MyCity » Ambulanta -> Arhiva Ambulante » Racunar steka

Racunar steka

Napisano na dan: 11.10.2012
1

Racunar steka
Sledeća strana Pagination

Idi na vrh

Poslao: 11 Okt 2012 18:26
Idi na vrh
offline
  • Pridružio: 19 Jul 2011
  • Poruke: 445
  • Gde živiš: Krusevac

Racunar pocinje da steka posle odredjenog vremena(Ukljucim ga, 20min-1h radi ok, posle pocinje da secka i da zeza), nekad mu treba i po 10 sec. Da otvori folder ili stranicu na internetu. Steka mi i prilikom gledanja online filmova. Sve lepo ocita, msm da nije do neta, samo odjednom slika ukoci i posle 5-6 sec krene opet.


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1
Run by Dimitrije at 18:00:04 on 2012-10-11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.133 [GMT 2:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\RunDLL32.exe
svchost.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Documents and Settings\Dimitrije\0i763f66bz.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
\\.\globalroot\systemroot\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Documents and Settings\Dimitrije\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uInternet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
mSearchAssistant = [Link mogu videti samo ulogovani korisnici]{searchTerms}&f=4
uURLSearchHooks: Softonic English Toolbar: {930f1200-f5f1-4870-bac6-e233ec8e7023} - c:\program files\softonic_english\tbSoft.dll
uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll
uWindows: load= c:\bc5\pipeline\remind.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - c:\program files\babylontoolbar\babylontoolbar\1.5.3.17\bh\BabylonToolbar.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll
BHO: Softonic English Toolbar: {930f1200-f5f1-4870-bac6-e233ec8e7023} - c:\program files\softonic_english\tbSoft.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Help the General-Search Project: {ca4520f3-ae13-4fb1-a513-58e23991c86d} - c:\docume~1\dimitr~1\applic~1\mediaf~1\extens~1\GENCRA~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
BHO: SweetPacks Browser Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
TB: Softonic English Toolbar: {930f1200-f5f1-4870-bac6-e233ec8e7023} - c:\program files\softonic_english\tbSoft.dll
TB: SweetPacks Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - c:\program files\babylontoolbar\babylontoolbar\1.5.3.17\BabylonToolbarTlbr.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [Google Update] "c:\documents and settings\dimitrije\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe" -automount
uRun: [0i763f66bz] c:\documents and settings\dimitrije\0i763f66bz.exe
uRun: [Facebook Update] "c:\documents and settings\dimitrije\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
mRun: [WheelMouse] c:\program files\a4tech\mouse\Amoumain.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [SweetIM] c:\program files\sweetim\messenger\SweetIM.exe
mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Regedit32] c:\windows\system32\regedit.exe
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
StartupFolder: c:\docume~1\dimitr~1\startm~1\programs\startup\gamera~1.lnk - c:\documents and settings\dimitrije\application data\gameranger\gameranger\GameRanger.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe
IE: Download with &Media Finder - c:\program files\media finder\hook.html
IE: Search the Web - c:\program files\sweetim\toolbars\internet explorer\resources\menuext.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FE409F54-495D-4C46-BD25-CF65DAAFC11D} : DhcpNameServer = 192.168.1.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\MailUtil.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampPlayer.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko10.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko5.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko6.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko7.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko8.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\components\RadioWMPCoreGecko9.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko10.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko19.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko5.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko6.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko7.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko8.dll
FF - component: c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}\components\RadioWMPCoreGecko9.dll
FF - component: c:\program files\mozilla firefox\extensions\{82af8dca-6de9-405d-bd5e-43525bdad38a}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\dimitrije\local settings\application data\facebook\video\skype\npFacebookVideoCalling.dll
FF - plugin: c:\documents and settings\dimitrije\local settings\application data\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_287.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - tt=010312_ctrl
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 10042270000000000000001a92da0294
FF - user.js: extensions.BabylonToolbar_i.hardId - 10042270000000000000001a92da0294
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15487
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1711:25:05
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2012-2-5 2253120]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2009-12-23 370688]
R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2012-1-18 450848]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe [2012-1-5 75624]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-6 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-2 250808]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-5-4 114144]
.
=============== Created Last 30 ================
.
2012-09-28 18:20:08 -------- d-----w- c:\documents and settings\dimitrije\local settings\application data\Ahead
2012-09-28 18:15:58 -------- d-----w- c:\program files\Nero
2012-09-23 16:12:06 5632 ----a-w- c:\windows\system32\ptpusb.dll
2012-09-23 16:12:05 159232 ----a-w- c:\windows\system32\ptpusd.dll
2012-09-23 16:12:04 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2012-09-23 16:12:04 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
.
==================== Find3M ====================
.
2012-10-09 04:37:08 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-09 04:37:08 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-22 23:07:23 74752 ----a-w- c:\windows\ST6UNST.EXE
2012-08-22 23:07:23 253952 ------w- c:\windows\Setup1.exe
2012-07-26 02:40:28 286052 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-07-26 02:40:28 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-07-26 02:40:27 286052 ----a-w- c:\windows\system32\nvdrsdb0.bin
.
============= FINISH: 18:00:16.56 ===============


[Link mogu videti samo ulogovani korisnici]




[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]



Poslao: 11 Okt 2012 20:38
Idi na vrh
offline
  • Pridružio: 04 Jul 2011
  • Poruke: 5424

Pozdrav, DimA1994.


U toku resavanja slucaja, zamolio bih te da se pridrzavas sledeceg:
Detaljno citati moja uputstva ( ili uputstva kolega koji ce me zamenjivati) i raditi iskljucivo po njima;
Ne traziti istovremeno pomoc na drugom mestu;
Nemoj koristiti druge programe za uklanjanje malware-a, osim onih za koje budes dobio uputstvo;
U toku intervencije ne koristiti USB memorijske uredjaje, dok to ne budem zatrazio;
Ukoliko ne odgovorim u roku od 48h, osvezi temu novim post-om;
Ukoliko se ne javis u roku od 5 dana, zatvoricemo slucaj.
Za vise informacija o pravilima Ambulante MyCity foruma: LINK

-------------------------------------------------------------------------------------



Arrow Korak 1

Idi u Start - Control Panel - Add or Remove Programs i deinstaliraj sedeće:
Babylon toolbar on IE
BabylonObjectInstaller
Softonic_English Toolbar
SweetPacks Toolbar for Internet Explorer 4.4




Arrow Korak 2

Preuzmi Kaspersky Lab-ov TDSSKiller sa sledece adrese na Desktop:


TDSSKiller

Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili slicnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sacuvati file, odaberi Desktop i klikni Save.


Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
preimenuj TDSSKiller.exe u MyCity.exe;
dvoklikom pokreni program MyCity.exe;
klik na dugme Start Scan.

Ukoliko maliciozni (malicious) objekti budu pronadjeni, uveri se da je za njih odabrana akcija "Cure" (primer) i klikni Continue, a zatim klikni Reboot Now.



Okaci mi sadrzaj log-a sa sledece lokacije:
C:\TDSSKiller_verzija programa_DD.MM.GG_HH.MM.SS.txt
(DD-dan, MM-mesec, GG-godina, HH-sat, MM-minut, SS-sekunda; datum i vreme kada je log napravljen)




Arrow Korak 3


Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.




Ivance95 (AMF Tim)



Poslao: 11 Okt 2012 22:36
Idi na vrh
offline
  • Pridružio: 19 Jul 2011
  • Poruke: 445
  • Gde živiš: Krusevac

21:27:13.0690 2592 TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
21:27:13.0877 2592 ============================================================
21:27:13.0877 2592 Current date / time: 2012/10/11 21:27:13.0877
21:27:13.0877 2592 SystemInfo:
21:27:13.0877 2592
21:27:13.0877 2592 OS Version: 5.1.2600 ServicePack: 3.0
21:27:13.0877 2592 Product type: Workstation
21:27:13.0877 2592 ComputerName: DIMA-827C94CE11
21:27:13.0877 2592 UserName: Dimitrije
21:27:13.0877 2592 Windows directory: C:\WINDOWS
21:27:13.0877 2592 System windows directory: C:\WINDOWS
21:27:13.0877 2592 Processor architecture: Intel x86
21:27:13.0877 2592 Number of processors: 1
21:27:13.0877 2592 Page size: 0x1000
21:27:13.0877 2592 Boot type: Normal boot
21:27:13.0877 2592 ============================================================
21:27:23.0049 2592 !crdlk
21:27:23.0127 2592 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'A'
21:27:23.0174 2592 ============================================================
21:27:23.0174 2592 \Device\Harddisk0\DR0:
21:27:23.0174 2592 MBR partitions:
21:27:23.0174 2592 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xEA60903
21:27:23.0205 2592 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xEA60981, BlocksNum 0x169C8E7F
21:27:23.0205 2592 ============================================================
21:27:23.0283 2592 D: <-> \Device\Harddisk0\DR0\Partition2
21:27:23.0299 2592 C: <-> \Device\Harddisk0\DR0\Partition1
21:27:23.0330 2592 ============================================================
21:27:23.0330 2592 Initialize success
21:27:23.0330 2592 ============================================================
21:27:27.0845 4064 ============================================================
21:27:27.0845 4064 Scan started
21:27:27.0845 4064 Mode: Manual;
21:27:27.0845 4064 ============================================================
21:27:28.0564 4064 ================ Scan system memory ========================
21:27:28.0564 4064 System memory - ok
21:27:28.0580 4064 ================ Scan services =============================
21:27:28.0642 4064 Suspicious service (NoAccess): 658dfed3bfeed537
21:27:28.0892 4064 [ A60B48A393A856D115739578076ED878 ] 658dfed3bfeed537 C:\WINDOWS\System32\Drivers\658dfed3bfeed537.sys
21:27:28.0892 4064 Suspicious file (NoAccess): C:\WINDOWS\System32\Drivers\658dfed3bfeed537.sys. md5: A60B48A393A856D115739578076ED878
21:27:31.0267 4064 658dfed3bfeed537 ( Rootkit.Win32.Necurs.gen ) - infected
21:27:31.0267 4064 658dfed3bfeed537 - detected Rootkit.Win32.Necurs.gen (0)
21:27:31.0517 4064 Abiosdsk - ok
21:27:31.0611 4064 abp480n5 - ok
21:27:31.0752 4064 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:27:31.0783 4064 ACPI - ok
21:27:31.0892 4064 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
21:27:31.0892 4064 ACPIEC - ok
21:27:32.0033 4064 [ AE3475450BD241598AE60CAB4A40FADF ] ADIHdAudAddService C:\WINDOWS\system32\drivers\ADIHdAud.sys
21:27:32.0064 4064 ADIHdAudAddService - ok
21:27:32.0298 4064 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
21:27:32.0330 4064 AdobeFlashPlayerUpdateSvc - ok
21:27:32.0470 4064 adpu160m - ok
21:27:32.0580 4064 [ F932A37FFF15D1B35289213089E9C78D ] AEAudioService C:\WINDOWS\system32\drivers\AEAudio.sys
21:27:32.0595 4064 AEAudioService - ok
21:27:32.0689 4064 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
21:27:32.0705 4064 aec - ok
21:27:32.0845 4064 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
21:27:32.0861 4064 AFD - ok
21:27:32.0923 4064 Aha154x - ok
21:27:33.0017 4064 aic78u2 - ok
21:27:33.0111 4064 aic78xx - ok
21:27:33.0267 4064 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
21:27:33.0283 4064 Alerter - ok
21:27:33.0408 4064 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
21:27:33.0408 4064 ALG - ok
21:27:33.0470 4064 AliIde - ok
21:27:33.0533 4064 [ D716473C4F66C1173D3CA4E679F68743 ] Amfilter C:\WINDOWS\system32\DRIVERS\Amfilter.sys
21:27:33.0548 4064 Amfilter - ok
21:27:33.0580 4064 amsint - ok
21:27:33.0720 4064 [ 0E264A9ACB592F3FD91E742983DB6A96 ] Amusbprt C:\WINDOWS\system32\DRIVERS\Amusbprt.sys
21:27:33.0720 4064 Amusbprt - ok
21:27:33.0892 4064 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
21:27:34.0017 4064 AppMgmt - ok
21:27:34.0064 4064 asc - ok
21:27:34.0111 4064 asc3350p - ok
21:27:34.0158 4064 asc3550 - ok
21:27:34.0205 4064 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:27:34.0205 4064 AsyncMac - ok
21:27:34.0330 4064 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
21:27:34.0330 4064 atapi - ok
21:27:34.0376 4064 Atdisk - ok
21:27:34.0455 4064 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:27:34.0470 4064 Atmarpc - ok
21:27:34.0564 4064 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
21:27:34.0580 4064 AudioSrv - ok
21:27:34.0736 4064 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
21:27:34.0751 4064 audstub - ok
21:27:34.0923 4064 [ 7692F4B242E45870873CAF4CB85CF769 ] AxAutoMntSrv C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
21:27:35.0079 4064 AxAutoMntSrv - ok
21:27:35.0267 4064 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
21:27:35.0267 4064 Beep - ok
21:27:35.0486 4064 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
21:27:35.0517 4064 BITS - ok
21:27:35.0658 4064 [ A06CE3399D16DB864F55FAEB1F1927A9 ] Browser C:\WINDOWS\System32\browser.dll
21:27:35.0673 4064 Browser - ok
21:27:35.0783 4064 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
21:27:35.0798 4064 cbidf2k - ok
21:27:35.0939 4064 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:27:35.0970 4064 CCDECODE - ok
21:27:36.0095 4064 cd20xrnt - ok
21:27:36.0236 4064 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
21:27:36.0267 4064 Cdaudio - ok
21:27:36.0439 4064 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
21:27:36.0454 4064 Cdfs - ok
21:27:36.0689 4064 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:27:36.0704 4064 Cdrom - ok
21:27:36.0861 4064 Changer - ok
21:27:37.0079 4064 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
21:27:37.0095 4064 CiSvc - ok
21:27:37.0251 4064 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
21:27:37.0267 4064 ClipSrv - ok
21:27:37.0361 4064 CmdIde - ok
21:27:37.0454 4064 COMSysApp - ok
21:27:37.0689 4064 Cpqarray - ok
21:27:37.0939 4064 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
21:27:37.0939 4064 CryptSvc - ok
21:27:38.0111 4064 dac2w2k - ok
21:27:38.0611 4064 dac960nt - ok
21:27:38.0798 4064 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
21:27:38.0829 4064 DcomLaunch - ok
21:27:38.0939 4064 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
21:27:38.0970 4064 Dhcp - ok
21:27:39.0064 4064 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
21:27:39.0095 4064 Disk - ok
21:27:39.0126 4064 dmadmin - ok
21:27:39.0298 4064 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
21:27:39.0392 4064 dmboot - ok
21:27:39.0470 4064 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
21:27:39.0470 4064 dmio - ok
21:27:39.0611 4064 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
21:27:39.0611 4064 dmload - ok
21:27:39.0767 4064 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
21:27:39.0782 4064 dmserver - ok
21:27:39.0939 4064 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
21:27:39.0954 4064 DMusic - ok
21:27:40.0173 4064 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
21:27:40.0173 4064 Dnscache - ok
21:27:40.0267 4064 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
21:27:40.0267 4064 Dot3svc - ok
21:27:40.0329 4064 dpti2o - ok
21:27:40.0454 4064 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
21:27:40.0470 4064 drmkaud - ok
21:27:40.0548 4064 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
21:27:40.0548 4064 EapHost - ok
21:27:40.0626 4064 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
21:27:40.0626 4064 ERSvc - ok
21:27:40.0704 4064 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
21:27:40.0720 4064 Eventlog - ok
21:27:40.0985 4064 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
21:27:41.0001 4064 EventSystem - ok
21:27:41.0173 4064 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
21:27:41.0204 4064 Fastfat - ok
21:27:41.0314 4064 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
21:27:41.0345 4064 FastUserSwitchingCompatibility - ok
21:27:41.0454 4064 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
21:27:41.0470 4064 Fdc - ok
21:27:41.0564 4064 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
21:27:41.0579 4064 Fips - ok
21:27:41.0735 4064 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:27:41.0735 4064 Flpydisk - ok
21:27:41.0798 4064 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
21:27:41.0814 4064 FltMgr - ok
21:27:41.0907 4064 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:27:41.0907 4064 Fs_Rec - ok
21:27:42.0001 4064 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:27:42.0001 4064 Ftdisk - ok
21:27:42.0189 4064 [ 77EBF3E9386DAA51551AF429052D88D0 ] giveio C:\WINDOWS\system32\giveio.sys
21:27:42.0189 4064 giveio - ok
21:27:42.0267 4064 GMSIPCI - ok
21:27:42.0392 4064 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:27:42.0423 4064 Gpc - ok
21:27:42.0595 4064 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:27:42.0610 4064 HDAudBus - ok
21:27:43.0017 4064 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
21:27:43.0017 4064 helpsvc - ok
21:27:43.0110 4064 HidServ - ok
21:27:43.0188 4064 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:27:43.0204 4064 hidusb - ok
21:27:43.0454 4064 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
21:27:43.0454 4064 hkmsvc - ok
21:27:43.0610 4064 hpn - ok
21:27:43.0782 4064 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
21:27:43.0782 4064 HTTP - ok
21:27:43.0985 4064 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
21:27:44.0001 4064 HTTPFilter - ok
21:27:44.0126 4064 i2omgmt - ok
21:27:44.0267 4064 i2omp - ok
21:27:44.0454 4064 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:27:44.0454 4064 i8042prt - ok
21:27:44.0610 4064 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
21:27:44.0610 4064 Imapi - ok
21:27:44.0735 4064 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
21:27:44.0751 4064 ImapiService - ok
21:27:44.0970 4064 ini910u - ok
21:27:45.0251 4064 IntelIde - ok
21:27:45.0423 4064 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:27:45.0438 4064 intelppm - ok
21:27:45.0704 4064 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
21:27:45.0704 4064 Ip6Fw - ok
21:27:45.0845 4064 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:27:45.0845 4064 IpFilterDriver - ok
21:27:45.0970 4064 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:27:45.0970 4064 IpInIp - ok
21:27:46.0220 4064 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:27:46.0235 4064 IpNat - ok
21:27:46.0391 4064 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:27:46.0407 4064 IPSec - ok
21:27:46.0626 4064 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
21:27:46.0641 4064 IRENUM - ok
21:27:46.0985 4064 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:27:47.0001 4064 isapnp - ok
21:27:47.0282 4064 [ C2C1660DDCC9BD67EB98D6D5F91C107F ] JavaQuickStarterService C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
21:27:47.0313 4064 JavaQuickStarterService - ok
21:27:47.0501 4064 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:27:47.0501 4064 Kbdclass - ok
21:27:47.0641 4064 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
21:27:47.0641 4064 kmixer - ok
21:27:47.0782 4064 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
21:27:47.0813 4064 KSecDD - ok
21:27:48.0032 4064 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
21:27:48.0048 4064 LanmanServer - ok
21:27:48.0282 4064 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
21:27:48.0298 4064 lanmanworkstation - ok
21:27:48.0376 4064 lbrtfdc - ok
21:27:48.0657 4064 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
21:27:48.0673 4064 LmHosts - ok
21:27:48.0923 4064 [ 5BC80451109A8DD7F2DDD35BCE2929A3 ] LVUVC C:\WINDOWS\system32\DRIVERS\lvuvc.sys
21:27:50.0219 4064 LVUVC - ok
21:27:50.0672 4064 [ 22A7776C5D8EB5930EDF9C8DD0884259 ] McComponentHostService C:\Program Files\McAfee Security Scan\3.0.207\McCHSvc.exe
21:27:50.0672 4064 McComponentHostService - ok
21:27:51.0266 4064 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
21:27:51.0282 4064 Messenger - ok
21:27:51.0813 4064 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
21:27:51.0844 4064 mnmdd - ok
21:27:53.0422 4064 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
21:27:53.0485 4064 mnmsrvc - ok
21:27:54.0782 4064 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
21:27:54.0797 4064 Modem - ok
21:27:56.0032 4064 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:27:56.0047 4064 Mouclass - ok
21:27:58.0250 4064 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:27:58.0297 4064 mouhid - ok
21:27:59.0094 4064 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
21:27:59.0110 4064 MountMgr - ok
21:27:59.0531 4064 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
21:27:59.0578 4064 MozillaMaintenance - ok
21:28:00.0078 4064 mraid35x - ok
21:28:00.0250 4064 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:28:00.0266 4064 MRxDAV - ok
21:28:00.0469 4064 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:28:00.0516 4064 MRxSmb - ok
21:28:00.0672 4064 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
21:28:00.0672 4064 MSDTC - ok
21:28:00.0922 4064 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
21:28:00.0938 4064 Msfs - ok
21:28:01.0109 4064 MSIServer - ok
21:28:01.0344 4064 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:28:01.0359 4064 MSKSSRV - ok
21:28:01.0750 4064 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:28:01.0766 4064 MSPCLOCK - ok
21:28:02.0078 4064 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
21:28:02.0078 4064 MSPQM - ok
21:28:02.0328 4064 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:28:02.0328 4064 mssmbios - ok
21:28:02.0625 4064 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
21:28:02.0641 4064 MSTEE - ok
21:28:03.0000 4064 [ D48659BB24C48345D926ECB45C1EBDF5 ] MTsensor C:\WINDOWS\system32\DRIVERS\ASACPI.sys
21:28:03.0016 4064 MTsensor - ok
21:28:03.0734 4064 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
21:28:03.0766 4064 Mup - ok
21:28:04.0453 4064 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:28:04.0531 4064 NABTSFEC - ok
21:28:05.0109 4064 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
21:28:05.0156 4064 napagent - ok
21:28:05.0984 4064 [ 7DB7924793B9BD0EC991AD321664C486 ] NBService C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
21:28:06.0000 4064 NBService - ok
21:28:06.0062 4064 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
21:28:06.0062 4064 NDIS - ok
21:28:06.0140 4064 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:28:06.0156 4064 NdisIP - ok
21:28:06.0328 4064 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:28:06.0328 4064 NdisTapi - ok
21:28:06.0390 4064 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:28:06.0390 4064 Ndisuio - ok
21:28:06.0422 4064 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:28:06.0437 4064 NdisWan - ok
21:28:06.0484 4064 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
21:28:06.0484 4064 NDProxy - ok
21:28:06.0531 4064 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
21:28:06.0531 4064 NetBIOS - ok
21:28:06.0578 4064 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
21:28:06.0578 4064 NetBT - ok
21:28:06.0625 4064 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
21:28:06.0625 4064 NetDDE - ok
21:28:06.0656 4064 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
21:28:06.0656 4064 NetDDEdsdm - ok
21:28:06.0687 4064 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
21:28:06.0687 4064 Netlogon - ok
21:28:06.0750 4064 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
21:28:06.0750 4064 Netman - ok
21:28:06.0797 4064 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
21:28:07.0062 4064 Nla - ok
21:28:07.0078 4064 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
21:28:07.0078 4064 Npfs - ok
21:28:07.0109 4064 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
21:28:07.0125 4064 Ntfs - ok
21:28:07.0140 4064 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
21:28:07.0140 4064 NtLmSsp - ok
21:28:07.0187 4064 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
21:28:07.0203 4064 NtmsSvc - ok
21:28:07.0234 4064 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
21:28:07.0234 4064 Null - ok
21:28:07.0562 4064 [ 4B54DCD6ADEE535DF80F07C59DDD8F14 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
21:28:09.0562 4064 nv - ok
21:28:09.0656 4064 [ 0573C75A2895D973EA6EF2495620BA49 ] NVSvc C:\WINDOWS\system32\nvsvc32.exe
21:28:09.0656 4064 NVSvc - ok
21:28:09.0750 4064 [ 9C84945FEEE40EA42D3BCA5C22250D47 ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
21:28:09.0796 4064 nvUpdatusService - ok
21:28:09.0843 4064 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:28:09.0843 4064 NwlnkFlt - ok
21:28:09.0859 4064 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:28:09.0859 4064 NwlnkFwd - ok
21:28:09.0875 4064 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
21:28:09.0875 4064 Parport - ok
21:28:09.0906 4064 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
21:28:09.0906 4064 PartMgr - ok
21:28:09.0968 4064 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
21:28:09.0984 4064 ParVdm - ok
21:28:10.0031 4064 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
21:28:10.0031 4064 PCI - ok
21:28:10.0046 4064 PCIDump - ok
21:28:10.0078 4064 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
21:28:10.0078 4064 PCIIde - ok
21:28:10.0109 4064 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
21:28:10.0109 4064 Pcmcia - ok
21:28:10.0140 4064 PDCOMP - ok
21:28:10.0171 4064 PDFRAME - ok
21:28:10.0296 4064 PDRELI - ok
21:28:10.0390 4064 PDRFRAME - ok
21:28:10.0500 4064 perc2 - ok
21:28:10.0640 4064 perc2hib - ok
21:28:11.0234 4064 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
21:28:11.0234 4064 PlugPlay - ok
21:28:11.0343 4064 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
21:28:11.0343 4064 PolicyAgent - ok
21:28:11.0484 4064 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:28:11.0500 4064 PptpMiniport - ok
21:28:11.0656 4064 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
21:28:11.0671 4064 ProtectedStorage - ok
21:28:12.0171 4064 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
21:28:12.0187 4064 PSched - ok
21:28:12.0234 4064 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:28:12.0234 4064 Ptilink - ok
21:28:12.0406 4064 [ 153D02480A0A2F45785522E814C634B6 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
21:28:12.0406 4064 PxHelp20 - ok
21:28:12.0515 4064 ql1080 - ok
21:28:12.0609 4064 Ql10wnt - ok
21:28:12.0718 4064 ql12160 - ok
21:28:12.0874 4064 ql1240 - ok
21:28:12.0937 4064 ql1280 - ok
21:28:12.0984 4064 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:28:12.0984 4064 RasAcd - ok
21:28:13.0078 4064 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
21:28:13.0078 4064 RasAuto - ok
21:28:13.0218 4064 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:28:13.0218 4064 Rasl2tp - ok
21:28:13.0390 4064 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
21:28:13.0390 4064 RasMan - ok
21:28:13.0499 4064 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:28:13.0499 4064 RasPppoe - ok
21:28:13.0640 4064 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
21:28:13.0656 4064 Raspti - ok
21:28:13.0703 4064 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:28:13.0703 4064 Rdbss - ok
21:28:13.0765 4064 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:28:13.0765 4064 RDPCDD - ok
21:28:13.0828 4064 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:28:13.0828 4064 rdpdr - ok
21:28:13.0874 4064 [ 6589DB6E5969F8EEE594CF71171C5028 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
21:28:13.0874 4064 RDPWD - ok
21:28:13.0937 4064 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
21:28:13.0937 4064 RDSessMgr - ok
21:28:13.0984 4064 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
21:28:13.0984 4064 redbook - ok
21:28:14.0031 4064 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
21:28:14.0031 4064 RemoteAccess - ok
21:28:14.0062 4064 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
21:28:14.0077 4064 RemoteRegistry - ok
21:28:14.0171 4064 [ 60AC082B41E60906171335DFBF8C19C0 ] rootrepeal C:\WINDOWS\system32\drivers\rootrepeal.sys
21:28:14.0171 4064 rootrepeal - ok
21:28:14.0218 4064 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
21:28:14.0218 4064 RpcLocator - ok
21:28:14.0281 4064 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll
21:28:14.0296 4064 RpcSs - ok
21:28:14.0359 4064 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
21:28:14.0359 4064 RSVP - ok
21:28:14.0421 4064 [ 25BE98C05808C57E4D8D26477DC12D39 ] RTLE8023xp C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
21:28:14.0421 4064 RTLE8023xp - ok
21:28:14.0452 4064 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
21:28:14.0452 4064 SamSs - ok
21:28:14.0499 4064 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
21:28:14.0515 4064 SCardSvr - ok
21:28:14.0562 4064 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
21:28:14.0562 4064 Schedule - ok
21:28:14.0593 4064 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:28:14.0593 4064 Secdrv - ok
21:28:14.0624 4064 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
21:28:14.0624 4064 seclogon - ok
21:28:14.0656 4064 [ 23228966244CDD9627BDE4141B3BE1F0 ] SenFiltService C:\WINDOWS\system32\drivers\Senfilt.sys
21:28:14.0671 4064 SenFiltService - ok
21:28:14.0687 4064 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
21:28:14.0687 4064 SENS - ok
21:28:14.0702 4064 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
21:28:14.0702 4064 serenum - ok
21:28:14.0718 4064 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
21:28:14.0734 4064 Serial - ok
21:28:14.0749 4064 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
21:28:14.0749 4064 Sfloppy - ok
21:28:14.0781 4064 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
21:28:14.0796 4064 ShellHWDetection - ok
21:28:14.0812 4064 Simbad - ok
21:28:14.0859 4064 [ C70AEBD3608ED9FCEA2A1BAE83567FFC ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
21:28:14.0859 4064 SkypeUpdate - ok
21:28:14.0890 4064 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:28:14.0890 4064 SLIP - ok
21:28:14.0906 4064 Sparrow - ok
21:28:14.0937 4064 [ 3FA2E254BFBCE52B3C6F1BF23AAB6911 ] speedfan C:\WINDOWS\system32\speedfan.sys
21:28:14.0952 4064 speedfan - ok
21:28:14.0968 4064 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
21:28:14.0968 4064 splitter - ok
21:28:14.0999 4064 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
21:28:15.0015 4064 Spooler - ok
21:28:15.0062 4064 [ 0022CFFF1A41E5CE3A764050A7DDF22A ] sptd C:\WINDOWS\System32\Drivers\sptd.sys
21:28:15.0077 4064 sptd - ok
21:28:15.0109 4064 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
21:28:15.0109 4064 sr - ok
21:28:15.0140 4064 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
21:28:15.0140 4064 srservice - ok
21:28:15.0187 4064 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
21:28:15.0202 4064 Srv - ok
21:28:15.0265 4064 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
21:28:15.0265 4064 SSDPSRV - ok
21:28:15.0327 4064 [ E5C796B621F6FBA8616511063D7F0FFE ] StarWindServiceAE C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
21:28:15.0327 4064 StarWindServiceAE - ok
21:28:15.0484 4064 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
21:28:15.0484 4064 stisvc - ok
21:28:15.0515 4064 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:28:15.0515 4064 streamip - ok
21:28:15.0546 4064 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
21:28:15.0546 4064 swenum - ok
21:28:15.0562 4064 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
21:28:15.0577 4064 swmidi - ok
21:28:15.0593 4064 SwPrv - ok
21:28:15.0609 4064 symc810 - ok
21:28:15.0609 4064 symc8xx - ok
21:28:15.0624 4064 sym_hi - ok
21:28:15.0687 4064 sym_u3 - ok
21:28:15.0718 4064 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
21:28:15.0718 4064 sysaudio - ok
21:28:15.0749 4064 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
21:28:15.0765 4064 SysmonLog - ok
21:28:15.0796 4064 [ 0C3B2A9C4BD2DD9A6C2E4084314DD719 ] taphss C:\WINDOWS\system32\DRIVERS\taphss.sys
21:28:15.0796 4064 taphss - ok
21:28:15.0827 4064 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
21:28:15.0843 4064 TapiSrv - ok
21:28:15.0890 4064 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:28:15.0890 4064 Tcpip - ok
21:28:15.0921 4064 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
21:28:15.0937 4064 TDPIPE - ok
21:28:15.0952 4064 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
21:28:15.0952 4064 TDTCP - ok
21:28:15.0984 4064 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
21:28:15.0984 4064 TermDD - ok
21:28:16.0031 4064 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
21:28:16.0046 4064 TermService - ok
21:28:16.0077 4064 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
21:28:16.0077 4064 Themes - ok
21:28:16.0109 4064 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
21:28:16.0109 4064 TlntSvr - ok
21:28:16.0124 4064 TosIde - ok
21:28:16.0187 4064 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
21:28:16.0187 4064 TrkWks - ok
21:28:16.0234 4064 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
21:28:16.0234 4064 Udfs - ok
21:28:16.0265 4064 ultra - ok
21:28:16.0327 4064 [ 67A95B9D129ED5399E7965CD09CF30E7 ] UMVPFSrv C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
21:28:16.0327 4064 UMVPFSrv - ok
21:28:16.0406 4064 [ AB0A7CA90D9E3D6A193905DC1715DED0 ] UMWdf C:\WINDOWS\system32\wdfmgr.exe
21:28:16.0406 4064 UMWdf - ok
21:28:16.0452 4064 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
21:28:16.0468 4064 Update - ok
21:28:16.0515 4064 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
21:28:16.0515 4064 upnphost - ok
21:28:16.0530 4064 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
21:28:16.0546 4064 UPS - ok
21:28:16.0593 4064 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:28:16.0593 4064 usbccgp - ok
21:28:16.0624 4064 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:28:16.0640 4064 usbehci - ok
21:28:16.0655 4064 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:28:16.0655 4064 usbhub - ok
21:28:16.0749 4064 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:28:16.0749 4064 usbscan - ok
21:28:16.0796 4064 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:28:16.0796 4064 USBSTOR - ok
21:28:16.0827 4064 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:28:16.0827 4064 usbuhci - ok
21:28:16.0859 4064 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
21:28:16.0859 4064 usbvideo - ok
21:28:16.0874 4064 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
21:28:16.0874 4064 VgaSave - ok
21:28:16.0890 4064 ViaIde - ok
21:28:16.0937 4064 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
21:28:16.0937 4064 VolSnap - ok
21:28:16.0968 4064 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
21:28:16.0984 4064 VSS - ok
21:28:17.0015 4064 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
21:28:17.0030 4064 W32Time - ok
21:28:17.0062 4064 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:28:17.0062 4064 Wanarp - ok
21:28:17.0077 4064 WDICA - ok
21:28:17.0093 4064 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
21:28:17.0093 4064 wdmaud - ok
21:28:17.0124 4064 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
21:28:17.0124 4064 WebClient - ok
21:28:17.0202 4064 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
21:28:17.0202 4064 winmgmt - ok
21:28:17.0265 4064 [ 140EF97B64F560FD78643CAE2CDAD838 ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
21:28:17.0265 4064 WmdmPmSN - ok
21:28:17.0327 4064 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
21:28:17.0343 4064 Wmi - ok
21:28:17.0405 4064 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
21:28:17.0405 4064 WmiApSrv - ok
21:28:17.0452 4064 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:28:17.0452 4064 WSTCODEC - ok
21:28:17.0484 4064 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
21:28:17.0484 4064 wuauserv - ok
21:28:17.0515 4064 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
21:28:17.0530 4064 WZCSVC - ok
21:28:17.0577 4064 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
21:28:17.0577 4064 xmlprov - ok
21:28:17.0593 4064 ================ Scan global ===============================
21:28:17.0640 4064 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
21:28:17.0655 4064 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
21:28:17.0671 4064 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
21:28:17.0687 4064 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
21:28:17.0702 4064 [Global] - ok
21:28:17.0718 4064 ================ Scan MBR ==================================
21:28:17.0734 4064 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
21:28:17.0874 4064 \Device\Harddisk0\DR0 - ok
21:28:17.0874 4064 ================ Scan VBR ==================================
21:28:17.0890 4064 [ 80039FA99B61377D90187A5A96CC208E ] \Device\Harddisk0\DR0\Partition1
21:28:17.0890 4064 \Device\Harddisk0\DR0\Partition1 - ok
21:28:17.0905 4064 [ E3D9BD15D133BFB3F764C3E65984C6DA ] \Device\Harddisk0\DR0\Partition2
21:28:17.0905 4064 \Device\Harddisk0\DR0\Partition2 - ok
21:28:17.0905 4064 ============================================================
21:28:17.0905 4064 Scan finished
21:28:17.0905 4064 ============================================================
21:28:18.0015 3844 Detected object count: 1
21:28:18.0015 3844 Actual detected object count: 1
21:29:29.0683 3844 C:\WINDOWS\System32\Drivers\658dfed3bfeed537.sys - copied to quarantine
21:29:29.0730 3844 HKLM\SYSTEM\ControlSet001\services\658dfed3bfeed537 - will be deleted on reboot
21:29:29.0745 3844 HKLM\SYSTEM\ControlSet002\services\658dfed3bfeed537 - will be deleted on reboot
21:29:29.0886 3844 C:\WINDOWS\System32\Drivers\658dfed3bfeed537.sys - will be deleted on reboot
21:29:29.0886 3844 658dfed3bfeed537 ( Rootkit.Win32.Necurs.gen ) - User select action: Delete
21:29:34.0683 0724 Deinitialize success


[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]


ComboFix 12-10-11.03 - Dimitrije 10/11/2012 22:20:05.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.293 [GMT 2:00]
Running from: c:\documents and settings\Dimitrije\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Dimitrije\0i763f66bz.exe
c:\documents and settings\Dimitrije\Local Settings\Application Data\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}
c:\documents and settings\Dimitrije\Local Settings\Application Data\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\@
c:\documents and settings\Dimitrije\Local Settings\Application Data\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\n
c:\documents and settings\Dimitrije\Local Settings\Application Data\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U\00000001.@
c:\documents and settings\Dimitrije\Local Settings\Application Data\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U\80000000.@
c:\documents and settings\Dimitrije\Local Settings\Application Data\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U\800000cb.@
c:\documents and settings\Dimitrije\WINDOWS
c:\windows\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}
c:\windows\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\@
c:\windows\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\n
c:\windows\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U\00000001.@
c:\windows\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U\80000000.@
c:\windows\Installer\{0e6eeec4-7265-3910-70e7-2c41e7bf0ce1}\U\800000cb.@
c:\windows\ST6UNST.000
c:\windows\system\bdt52exf.dll
c:\windows\system\bivbx31.32n
c:\windows\winhelp.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-09-11 to 2012-10-11 )))))))))))))))))))))))))))))))
.
.
2012-10-11 20:05 . 2012-10-11 20:07 -------- d-----w- c:\windows\LastGood.Tmp
2012-10-11 19:32 . 2012-10-11 19:32 -------- d-----w- C:\found.000
2012-10-11 19:29 . 2012-10-11 19:29 -------- d-----w- C:\TDSSKiller_Quarantine
2012-10-11 16:12 . 2012-10-11 16:13 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys
2012-09-28 18:20 . 2012-09-28 18:30 -------- d-----w- c:\documents and settings\Dimitrije\Local Settings\Application Data\Ahead
2012-09-28 18:18 . 2012-09-28 18:31 -------- d-----w- c:\documents and settings\Dimitrije\Application Data\Ahead
2012-09-28 18:15 . 2012-09-28 18:20 -------- d-----w- c:\program files\Common Files\Ahead
2012-09-28 18:15 . 2012-09-28 18:15 -------- d-----w- c:\program files\Nero
2012-09-26 16:54 . 2012-09-26 16:54 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2012-09-23 16:12 . 2001-08-17 20:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2012-09-23 16:12 . 2008-04-14 03:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2012-09-23 16:12 . 2008-04-13 22:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2012-09-23 16:12 . 2008-04-13 22:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-09 04:37 . 2012-04-01 23:03 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 04:37 . 2012-02-12 03:41 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-22 23:07 . 2012-08-22 23:06 253952 ------w- c:\windows\Setup1.exe
2012-08-22 23:07 . 2012-08-22 23:06 74752 ----a-w- c:\windows\ST6UNST.EXE
2012-09-08 22:22 . 2012-09-08 22:21 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-05 17344176]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2012-01-05 75624]
"Facebook Update"="c:\documents and settings\Dimitrije\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2012-07-13 138096]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-18 925696]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2012-02-16 114992]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
.
c:\documents and settings\Dimitrije\Start Menu\Programs\Startup\
GameRanger.lnk - c:\documents and settings\Dimitrije\Application Data\GameRanger\GameRanger\GameRanger.exe [2012-10-12 1482464]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2/5/2012 4:11 PM 2253120]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [6/6/2012 12:17 AM 160944]
R2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [1/18/2012 8:44 AM 450848]
S?2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [1/5/2012 5:42 PM 75624]
S0 34922202;34922202;c:\windows\system32\drivers\54500579.sys --> c:\windows\system32\drivers\54500579.sys [?]
S0 658dfed3bfeed537;0i763f66bz.exe;\SystemRoot\\SystemRoot\System32\Drivers\658dfed3bfeed537.sys --> \SystemRoot\\SystemRoot\System32\Drivers\658dfed3bfeed537.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/2/2012 1:03 AM 250808]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.207\McCHSvc.exe [6/17/2011 7:33 PM 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/4/2012 10:31 PM 114144]
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 04:37]
.
2012-10-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003Core.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-07-13 11:00]
.
2012-10-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003UA.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-07-13 11:00]
.
2012-10-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003Core.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-04 19:27]
.
2012-10-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003UA.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-04 19:27]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uInternet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Dimitrije\Application Data\Mozilla\Firefox\Profiles\2c4rxou0.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - tt=010312_ctrl
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 10042270000000000000001a92da0294
FF - user.js: extensions.BabylonToolbar_i.hardId - 10042270000000000000001a92da0294
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15487
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1711:25
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{930f1200-f5f1-4870-bac6-e233ec8e7023} - c:\program files\Softonic_English\tbSoft.dll
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
BHO-{930f1200-f5f1-4870-bac6-e233ec8e7023} - c:\program files\Softonic_English\tbSoft.dll
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
Toolbar-{930f1200-f5f1-4870-bac6-e233ec8e7023} - c:\program files\Softonic_English\tbSoft.dll
WebBrowser-{930F1200-F5F1-4870-BAC6-E233EC8E7023} - c:\program files\Softonic_English\tbSoft.dll
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
HKCU-Run-0i763f66bz - c:\documents and settings\Dimitrije\0i763f66bz.exe
SafeBoot-34922202.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2012-10-11 22:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-57989841-507921405-1417001333-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2140)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
c:\windows\system32\RunDLL32.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2012-10-11 22:32:18 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-11 20:32
.
Pre-Run: 37,895,831,552 bytes free
Post-Run: 38,131,630,080 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - BCBA31CE2887E33B8A3E9AC3D27C0F07

Poslao: 12 Okt 2012 14:46
Idi na vrh
offline
  • Pridružio: 04 Jul 2011
  • Poruke: 5424

Arrow Otvoriti Notepad i iskopirati sledeci tekst:

Driver::
658dfed3bfeed537

File::
c:\windows\System32\Drivers\658dfed3bfeed537.sys

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.





Question Da li je sada bolje stanje, da li i dalje koči računar?




Ivance95 (AMF Tim)

Poslao: 12 Okt 2012 15:22
Idi na vrh
offline
  • Pridružio: 19 Jul 2011
  • Poruke: 445
  • Gde živiš: Krusevac

Napisano: 12 Okt 2012 15:14

ComboFix 12-10-12.01 - Dimitrije 10/12/2012 15:03:53.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.280 [GMT 2:00]
Running from: c:\documents and settings\Dimitrije\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Dimitrije\Desktop\CFScript.txt.txt
.
FILE ::
"c:\windows\System32\Drivers\658dfed3bfeed537.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_658DFED3BFEED537
-------\Service_658dfed3bfeed537
.
.
((((((((((((((((((((((((( Files Created from 2012-09-12 to 2012-10-12 )))))))))))))))))))))))))))))))
.
.
2012-10-11 19:32 . 2012-10-11 19:32 -------- d-----w- C:\found.000
2012-10-11 19:29 . 2012-10-11 19:29 -------- d-----w- C:\TDSSKiller_Quarantine
2012-10-11 16:12 . 2012-10-11 16:13 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys
2012-09-28 18:20 . 2012-09-28 18:30 -------- d-----w- c:\documents and settings\Dimitrije\Local Settings\Application Data\Ahead
2012-09-28 18:18 . 2012-09-28 18:31 -------- d-----w- c:\documents and settings\Dimitrije\Application Data\Ahead
2012-09-28 18:15 . 2012-09-28 18:20 -------- d-----w- c:\program files\Common Files\Ahead
2012-09-28 18:15 . 2012-09-28 18:15 -------- d-----w- c:\program files\Nero
2012-09-26 16:54 . 2012-09-26 16:54 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee
2012-09-23 16:12 . 2001-08-17 20:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2012-09-23 16:12 . 2008-04-14 03:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2012-09-23 16:12 . 2008-04-13 22:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2012-09-23 16:12 . 2008-04-13 22:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-09 04:37 . 2012-04-01 23:03 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-09 04:37 . 2012-02-12 03:41 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-28 15:14 . 2008-04-14 09:42 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14 . 2008-04-14 09:41 43520 ------w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14 . 2008-04-14 09:42 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07 . 2008-04-14 04:07 385024 ------w- c:\windows\system32\html.iec
2012-08-24 13:53 . 2008-04-14 09:42 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-22 23:07 . 2012-08-22 23:06 253952 ------w- c:\windows\Setup1.exe
2012-08-22 23:07 . 2012-08-22 23:06 74752 ----a-w- c:\windows\ST6UNST.EXE
2012-08-21 13:29 . 2008-04-14 04:57 2192896 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58 . 2008-04-14 00:01 2069632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-09-08 22:22 . 2012-09-08 22:21 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-06-05 17344176]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [2012-01-05 75624]
"Facebook Update"="c:\documents and settings\Dimitrije\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2012-07-13 138096]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-18 925696]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 204800]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2012-02-16 114992]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
.
c:\documents and settings\Dimitrije\Start Menu\Programs\Startup\
GameRanger.lnk - c:\documents and settings\Dimitrije\Application Data\GameRanger\GameRanger\GameRanger.exe [2012-10-12 1482464]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2/5/2012 4:11 PM 2253120]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [6/6/2012 12:17 AM 160944]
R2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe [1/18/2012 8:44 AM 450848]
S0 34922202;34922202;c:\windows\system32\drivers\54500579.sys --> c:\windows\system32\drivers\54500579.sys [?]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [1/5/2012 5:42 PM 75624]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/2/2012 1:03 AM 250808]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.207\McCHSvc.exe [6/17/2011 7:33 PM 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/4/2012 10:31 PM 114144]
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 04:37]
.
2012-10-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003Core.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-07-13 11:00]
.
2012-10-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003UA.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-07-13 11:00]
.
2012-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003Core.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-04 19:27]
.
2012-10-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-507921405-1417001333-1003UA.job
- c:\documents and settings\Dimitrije\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-02-04 19:27]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uInternet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Dimitrije\Application Data\Mozilla\Firefox\Profiles\2c4rxou0.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: keyword.URL - [Link mogu videti samo ulogovani korisnici]
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - tt=010312_ctrl
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 10042270000000000000001a92da0294
FF - user.js: extensions.BabylonToolbar_i.hardId - 10042270000000000000001a92da0294
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15487
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1711:25
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2012-10-12 15:10
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-57989841-507921405-1417001333-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1900)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\windows\system32\nvcpl.dll
c:\windows\system32\nvapi.dll
c:\program files\NVIDIA Corporation\nview\nvshell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\RunDLL32.exe
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2012-10-12 15:12:44 - machine was rebooted
ComboFix-quarantined-files.txt 2012-10-12 13:12
ComboFix2.txt 2012-10-11 20:32
.
Pre-Run: 37,633,961,984 bytes free
Post-Run: 37,567,033,344 bytes free
.
- - End Of File - - FD19C0BB89BAB2A0F5686723F2284DD0

Dopuna: 12 Okt 2012 15:16

Moze se reci da radi malo bolje.

Dopuna: 12 Okt 2012 15:22

Zahvaljujem Smile

Poslao: 12 Okt 2012 15:35
Idi na vrh
offline
  • Pridružio: 04 Jul 2011
  • Poruke: 5424

Arrow Preuzmi "Xplode"-ov AdwCleaner i sacuvaj ga na Desktop
Dvoklikom pokreni program i klikni na dugme [Search] .
Kada program zavrsi analizu otvorice notepad sa izvestajem. Zatvori taj notepad.

Klikni na dugme [Delete] i pricekaj da program zavrsi.
Program ce zatvoriti sve aktivne programe i izbaciti prozor sa tim upozorenjem. Klikni Ok kao potvrdu.
Na sledeca dva prozora koja se otvore (Informations i Restart required ) klikni Ok
Racunar ce se restartovati a potom otvoriti notepad (C:\AdwCleaner[S1].txt) sa izvestajem.
Sacuvaj taj notepad na Desktop i okaci ga uz poruku koristeci opciju "Prikaci fajl"
Napomena: Izvestaj ce takodje biti sacuvan na C:\AdwCleaner[S1].txt





Arrow Da li je sada bolje stanje?




Ivance95 (AMF Tim)

Poslao: 12 Okt 2012 16:11
Idi na vrh
offline
  • Pridružio: 19 Jul 2011
  • Poruke: 445
  • Gde živiš: Krusevac

[Link mogu videti samo ulogovani korisnici]


Radi daleko bolje nego pre.

Poslao: 12 Okt 2012 16:31
Idi na vrh
offline
  • Pridružio: 04 Jul 2011
  • Poruke: 5424

Arrow Potrebno je deinstalirati ComboFix:
klikni start (ili ), a zatim RUN.

Na Visti koristiti Start Search polje ukoliko Run nije dostupan.

U liniju za unos teksta ukucaj (iskopiraj) sledeće:

ComboFix /Uninstall

Primeti da postoji razmak između "ComboFix" i "/Uninstall".



a zatim klikni OK (ili pritisni Enter).

Sačekaj da se proces deinstalacije završi.




Arrow
Ponovo pokreni AdwCleaner
Klikni na dugme [Uninstall] i pricekaj da se postupak uninstallacije zavrsi.





Arrow Na računaru nemaš instaliran ni jedan antivirusni program. Obavezno instaliraj jedno od besplatnih AV rešenja: Avira, AVG, Panda, Avast, MSE..., ili kupi licencu za neki od komercijalnih.
Nikada ne instaliraj piratske AV-ove!!!




Arrow Ponovo pokreni DDS i postavi mi svež log.




Ivance95 (AMF Tim)

Poslao: 12 Okt 2012 16:49
Idi na vrh
offline
  • Pridružio: 19 Jul 2011
  • Poruke: 445
  • Gde živiš: Krusevac

Znam da nemam antivirus. Trenutno skidam avast.



.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.7.2
Run by Dimitrije at 16:41:11 on 2012-10-12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.309 [GMT 2:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe
svchost.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
uInternet Connection Wizard,ShellNext = [Link mogu videti samo ulogovani korisnici]
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [AlcoholAutomount] "c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe" -automount
uRun: [Facebook Update] "c:\documents and settings\dimitrije\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [WheelMouse] c:\program files\a4tech\mouse\Amoumain.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [LWS] c:\program files\logitech\lws\webcam software\LWS.exe -hide
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\dimitr~1\startm~1\programs\startup\gamera~1.lnk - c:\documents and settings\dimitrije\application data\gameranger\gameranger\GameRanger.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.207\SSScheduler.exe
IE: Search the Web - c:\program files\sweetim\toolbars\internet explorer\resources\menuext.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FE409F54-495D-4C46-BD25-CF65DAAFC11D} : DhcpNameServer = 192.168.1.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\dimitrije\application data\mozilla\firefox\profiles\2c4rxou0.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: network.proxy.type - 0
.
============= SERVICES / DRIVERS ===============
.
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2012-2-5 2253120]
R2 StarWindServiceAE;StarWind AE Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindServiceAE.exe [2009-12-23 370688]
R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2012-1-18 450848]
S0 34922202;34922202;c:\windows\system32\drivers\54500579.sys --> c:\windows\system32\drivers\54500579.sys [?]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files\alcohol soft\alcohol 120\AxAutoMntSrv.exe [2012-1-5 75624]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-6-6 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-2 250808]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.207\McCHSvc.exe [2011-6-17 237008]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-5-4 114144]
.
=============== Created Last 30 ================
.
2012-10-12 13:42:41 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-10-11 20:12:31 -------- d-sha-r- C:\cmdcons
2012-10-11 19:32:33 -------- d-----w- C:\found.000
2012-10-11 19:29:29 -------- d-----w- C:\TDSSKiller_Quarantine
2012-10-11 16:12:58 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys
2012-09-28 18:20:08 -------- d-----w- c:\documents and settings\dimitrije\local settings\application data\Ahead
2012-09-28 18:15:58 -------- d-----w- c:\program files\Nero
2012-09-23 16:12:06 5632 ----a-w- c:\windows\system32\ptpusb.dll
2012-09-23 16:12:05 159232 ----a-w- c:\windows\system32\ptpusd.dll
2012-09-23 16:12:04 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2012-09-23 16:12:04 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
.
==================== Find3M ====================
.
2012-10-12 13:42:30 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-10-12 13:42:29 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-10-12 13:42:29 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-10-09 04:37:08 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-09 04:37:08 696760 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-28 15:14:53 916992 ----a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 ------w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 ------w- c:\windows\system32\html.iec
2012-08-24 13:53:22 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-08-22 23:07:23 74752 ----a-w- c:\windows\ST6UNST.EXE
2012-08-22 23:07:23 253952 ------w- c:\windows\Setup1.exe
2012-08-21 13:29:19 2192896 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-21 12:58:06 2069632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-07-26 02:40:28 286052 ----a-w- c:\windows\system32\nvdrsdb1.bin
2012-07-26 02:40:28 1 ----a-w- c:\windows\system32\nvdrssel.bin
2012-07-26 02:40:27 286052 ----a-w- c:\windows\system32\nvdrsdb0.bin
.
============= FINISH: 16:41:34.03 ===============





[Link mogu videti samo ulogovani korisnici]

Poslao: 12 Okt 2012 17:10
Idi na vrh
offline
  • Pridružio: 04 Jul 2011
  • Poruke: 5424

Arrow Tvoj kompjuter je čist što se malware-a tiče. Obavezno instaliraj AV, smanjiće mogućnost zaraze u buduće, i nikada nemoj da ostaješ bez AV-a na duže vreme.




Arrow Preporucujem da za zastitu USB memorijskih uredjaja koristis MCShield v2. Nema nikakve veze sa AntiVirus-om tj. nece ometati njegov rad a pokazao se kao jedan od najboljih vida zastite od malware-a koji se prenosi putem USB mem. uredjaja. Skines, instaliras, ubodes USB mem. uredjaj, izvrsi se skeniranje nakon cega dobijes obavestenje da je uredjaj cist (ukoliko je stvarno tako); ili dobijes log u kome vidis informacije o malware-u koji je nadjen i obrisan.


Home Page MCShield-a ::Anti-Malware Tool:: v2: [Link mogu videti samo ulogovani korisnici]

Vise o MCShield-u mozes saznati u ovim temama:
v1: [Link mogu videti samo ulogovani korisnici]
v2: [Link mogu videti samo ulogovani korisnici]




Arrow Obavezno poseti temu "Testirajte da li vam je pretrazivac ranjiv", procitaj i isprati link koji stoji u njoj. Link do teme je: [Link mogu videti samo ulogovani korisnici]




Ivance95 (AMF Tim)

MyCity » Ambulanta -> Arhiva Ambulante » Racunar steka

Ko je trenutno na forumu
 

Ukupno su 4318 korisnika na forumu :: 67 registrovanih, 9 sakrivenih i 4242 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 20624 - dana 04 Apr 2026 04:18

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: aleksmajstor, alex71, Andrija357, Apok, Arni, AS, Asteker, b_z_b, bakovaca, bankulen, Baždaranac, Ben Roj, bobomicek, Borkanović, Cirkon, dankisha, darionis, debeli, desmeki, djboj, dmitarche, Dolinc, Dorcolac, dushan, efektiva, Fructo, galerija, Glavonja049, Hans Gajger, Jablan, Jaz, joca83, leopard83, loon123, MarijaC84, Medojed, MIKULENCE, Milan A. Nikolic, mile.ilic75, milenko crazy north, Milos ZA, Mitch22, MKK7, mocnijogurt, mrvica78, nebidrag, nevjerna beba, opt1, Paklenica, Parker, Permaldar, Shajlok, simazr, slucajniprolaznik.ba, Smiljkovich, sova72, sspp, Stevan2026, TRZH92, USSVoyager, veljko82, veljkovicdani, Vrač, yufighter, Zandar, zixmix, 79693