAOPIOM ImagePath=System32\DLA\DLAOPIOM.SYS - this reference has been left in place ---------- Key=DLAPoolM ImagePath=System32\DLA\DLAPoolM.SYS - this reference has been left in place ---------- Key=DLARTL_N ImagePath=System32\Drivers\DLARTL_N.SYS - this reference has been left in place ---------- Key=DLAUDFAM ImagePath=System32\DLA\DLAUDFAM.SYS - this reference has been left in place ---------- Key=DLAUDF_M ImagePath=System32\DLA\DLAUDF_M.SYS - this reference has been left in place ---------- Key=dmadmin ImagePath=%SystemRoot%\System32\dmadmin.exe /com - this reference has been left in place ---------- Key=dmboot ImagePath=System32\drivers\dmboot.sys - this reference has been left in place ---------- Key=dmio ImagePath=System32\drivers\dmio.sys - this reference has been left in place ---------- Key=dmload ImagePath=System32\drivers\dmload.sys - this reference has been left in place ---------- Key=DMusic ImagePath=system32\drivers\DMusic.sys - this reference has been left in place ---------- Key=drmkaud ImagePath=system32\drivers\drmkaud.sys - this reference has been left in place ---------- Key=DRVMCDB ImagePath=System32\Drivers\DRVMCDB.SYS - this reference has been left in place ---------- Key=DRVNDDM ImagePath=System32\Drivers\DRVNDDM.SYS - this reference has been left in place ---------- Key=DVD-RAM_Service ImagePath=C:\WINDOWS\system32\DVDRAMSV.exe - this reference has been left in place ---------- Key=Eventlog ImagePath=%SystemRoot%\system32\services.exe - this reference has been left in place ---------- Key=EvtEng ImagePath=C:\Program Files\Intel\Wireless\Bin\EvtEng.exe - this reference has been left in place ---------- Key=EXAMPLE ImagePath=\??\C:\WINDOWS\system32\main.sys - this reference has been left in place [file not found to scan] ---------- Key=FltMgr ImagePath=system32\DRIVERS\fltMgr.sys - this reference has been left in place ---------- Key=Ftdisk ImagePath=system32\DRIVERS\ftdisk.sys - this reference has been left in place ---------- Key=gmer ImagePath=System32\DRIVERS\gmer.sys - this reference has been left in place ---------- Key=Gpc ImagePath=system32\DRIVERS\msgpc.sys - this reference has been left in place ---------- Key=HdAudAddService ImagePath=system32\drivers\CHDAud.sys - this reference has been left in place ---------- Key=HDAudBus ImagePath=system32\DRIVERS\HDAudBus.sys - this reference has been left in place ---------- Key=hflt_ipf ImagePath=\??\C:\WINDOWS\system32\Drivers\hflt_ipf.sys - this reference has been left in place [file not found to scan] ---------- Key=HidUsb ImagePath=system32\DRIVERS\hidusb.sys - this reference has been left in place ---------- Key=HSFHWAZL ImagePath=system32\DRIVERS\HSFHWAZL.sys - this reference has been left in place ---------- Key=HSF_DPV ImagePath=system32\DRIVERS\HSF_DPV.sys - this reference has been left in place ---------- Key=HTTP ImagePath=System32\Drivers\HTTP.sys - this reference has been left in place ---------- Key=i8042prt ImagePath=system32\DRIVERS\i8042prt.sys - this reference has been left in place ---------- Key=ialm ImagePath=system32\DRIVERS\ialmnt5.sys - this reference has been left in place ---------- Key=IDriverT ImagePath="C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" - this reference has been left in place ---------- Key=Imapi ImagePath=system32\DRIVERS\imapi.sys - this reference has been left in place ---------- Key=ImapiService ImagePath=C:\WINDOWS\system32\imapi.exe - this reference has been left in place ---------- Key=intelppm ImagePath=system32\DRIVERS\intelppm.sys - this reference has been left in place ---------- Key=IpFilterDriver ImagePath=system32\DRIVERS\ipfltdrv.sys - this reference has been left in place ---------- Key=IpInIp ImagePath=system32\DRIVERS\ipinip.sys - this reference has been left in place ---------- Key=IpNat ImagePath=system32\DRIVERS\ipnat.sys - this reference has been left in place ---------- Key=IPSec ImagePath=system32\DRIVERS\ipsec.sys - this reference has been left in place ---------- Key=IRENUM ImagePath=system32\DRIVERS\irenum.sys - this reference has been left in place ---------- Key=isapnp ImagePath=system32\DRIVERS\isapnp.sys - this reference has been left in place ---------- Key=Iviaspi ImagePath=system32\drivers\iviaspi.sys - this reference has been left in place ---------- Key=KAVMonitorService ImagePath="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service - this reference has been left in place ---------- Key=Kbdclass ImagePath=system32\DRIVERS\kbdclass.sys - this reference has been left in place ---------- Key=kbdhid ImagePath=system32\DRIVERS\kbdhid.sys - this reference has been left in place ---------- Key=kmixer ImagePath=system32\drivers\kmixer.sys - this reference has been left in place ---------- Key=mdmxsdk ImagePath=system32\DRIVERS\mdmxsdk.sys - this reference has been left in place ---------- Key=meiudf ImagePath=System32\Drivers\meiudf.sys - this reference has been left in place ---------- Key=mnmsrvc ImagePath=C:\WINDOWS\system32\mnmsrvc.exe - this reference has been left in place ---------- Key=Mouclass ImagePath=system32\DRIVERS\mouclass.sys - this reference has been left in place ---------- Key=mouhid ImagePath=system32\DRIVERS\mouhid.sys - this reference has been left in place ---------- Key=MRxDAV ImagePath=system32\DRIVERS\mrxdav.sys - this reference has been left in place ---------- Key=MRxSmb ImagePath=system32\DRIVERS\mrxsmb.sys - this reference has been left in place ---------- Key=MSDTC ImagePath=C:\WINDOWS\system32\msdtc.exe - this reference has been left in place ---------- Key=MSIServer ImagePath=C:\WINDOWS\system32\msiexec.exe /V - this reference has been left in place ---------- Key=MSKSSRV ImagePath=system32\drivers\MSKSSRV.sys - this reference has been left in place ---------- Key=MSPCLOCK ImagePath=system32\drivers\MSPCLOCK.sys - this reference has been left in place ---------- Key=MSPQM ImagePath=system32\drivers\MSPQM.sys - this reference has been left in place ---------- Key=mssmbios ImagePath=system32\DRIVERS\mssmbios.sys - this reference has been left in place ---------- Key=MSTEE ImagePath=system32\drivers\MSTEE.sys - this reference has been left in place ---------- Key=NABTSFEC ImagePath=system32\DRIVERS\NABTSFEC.sys - this reference has been left in place ---------- Key=NdisIP ImagePath=system32\DRIVERS\NdisIP.sys - this reference has been left in place ---------- Key=NdisTapi ImagePath=system32\DRIVERS\ndistapi.sys - this reference has been left in place ---------- Key=Ndisuio ImagePath=system32\DRIVERS\ndisuio.sys - this reference has been left in place ---------- Key=NdisWan ImagePath=system32\DRIVERS\ndiswan.sys - this reference has been left in place ---------- Key=NetBIOS ImagePath=system32\DRIVERS\netbios.sys - this reference has been left in place ---------- Key=NetBT ImagePath=system32\DRIVERS\netbt.sys - this reference has been left in place ---------- Key=NetDDE ImagePath=%SystemRoot%\system32\netdde.exe - this reference has been left in place ---------- Key=NetDDEdsdm ImagePath=%SystemRoot%\system32\netdde.exe - this reference has been left in place ---------- Key=Netdevio ImagePath=system32\DRIVERS\netdevio.sys - this reference has been left in place ---------- Key=Netlogon ImagePath=%SystemRoot%\system32\lsass.exe - this reference has been left in place ---------- Key=NtLmSsp ImagePath=%SystemRoot%\system32\lsass.exe - this reference has been left in place ---------- Key=NwlnkFlt ImagePath=system32\DRIVERS\nwlnkflt.sys - this reference has been left in place ---------- Key=NwlnkFwd ImagePath=system32\DRIVERS\nwlnkfwd.sys - this reference has been left in place ---------- Key=ose ImagePath="C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" - this reference has been left in place ---------- Key=PCI ImagePath=system32\DRIVERS\pci.sys - this reference has been left in place ---------- Key=PCIIde ImagePath=system32\DRIVERS\pciide.sys - this reference has been left in place ---------- Key=Pcmcia ImagePath=system32\DRIVERS\pcmcia.sys - this reference has been left in place ---------- Key=Pfc ImagePath=system32\drivers\pfc.sys - this reference has been left in place ---------- Key=PlugPlay ImagePath=%SystemRoot%\system32\services.exe - this reference has been left in place ---------- Key=PolicyAgent ImagePath=%SystemRoot%\system32\lsass.exe - this reference has been left in place ---------- Key=PptpMiniport ImagePath=system32\DRIVERS\raspptp.sys - this reference has been left in place ---------- Key=ProtectedStorage ImagePath=%SystemRoot%\system32\lsass.exe - this reference has been left in place ---------- Key=PSched ImagePath=system32\DRIVERS\psched.sys - this reference has been left in place ---------- Key=Ptilink ImagePath=system32\DRIVERS\ptilink.sys - this reference has been left in place ---------- Key=PxHelp20 ImagePath=System32\Drivers\PxHelp20.sys - this reference has been left in place ---------- Key=qkbfiltr ImagePath=system32\drivers\qkbfiltr.sys - this reference has been left in place ---------- Key=qmofiltr ImagePath=system32\drivers\qmofiltr.sys - this reference has been left in place ---------- Key=RasAcd ImagePath=system32\DRIVERS\rasacd.sys - this reference has been left in place ---------- Key=Rasl2tp ImagePath=system32\DRIVERS\rasl2tp.sys - this reference has been left in place ---------- Key=RasPppoe ImagePath=system32\DRIVERS\raspppoe.sys - this reference has been left in place ---------- Key=Raspti ImagePath=system32\DRIVERS\raspti.sys - this reference has been left in place ---------- Key=Rdbss ImagePath=system32\DRIVERS\rdbss.sys - this reference has been left in place ---------- Key=RDPCDD ImagePath=System32\DRIVERS\RDPCDD.sys - this reference has been left in place ---------- Key=rdpdr ImagePath=system32\DRIVERS\rdpdr.sys - this reference has been left in place ---------- Key=RDSessMgr ImagePath=C:\WINDOWS\system32\sessmgr.exe - this reference has been left in place ---------- Key=redbook ImagePath=system32\DRIVERS\redbook.sys - this reference has been left in place ---------- Key=RegSrvc ImagePath=C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe - this reference has been left in place ---------- Key=RpcLocator ImagePath=%SystemRoot%\system32\locator.exe - this reference has been left in place ---------- Key=RSVP ImagePath=%SystemRoot%\system32\rsvp.exe - this reference has been left in place ---------- Key=RTL8023xp ImagePath=system32\DRIVERS\Rtlnicxp.sys - this reference has been left in place ---------- Key=rtl8139 ImagePath=system32\DRIVERS\RTL8139.SYS - this reference has been left in place ---------- Key=Runtime ImagePath=\??\C:\WINDOWS\System32\drivers\runtime.sys - this reference has been left in place [file not found to scan] ---------- Key=S24EventMonitor ImagePath=C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe - this reference has been left in place ---------- Key=s24trans ImagePath=system32\DRIVERS\s24trans.sys - this reference has been left in place ---------- Key=SamSs ImagePath=%SystemRoot%\system32\lsass.exe - this reference has been left in place ---------- Key=SCardSvr ImagePath=%SystemRoot%\System32\SCardSvr.exe - this reference has been left in place ---------- Key=Secdrv ImagePath=system32\DRIVERS\secdrv.sys - this reference has been left in place ---------- Key=SLIP ImagePath=system32\DRIVERS\SLIP.sys - this reference has been left in place ---------- Key=SONYPVU1 ImagePath=system32\DRIVERS\SONYPVU1.SYS - this reference has been left in place ---------- Key=splitter ImagePath=system32\drivers\splitter.sys - this reference has been left in place ---------- Key=Spooler ImagePath=%SystemRoot%\system32\spoolsv.exe - this reference has been left in place ---------- Key=sr ImagePath=system32\DRIVERS\sr.sys - this reference has been left in place ---------- Key=Srv ImagePath=system32\DRIVERS\srv.sys - this reference has been left in place ---------- Key=streamip ImagePath=system32\DRIVERS\StreamIP.sys - this reference has been left in place ---------- Key=swenum ImagePath=system32\DRIVERS\swenum.sys - this reference has been left in place ---------- Key=swmidi ImagePath=system32\drivers\swmidi.sys - this reference has been left in place ---------- Key=SwPrv ImagePath=C:\WINDOWS\system32\dllhost.exe /Processid:{7C7BFE9B-3BDE-4961-A55F-05C8C188F01B} - this reference has been left in place ---------- Key=SynTP ImagePath=system32\DRIVERS\SynTP.sys - this reference has been left in place ---------- Key=sysaudio ImagePath=system32\drivers\sysaudio.sys - this reference has been left in place ---------- Key=SysmonLog ImagePath=%SystemRoot%\system32\smlogsvc.exe - this reference has been left in place ---------- Key=Tcpip ImagePath=system32\DRIVERS\tcpip.sys - this reference has been left in place ---------- Key=TermDD ImagePath=system32\DRIVERS\termdd.sys - this reference has been left in place ---------- Key=TlntSvr ImagePath=C:\WINDOWS\system32\tlntsvr.exe - this reference has been left in place ---------- Key=UIUSys ImagePath=system32\DRIVERS\UIUSYS.SYS - this reference has been left in place [file not found to scan] ---------- Key=UMWdf ImagePath=C:\WINDOWS\system32\wdfmgr.exe - this reference has been left in place ---------- Key=Update ImagePath=system32\DRIVERS\update.sys - this reference has been left in place ---------- Key=UPS ImagePath=%SystemRoot%\System32\ups.exe - this reference has been left in place ---------- Key=usbccgp ImagePath=system32\DRIVERS\usbccgp.sys - this reference has been left in place ---------- Key=usbehci ImagePath=system32\DRIVERS\usbehci.sys - this reference has been left in place ---------- Key=usbhub ImagePath=system32\DRIVERS\usbhub.sys - this reference has been left in place ---------- Key=USBSTOR ImagePath=system32\DRIVERS\USBSTOR.SYS - this reference has been left in place ---------- Key=usbuhci ImagePath=system32\DRIVERS\usbuhci.sys - this reference has been left in place ---------- Key=usbvideo ImagePath=System32\Drivers\usbvideo.sys - this reference has been left in place ---------- Key=VgaSave ImagePath=\SystemRoot\System32\drivers\vga.sys - this reference has been left in place ---------- Key=VSS ImagePath=%SystemRoot%\System32\vssvc.exe - this reference has been left in place ---------- Key=w39n51 ImagePath=system32\DRIVERS\w39n51.sys - this reference has been left in place ---------- Key=Wanarp ImagePath=system32\DRIVERS\wanarp.sys - this reference has been left in place ---------- Key=wdmaud ImagePath=system32\drivers\wdmaud.sys - this reference has been left in place ---------- Key=winachsf ImagePath=system32\DRIVERS\HSF_CNXT.sys - this reference has been left in place ---------- Key=WmiApSrv ImagePath=C:\WINDOWS\system32\wbem\wmiapsrv.exe - this reference has been left in place ---------- Key=WS2IFSL ImagePath=\SystemRoot\System32\drivers\ws2ifsl.sys - this reference has been left in place ---------- Key=WSTCODEC ImagePath=system32\DRIVERS\WSTCODEC.SYS - this reference has been left in place ---------- ********************************************** 12:16:32: Scanning -----VXD ENTRIES----- Checking VMM32 VxD files being loaded ********************************************** 12:16:32: Scanning ----- WINLOGON\NOTIFY DLLS ----- Checking DLLs called from the Winlogon\Notify key: Key=crypt32chain DLLName=crypt32.dll - this reference has been left in place ---------- Key=cryptnet DLLName=cryptnet.dll - this reference has been left in place ---------- Key=cscdll DLLName=cscdll.dll - this reference has been left in place ---------- Key=igfxcui DLLName=igfxdev.dll - this reference has been left in place ---------- Key=ScCertProp DLLName=wlnotify.dll - this reference has been left in place ---------- Key=Schedule DLLName=wlnotify.dll - this reference has been left in place ---------- Key=sclgntfy DLLName=sclgntfy.dll - this reference has been left in place ---------- Key=SensLogn DLLName=WlNotify.dll - this reference has been left in place ---------- Key=termsrv DLLName=wlnotify.dll - this reference has been left in place ---------- Key=wlballoon DLLName=wlnotify.dll - this reference has been left in place ---------- ********************************************** 12:16:33: Scanning ----- CONTEXTMENUHANDLERS ----- Key = AVG Anti-Spyware CLSID = {8934FCEF-F5B8-468f-951F-78A921CD3920} C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll - this ContextMenuHandler has been left in place ---------- Key = BriefcaseMenu CLSID = {85BBD920-42A0-1069-A2E4-08002B30309D} syncui.dll - this ContextMenuHandler has been left in place ---------- Key = Kaspersky Anti-Virus CLSID = {dd230880-495a-11d1-b064-008048ec2fc5} C:\Program Files\Common Files\KAV Shared Files\AvpShlEx.dll - this ContextMenuHandler has been left in place ---------- Key = Offline Files CLSID = {750fdf0e-2a26-11d1-a3ea-080036587f03} %SystemRoot%\System32\cscui.dll - this ContextMenuHandler has been left in place ---------- Key = Open With CLSID = {09799AFB-AD67-11d1-ABCD-00C04FC30936} %SystemRoot%\system32\SHELL32.dll - this ContextMenuHandler has been left in place ---------- Key = Open With EncryptionMenu CLSID = {A470F8CF-A1E8-4f65-8335-227475AA5C46} %SystemRoot%\system32\SHELL32.dll - this ContextMenuHandler has been left in place ---------- Key = Trojan Remover CLSID = {52B87208-9CCF-42C9-B88E-069281105805} C:\PROGRA~1\TROJAN~1\Trshlex.dll - this ContextMenuHandler has been left in place ---------- Key = TuneUp Shredder Shell Extension CLSID = {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll - this ContextMenuHandler has been left in place ---------- Key = {a2a9545d-a0c2-42b4-9708-a0b2badd77c8} %SystemRoot%\system32\SHELL32.dll - this ContextMenuHandler has been left in place ---------- ********************************************** 12:16:33: Scanning ----- FOLDER\COLUMNHANDLERS ----- Key = {0D2E74C4-3C34-11d2-A27E-00C04FC30871} %SystemRoot%\system32\SHELL32.dll - this Folder\ColumnHandler has been left in place ---------- Key = {24F14F01-7B1C-11d1-838f-0000F80461CF} %SystemRoot%\system32\SHELL32.dll - this Folder\ColumnHandler has been left in place ---------- Key = {24F14F02-7B1C-11d1-838f-0000F80461CF} %SystemRoot%\system32\SHELL32.dll - this Folder\ColumnHandler has been left in place ---------- Key = {66742402-F9B9-11D1-A202-0000F81FEDEE} %SystemRoot%\system32\SHELL32.dll - this Folder\ColumnHandler has been left in place ---------- Key = {F9DB5320-233E-11D1-9F84-707F02C10627} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll - this Folder\ColumnHandler has been left in place ---------- ********************************************** 12:16:34: Scanning ----- BROWSER HELPER OBJECTS ----- Key = {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - this Browser Helper Object has been left in place ---------- Key = {5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\System32\DLA\DLASHX_W.DLL - this Browser Helper Object has been left in place ---------- Key = {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - this Browser Helper Object has been left in place ---------- ********************************************** 12:16:34: Scanning ----- SHELLSERVICEOBJECTS ----- Key = PostBootReminder %SystemRoot%\system32\SHELL32.dll - this ShellServiceObject has been left in place ---------- Key = CDBurn %SystemRoot%\system32\SHELL32.dll - this ShellServiceObject has been left in place ---------- Key = WebCheck C:\WINDOWS\system32\webcheck.dll - this ShellServiceObject has been left in place ---------- Key = SysTray C:\WINDOWS\system32\stobject.dll - this ShellServiceObject has been left in place ---------- ********************************************** 12:16:34: Scanning ----- SHAREDTASKSCHEDULER ENTRIES ----- Value = {438755C2-A8BA-11D1-B96B-00A0C90312E1} Comment = Browseui preloader File: %SystemRoot%\system32\browseui.dll - this SharedTaskScheduler entry has been left in place ---------- Value = {8C7461EF-2B13-11d2-BE35-3078302C2030} Comment = Component Categories cache daemon File: %SystemRoot%\system32\browseui.dll - this SharedTaskScheduler entry has been left in place ---------- ********************************************** 12:16:34: Scanning ----- IMAGEFILE DEBUGGERS ----- No "Debugger" entries found. ********************************************** 12:16:34: Scanning ----- APPINIT_DLLS ----- The AppInit_DLLs value is blank ********************************************** 12:16:34: Scanning ------ COMMON STARTUP GROUP ------ [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] The Common Startup Group attempts to load the following file(s) at boot time: desktop.ini - this file is expected and has been left in place -------------------- ********************************************** 12:16:34: Scanning ------ USER STARTUP GROUPS ------ -------------------- Checking Startup Group for Administrator [C:\Documents and Settings\Administrator\START MENU\PROGRAMS\STARTUP] The Startup Group for Administrator attempts to load the following file(s): desktop.ini - this file is expected and has been left in place -------------------- Checking Startup Group for Biljka [C:\Documents and Settings\Biljka\START MENU\PROGRAMS\STARTUP] The Startup Group for Biljka attempts to load the following file(s): desktop.ini - this file is expected and has been left in place -------------------- Checking Startup Group for Nada [C:\Documents and Settings\Nada\START MENU\PROGRAMS\STARTUP] The Startup Group for Nada attempts to load the following file(s): desktop.ini - this file is expected and has been left in place Microsoft Office OneNote 2003 Quick Launch.lnk - this links to C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE and has been left in place ********************************************** 12:16:35: Scanning ----- SCHEDULED TASKS ----- ********************************************** 12:16:35: ----- EXTRA CHECKS ----- PE386 rootkit checks completed ---------- Winlogon registry rootkit checks completed ---------- Heuristic checks for hidden files/drivers completed ---------- ********************************************** 12:16:35: Scanning ------ DOWNLOADED PROGRAM FILES ------ The following files are located in the DOWNLOADED PROGRAM FILES directory: C:\WINDOWS\Downloaded Program Files\desktop.ini - this file is expected and has been left in place C:\WINDOWS\Downloaded Program Files\swflash.inf - this file has been left in place ********************************************** 12:16:35: Scanning ----- RUNNING PROCESSES ----- C:\WINDOWS\System32\smss.exe -------------------- C:\WINDOWS\system32\csrss.exe -------------------- C:\WINDOWS\system32\winlogon.exe -------------------- C:\WINDOWS\system32\services.exe -------------------- C:\WINDOWS\system32\lsass.exe -------------------- C:\WINDOWS\system32\svchost.exe -------------------- C:\WINDOWS\system32\svchost.exe -------------------- C:\WINDOWS\System32\svchost.exe -------------------- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -------------------- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -------------------- C:\WINDOWS\system32\svchost.exe -------------------- C:\WINDOWS\system32\svchost.exe -------------------- C:\WINDOWS\system32\spoolsv.exe -------------------- C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe -------------------- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe -------------------- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -------------------- C:\WINDOWS\system32\DVDRAMSV.exe -------------------- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe -------------------- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -------------------- C:\WINDOWS\system32\svchost.exe -------------------- C:\WINDOWS\system32\wdfmgr.exe -------------------- C:\WINDOWS\Explorer.EXE -------------------- C:\WINDOWS\system32\ctfmon.exe -------------------- C:\WINDOWS\System32\alg.exe -------------------- C:\WINDOWS\system32\notepad.exe -------------------- C:\WINDOWS\system32\wuauclt.exe -------------------- C:\WINDOWS\system32\spider.exe -------------------- C:\Documents and Settings\Biljka\Application Data\Simply Super Software\Trojan Remover\jtu5D.exe FileSize: 1,782,336 [This is a Trojan Remover component] -------------------- ********************************************** 12:16:40: Checking AUTOEXEC.BAT file AUTOEXEC.BAT found in C:\ No malicious entries were found in the AUTOEXEC.BAT file ********************************************** 12:16:40: Checking AUTOEXEC.NT file AUTOEXEC.NT found in C:\WINDOWS\system32 No malicious entries were found in the AUTOEXEC.NT file ********************************************** ------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------ HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\"Start Page": go.microsoft.com/fwlink/?LinkId=69157 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\"Local Page": %SystemRoot%\system32\blank.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\"Search Page": go.microsoft.com/fwlink/?LinkId=54896 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL": go.microsoft.com/fwlink/?LinkId=69157 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL": go.microsoft.com/fwlink/?LinkId=54896 HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch": ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\"SearchAssistant": ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Start Page": google.com HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Local Page": C:\WINDOWS\system32\blank.htm HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Search Page": microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ********************************************** === NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES === Scan completed at: 30/04/2007 12:16:40 ******************************************************** * NORMAL SCAN FOR ACTIVE MALWARE * Trojan Remover Ver 6.6.0.2465. For information, email simplysupsupport@aol.com [Unregistered version] Scan started at: 27/04/2007 22:38:10 Using Database v6783 Operating System: Windows XP Professional Service Pack 2 (Build 2600) Using data directory: C:\Documents and Settings\Biljka\Application Data\Simply Super Software\Trojan Remover\ Logfile directory: C:\Documents and Settings\Biljka\My Documents\Simply Super Software\Trojan Remover Logfiles\ Running with Administrator privileges ********************************************** The following Anti-Malware program(s) are loaded: AVG Anti-Spyware AVG Anti-Virus AVG Anti-Virus ********************************************** Checking Registry exefile command for modifications Checking Registry comfile command for modifications Checking Registry piffile command for modifications Checking Registry batfile command for modifications Checking Registry regfile command for modifications Checking Registry cmdfile command for modifications Checking Registry scrfile command for modifications ********************************************** 22:38:10: Scanning ----------WIN.INI----------- WIN.INI found in C:\WINDOWS ********************************************** 22:38:11: Scanning --------SYSTEM.INI--------- SYSTEM.INI found in C:\WINDOWS ********************************************** 22:38:11: ----- SCANNING FOR ROOTKIT SERVICES ----- No hidden Services were detected. ********************************************** 22:38:11: Scanning -----WINDOWS REGISTRY----- -------------------- Checking HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon This key's "Shell" value calls the following program(s): Explorer.exe - this entry has been left in place ---------- This key's "Userinit" value calls the following program(s): C:\WINDOWS\system32\userinit.exe - this entry has been left in place ---------- This key's "System" value appears to be blank ---------- -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows -------------------- Checking HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Value Name = load The Data Value for this entry appears to be blank -------------------- -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run This Registry Key attempts to run the following program(s): Value Name = TrojanScanner Value Data = C:\Program Files\Trojan Remover\Trjscan.exe - this program is Trojan Remover's own scan file -------------------- Value Name = !AVG Anti-Spyware Value Data = C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized - this command has been left in place -------------------- -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce This Registry Key appears to be empty -------------------- Checking HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx This Registry Key appears to be empty -------------------- Checking HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run This Registry Key attempts to run the following program(s): Value Name = ctfmon.exe Value Data = C:\WINDOWS\system32\ctfmon.exe - this command has been left in place -------------------- -------------------- Checking HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce This Registry Key appears to be empty ********************************************** 22:38:12: Scanning -----SHELLEXECUTEHOOKS----- ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972} File: shell32.dll - this file is expected and has been left in place ---------- ValueName: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} Value: AVG Anti-Spyware 7.5 File: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll - this ShellExecuteHook has been left in place ---------- ********************************************** 22:38:12: Scanning -----HIDDEN REGISTRY ENTRIES----- Taskdir check completed ---------- No Registry Run Keys Hidden Entries found ---------- ********************************************** 22:38:12: Scanning -----ACTIVE SCREENSAVER----- ScreenSaver=C:\WINDOWS\system32\logon.scr - this command has been left in place -------------------- ********************************************** 22:38:12: Scanning ----- REGISTRY ACTIVE SETUP KEYS ----- Checking the StubPath calls in the Active Setup\Installed Components registry keys: Key=<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} StubPath=C:\WINDOWS\system32\ieudinit.exe - this reference has been left in place ---------- Key=>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} StubPath=C:\WINDOWS\inf\unregmp2.exe - this reference has been left in place ---------- Key=>{26923b43-4d38-484f-9b9e-de460746276c} StubPath=C:\WINDOWS\system32\ie4uinit.exe - this reference has been left in place ---------- Key=>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} StubPath=C:\WINDOWS\system32\shmgrate.exe - this reference has been left in place ---------- Key={2C7339CF-2B09-4501-B3F3-F3508C9228ED} StubPath=C:\WINDOWS\system32\regsvr32.exe - this reference has been left in place ---------- Key={44BBA840-CC51-11CF-AAFA-00AA00B6015C} StubPath=C:\Program Files\Outlook Express\setup50.exe - this reference has been left in place ---------- Key={7790769C-0471-11d2-AF11-00C04FA35D02} StubPath=C:\Program Files\Outlook Express\setup50.exe - this reference has been left in place ---------- Key={89820200-ECBD-11cf-8B85-00AA005B4340} StubPath=regsvr32.exe - this reference has been left in place ---------- Key={89820200-ECBD-11cf-8B85-00AA005B4383} StubPath=C:\WINDOWS\system32\ie4uinit.exe - this reference has been left in place ---------- ********************************************** 22:38:14: Scanning ----- SERVICEDLL REGISTRY KEYS ----- Checking DLL files called from the CurrentControlSet\Services Keys: -------------------- Key=Alerter ServiceDLL=%SystemRoot%\system32\alrsvc.dll - this reference has been left in place -------------------- Key=AppMgmt ServiceDLL=%SystemRoot%\System32\appmgmts.dll - this reference has been left in place -------------------- Key=AudioSrv ServiceDLL=%SystemRoot%\System32\audiosrv.dll - this reference has been left in place -------------------- Key=BITS ServiceDLL=C:\WINDOWS\system32\qmgr.dll - this reference has been left in place -------------------- Key=Browser ServiceDLL=%SystemRoot%\System32\browser.dll - this reference has been left in place -------------------- Key=CryptSvc ServiceDLL=%SystemRoot%\System32\cryptsvc.dll - this reference has been left in place -------------------- Key=DcomLaunch ServiceDLL=%SystemRoot%\system32\rpcss.dll - this reference has been left in place -------------------- Key=Dhcp ServiceDLL=%SystemRoot%\System32\dhcpcsvc.dll - this reference has been left in place -------------------- Key=dmserver ServiceDLL=%SystemRoot%\System32\dmserver.dll - this reference has been left in place -------------------- Key=Dnscache ServiceDLL=%SystemRoot%\System32\dnsrslvr.dll - this reference has been left in place -------------------- Key=ERSvc ServiceDLL=%SystemRoot%\System32\ersvc.dll - this reference has been left in place -------------------- Key=EventSystem ServiceDLL=C:\WINDOWS\system32\es.dll - this reference has been left in place -------------------- Key=FastUserSwitchingCompatibility ServiceDLL=%SystemRoot%\System32\shsvcs.dll - this reference has been left in place -------------------- Key=helpsvc ServiceDLL=%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll - this reference has been left in place -------------------- Key=HidServ ServiceDLL=%SystemRoot%\System32\hidserv.dll - this reference has been left in place -------------------- Key=HTTPFilter ServiceDLL=%SystemRoot%\System32\w3ssl.dll - this reference has been left in place -------------------- Key=lanmanserver ServiceDLL=%SystemRoot%\System32\srvsvc.dll - this reference has been left in place -------------------- Key=lanmanworkstation ServiceDLL=%SystemRoot%\System32\wkssvc.dll - this reference has been left in place -------------------- Key=LmHosts ServiceDLL=%SystemRoot%\System32\lmhsvc.dll - this reference has been left in place -------------------- Key=Messenger ServiceDLL=%SystemRoot%\System32\msgsvc.dll - this reference has been left in place -------------------- Key=Netman ServiceDLL=%SystemRoot%\System32\netman.dll - this reference has been left in place -------------------- Key=Nla ServiceDLL=%SystemRoot%\System32\mswsock.dll - this reference has been left in place -------------------- Key=NtmsSvc ServiceDLL=%SystemRoot%\system32\ntmssvc.dll - this reference has been left in place -------------------- Key=RasAuto ServiceDLL=%SystemRoot%\System32\rasauto.dll - this reference has been left in place -------------------- Key=RasMan ServiceDLL=%SystemRoot%\System32\rasmans.dll - this reference has been left in place -------------------- Key=RemoteAccess ServiceDLL=%SystemRoot%\System32\mprdim.dll - this reference has been left in place -------------------- Key=RemoteRegistry ServiceDLL=%SystemRoot%\system32\regsvc.dll - this reference has been left in place -------------------- Key=RpcSs ServiceDLL=%SystemRoot%\system32\rpcss.dll - this reference has been left in place -------------------- Key=Schedule ServiceDLL=%SystemRoot%\system32\schedsvc.dll - this reference has been left in place -------------------- Key=seclogon ServiceDLL=%SystemRoot%\System32\seclogon.dll - this reference has been left in place -------------------- Key=SENS ServiceDLL=%SystemRoot%\system32\sens.dll - this reference has been left in place -------------------- Key=SharedAccess ServiceDLL=%SystemRoot%\System32\ipnathlp.dll - this reference has been left in place -------------------- Key=ShellHWDetection ServiceDLL=%SystemRoot%\System32\shsvcs.dll - this reference has been left in place -------------------- Key=srservice ServiceDLL=C:\WINDOWS\system32\srsvc.dll - this reference has been left in place -------------------- Key=SSDPSRV ServiceDLL=%SystemRoot%\System32\ssdpsrv.dll - this reference has been left in place -------------------- Key=stisvc ServiceDLL=%SystemRoot%\system32\wiaservc.dll - this reference has been left in place -------------------- Key=TapiSrv ServiceDLL=%SystemRoot%\System32\tapisrv.dll - this reference has been left in place -------------------- Key=TermService ServiceDLL=%SystemRoot%\System32\termsrv.dll - this reference has been left in place -------------------- Key=Themes ServiceDLL=%SystemRoot%\System32\shsvcs.dll - this reference has been left in place -------------------- Key=TrkWks ServiceDLL=%SystemRoot%\system32\trkwks.dll - this reference has been left in place -------------------- Key=upnphost ServiceDLL=%SystemRoot%\System32\upnphost.dll - this reference has been left in place -------------------- Key=UxTuneUp ServiceDLL=%SystemRoot%\System32\uxtuneup.dll - this reference has been left in place -------------------- Key=W32Time ServiceDLL=C:\WINDOWS\system32\w32time.dll - this reference has been left in place -------------------- Key=WebClient ServiceDLL=%SystemRoot%\System32\webclnt.dll - this reference has been left in place -------------------- Key=winmgmt ServiceDLL=%SystemRoot%\system32\wbem\WMIsvc.dll - this reference has been left in place -------------------- Key=WmdmPmSN ServiceDLL=C:\WINDOWS\system32\MsPMSNSv.dll - this reference has been left in place -------------------- Key=Wmi ServiceDLL=%SystemRoot%\System32\advapi32.dll - this reference has been left in place -------------------- Key=wscsvc ServiceDLL=%SYSTEMROOT%\system32\wscsvc.dll - this reference has been left in place -------------------- Key=wuauserv ServiceDLL=C:\WINDOWS\system32\wuauserv.dll - this reference has been left in place -------------------- Key=WZCSVC ServiceDLL=%SystemRoot%\System32\wzcsvc.dll - this reference has been left in place -------------------- Key=xmlprov ServiceDLL=%SystemRoot%\System32\xmlprov.dll - this reference has been left in place ************************************************ 22:38:19: Scanning ----- SERVICES REGISTRY KEYS ----- Checking files called from the CurrentControlSet\Services Keys: Key=ACPI ImagePath=system32\DRIVERS\ACPI.sys - this reference has been left in place ---------- Key=ACPIEC ImagePath=system32\DRIVERS\ACPIEC.sys - this reference has been left in place ---------- Key=aec ImagePath=system32\drivers\aec.sys - this reference has been left in place ---------- Key=AegisP ImagePath=system32\DRIVERS\AegisP.sys - this reference has been left in place ---------- Key=AFD ImagePath=\SystemRoot\System32\drivers\afd.sys - this reference has been left in place ---------- Key=ALG ImagePath=%SystemRoot%\System32\alg.exe - this reference has been left in place ---------- Key=aspnet_state ImagePath=%SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe - this reference has been left in place ---------- Key=AsyncMac ImagePath=system32\DRIVERS\asyncmac.sys - this reference has been left in place ---------- Key=atapi ImagePath=system32\DRIVERS\atapi.sys - this reference has been left in place ---------- Key=Atmarpc ImagePath=system32\DRIVERS\atmarpc.sys - this reference has been left in place ---------- Key=audstub ImagePath=system32\DRIVERS\audstub.sys - this reference has been left in place ---------- Key=AVG Anti-Spyware Driver ImagePath=\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys - this reference has been left in place ---------- Key=AVG Anti-Spyware Guard ImagePath=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe - this reference has been left in place ---------- Key=AvgAsCln ImagePath=System32\DRIVERS\AvgAsCln.sys - this reference has been left in place ---------- Key=AVPCC ImagePath="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service - this reference has been left in place ---------- Key=avpg ImagePath=\??\C:\PROGRA~1\COMMON~1\KAVSHA~1\avpg.sys - this reference has been left in place ---------- Key=BoiHwsetup ImagePath=system32\drivers\BoiHwSetup.sys - this reference has been left in place ---------- Key=CCDECODE ImagePath=system32\DRIVERS\CCDECODE.sys - this reference has been left in place ---------- Key=Cdrom ImagePath=system32\DRIVERS\cdrom.sys - this reference has been left in place ---------- Key=CFSvcs ImagePath=C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe - this reference has been left in place ---------- Key=CiSvc ImagePath=%SystemRoot%\system32\cisvc.exe - this reference has been left in place ---------- Key=ClipSrv ImagePath=%SystemRoot%\system32\clipsrv.exe - this reference has been left in place ---------- Key=CmBatt ImagePath=system32\DRIVERS\CmBatt.sys - this reference has been left in place ---------- Key=Compbatt ImagePath=system32\DRIVERS\compbatt.sys - this reference has been left in place ---------- Key=COMSysApp ImagePath=C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} - this reference has been left in place ---------- Key=Disk ImagePath=system32\DRIVERS\disk.sys - this reference has been left in place ---------- Key=DLABOIOM ImagePath=System32\DLA\DLABOIOM.SYS - this reference has been left in place ---------- Key=DLACDBHM ImagePath=System32\Drivers\DLACDBHM.SYS - this reference has been left in place ---------- Key=DLADResN ImagePath=System32\DLA\DLADResN.SYS - this reference has been left in place ---------- Key=DLAIFS_M ImagePath=System32\DLA\DLAIFS_M.SYS - this reference has been left in place ---------- Key=DLAOPIOM ImagePath=System32\DLA\DLAOPIOM.SYS - this reference has been left in place ---------- Key=DLAPoolM ImagePath=System32\DLA\DLAPoolM.SYS - this reference has been left in place ---------- Key=DLARTL_N ImagePath=System32\Drivers\DLARTL_N.SYS - this reference has been left in place ---------- Key=DLAUDFAM ImagePath=System32\DLA\DLAUDFAM.SYS - this reference has been left in place ---------- Key=DLAUDF_M ImagePath=System32\DLA\DLAUDF_M.SYS - this reference has been left in place ---------- Key=dmadmin ImagePath=%SystemRoot%\System32\dmadmin.exe /com - this reference has been left in place ---------- Key=dmboot ImagePath=System32\drivers\dmboot.sys - this reference has been left in place ---------- Key=dmio ImagePath=System32\drivers\dmio.sys - this reference has been left in place ---------- Key=dmload ImagePath=System32\drivers\dmload.sys - this reference has been left in place ---------- Key=DMusic ImagePath=system32\drivers\DMusic.sys - this reference has been left in place ---------- Key=drmkaud ImagePath=system32\drivers\drmkaud.sys - this reference has been left in place ---------- Key=DRVMCDB ImagePath=System32\Drivers\DRVMCDB.SYS - this reference has been left in place ---------- Key=DRVNDDM ImagePath=System32\Drivers\DRVNDDM.SYS - this reference has been left in place ---------- Key=DVD-RAM_Service ImagePath=C:\WINDOWS\system32\DVDRAMSV.exe - this reference has been left in place ---------- Key=Eventlog ImagePath=%SystemRoot%\system32\services.exe - this reference has been left in place ---------- Key=EvtEng ImagePath=C:\Program Files\Intel\Wireless\Bin\EvtEng.exe - this reference has been left in place ---------- Key=EXAMPLE ImagePath=\??\C:\WINDOWS\system32\main.sys - this reference has been left in place [file not found to scan] ---------- Key=FltMgr ImagePath=system32\DRIVERS\fltMgr.sys - this reference has been left in place ---------- Key=Ftdisk ImagePath=system32\DRIVERS\ftdisk.sys - this reference has been left in place ---------- Key=Gpc ImagePath=system32\DRIVERS\msgpc.sys - this reference has been left in place ---------- Key=HdAudAddService ImagePath=system32\drivers\CHDAud.sys - this reference has been left in place ---------- Key=HDAudBus ImagePath=system32\DRIVERS\HDAudBus.sys - this reference has been left in place ---------- Key=hflt_ipf ImagePath=\??\C:\WINDOWS\system32\Drivers\hflt_ipf.sys - this reference has been left in place [file not found to scan] ---------- Key=HidUsb ImagePath=system32\DRIVERS\hidusb.sys - this reference has been left in place ---------- Key=HSFHWAZL ImagePath=system32\DRIVERS\HSFHWAZL.sys - this reference has been left in place ---------- Key=HSF_DPV ImagePath=system32\DRIVERS\HSF_DPV.sys - this reference has been left in place ---------- Key=HTTP ImagePath=System32\Drivers\HTTP.sys - this reference has been left in place ---------- Key=i8042prt ImagePath=system32\DRIVERS\i8042prt.sys - this reference has been left in place ---------- Key=ialm ImagePath=system32\DRIVERS\ialmnt5.sys - this reference has been left in place ---------- Key=IDriverT ImagePath="C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" - this reference has been left in place ---------- Key=Imapi ImagePath=system32\DRIVERS\imapi.sys - this reference has been left in place ---------- Key=ImapiService ImagePath=C:\WINDOWS\system32\imapi.exe - this reference has been left in place ---------- Key=intelppm ImagePath=system32\DRIVERS\intelppm.sys - this reference has been left in place ---------- Key=IpFilterDriver ImagePath=system32\DRIVERS\ipfltdrv.sys - this reference has been left in place ---------- Key=IpInIp ImagePath=system32\DRIVERS\ipinip.sys - this reference has been left in place ---------- Key=IpNat ImagePath=system32\DRIVERS\ipnat.sys - this reference has been left in place ---------- Key=IPSec ImagePath=system32\DRIVERS\ipsec.sys - this reference has been left in place ---------- Key=IRENUM ImagePath=system32\DRIVERS\irenum.sys - this reference has been left in place ---------- Key=isapnp ImagePath=system32\DRIVERS\isapnp.sys - this reference has been left in place ---------- Key=Iviaspi ImagePath=system32\drivers\iviaspi.sys - this reference has been left in place ---------- Key=KAVMonitorService ImagePath="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service - this reference has been left in place ---------- Key=Kbdclass ImagePath=system32\DRIVERS\kbdclass.sys - this reference has been left in place ---------- Key=kbdhid ImagePath=system32\DRIVERS\kbdhid.sys - this reference has been left in place ---------- Key=kmixer ImagePath=system32\drivers\kmixer.sys - this reference has been left in place ---------- Key=mdmxsdk ImagePath=system32\DRIVERS\mdmxsdk.sys - this reference has been left in place ---------- Key=meiudf ImagePath=System32\Drivers\meiudf.sys - this reference has been left in place ---------- Key=mnmsrvc ImagePath=C:\WINDOWS\system32\mnmsrvc.exe - this reference has been left in place ---------- Key=Mouclass ImagePath=system32\DRIVERS\mouclass.sys - this reference has been left in place ---------- Key=mouhid ImagePath=system32\DRIVERS\mouhid.sys - this reference has been left in place ---------- Key=MRxDAV ImagePath=system32\DRIVERS\mrxdav.sys - this reference has been left in place ---------- Key=MRxSmb ImagePath=system32\DRIVERS\mrxsmb.sys - this reference has been left in place ---------- Key=MSDTC ImagePath=C:\WINDOWS\system32\msdt

Profil

bobby Poslao: 01 Maj 2007 13:03 Idi na vrh
offline bobby Administrator Pridružio: 04 Sep 2003 Poruke: 24135 Gde živiš: Wien	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Vidim u cemu je problem. Prvo da te obavestim da ovo sto cemo pokusati moze biti rizicno po integritet tvog Windowsa, tako da je najbolje da sve sto imas relevantno, tj. vazno na kompu prvo snimis na sigurno mesto (CD, DVD). Infekcija koju imas na kompu se ne moze otkloniti antivirusima, jer su zarazeni sistemski fajlovi samog Windowsa. Za resavanje ove infekcije ce ti biti potreban instalacioni CD Windowsa, tako da vidi da ti bude pri ruci kada budes sledila moja dalja uputstva. Otvori konzolu na sledeci nacin: Start> Run> upisi CMD u polje koje se pojavilo> stisni Enter. U konzoli upisi sledece: sc stop EXAMPLE pa stisni Enter sc delete EXAMPLE pa stisni Enter sc stop Runtime pa stisni Enter sc delete Runtime pa stisni Enter sc stop hflt_ipf pa stisni Enter sc delete hflt_ipf pa stisni Enter sc stop UIUSys pa stisni Enter sc delete UIUSys pa stisni Enter sfc /Scanonce pa stisni Enter Sada restartuj komp. Tokom ponovnog startovanja izvrsice se skeniranje autenticnosti Windowsovih fajlova, i bice od tebe zatrazeno da ubacis Windows instalacioni CD u drajv ukoliko se za neki fajl utvrdi da nije originalan. Sada ce biti zamenjen originalnim. Kada se skeniranje zavrsi, restartuj ponovo komp. Kada se Windows startuje, sa diska obrisi sledece fajlove: C:\Windows\System32\main.sys C:\Windows\System32\drivers\runtime.sys C:\Windows\System32\drivers\ip6fw.sys (prvo proveri tvojim antivirusom da li je ovo virus, moze biti i da je originalan Windowsov fajl) C:\Windows\System32\wsys.dll Sada preskeniraj ceo komp tvojim antivirus programom. Ukoliko nakon ciscenja ne mozes vise da se prikljucis na internet, otvori ponovo konzolu pa ukucaj: sfc /scannow Ponovo ce biti proskeniran komp da se utvrdi da li su originalni Windowsovi fajlovi zamenjeni nekim drugim fajlovima. Ukoliko neki jeste, onda ce biti iskopiran originalan fajl sa instalacionog CD-a. Nakon svega toga, postavi mi sveze logove napravljene uz pomoc Trojan Removera i GMER-a

Profil

biljkaljubicica Poslao: 20 Maj 2007 10:45 Idi na vrh
offline biljkaljubicica Novi MyCity građanin Pridružio: 28 Apr 2007 Poruke: 5	0Niko još nije pohvalio poruku. Registruj se da bi pohvalio/la poruku! Kada sam stavila CD automatski je reinstaliran ceo windows i sada sve radi super. Hvala.

Profil

MyCity » Ambulanta -> Arhiva Ambulante » Pomoc...

Ko je trenutno na forumu

Ukupno su 1170 korisnika na forumu :: 38 registrovanih, 7 sakrivenih i 1125 gosta :: [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:: Korisnici trenutno na forumu: Apok, Bobrock1, Brana01, Denaya, Dimitrise93, FOX, Gargantua, hatman, hologram, HrcAk47, ikan, Istman, Karla, kunktator, laki_bb, lord sir giga, Mcdado, mercedesamg, Mercury, Milos ZA, milutin134, Mixelotti, mrav pesadinac, nemkea71, panzerwaffe, pein, S2M, Srle993, stegonosa, tomigun, vathra, VP6919, vukovi, YugoSlav, zbazin, zeo, žeks62, 1107

Svaki korisnik ovog sajta je odgovoran za sadržaj svoje poruke koju objavi na sajtu. Sajt se odriče svake odgovornosti za sadržaj tih poruka.
Postavljanjem vaše poruke ili vašeg autorskog dela na ovaj sajt, saglasni ste da ovaj sajt postaje distributer vašeg dela, i odričete se mogućnosti njegovog povlačenja ili brisanja, bez saglasnosti uprave sajta.
Distribucija sadržaja sa ovog sajta je dozvoljena samo u nekomercijalne svrhe, uz obaveznu napomenu da je sadržaj preuzet sa ovog sajta, i uz obavezno navođenje adrese MyCity sajta. Za sve ostale vidove distribucije obavezni ste da prethodno zatražite odobrenje od vlasnika MyCity sajta.
MyCity pokrenuo, administrira i razvija Predrag Damnjanović, a o uređenju sajta se brine MyCity Tim.
Ukoliko želite da nas kontaktirate kliknite ovde.
Naši sajtovi:
Vesti, Vojni forum, Zaštita od virusa, TekstPesme.rs

This content is licensed under a Creative Commons License.
Based on phpBB 2, translated by Simke, designed by