MyCity » Ambulanta -> Arhiva Ambulante » Superantispyware mi detektovao virus PUP.MyWebsearch

Superantispyware mi detektovao virus PUP.MyWebsearch

Napisano na dan: 14.4.2013
1

Superantispyware mi detektovao virus PUP.MyWebsearch
Sledeća strana Pagination

Idi na vrh

Poslao: 14 Apr 2013 17:13
Idi na vrh
offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 445
  • Gde živiš: Landau and der Pfalz

Superantispyware mi je detektovao virus PUP.MyWebsearch danas i nemogu da ga uklonim sa sistema




DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.17.2
Run by Dalibor at 17:00:12 on 2013-04-14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.162 [GMT 2:00]
.
AV: Panda Cloud Antivirus *Enabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}
FW: Cloud Antivirus Firewall *Disabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77DE8857&p2=^HJ^xdm238^YY^rs&ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
dURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - <orphaned>
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
mRun: [VMSnap3] c:\windows\VMSnap3.EXE
mRun: [Domino] c:\windows\Domino.EXE
mRun: [PSUAMain] "c:\program files\panda security\panda cloud antivirus\PSUAMain.exe" /LaunchSysTray
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\dalibor\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\widgets\YahooWidgets.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.318\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{9F4E3ED5-5E40-425C-BD51-990C50442851} : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\dalibor\application data\mozilla\firefox\profiles\6e0jhsd5.default\
FF - prefs.js: browser.search.selectedEngine - My Web Search
FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722&n=77fc92a3&p2=^HJ^xdm238^YY^rs
FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722&n=77fc92a3&ind=2013041315&p2=^HJ^xdm238^YY^rs&searchfor=
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mcafee security scan\3.0.318\npMcAfeeMSS.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: !HIDDEN! 2013-04-13 14:59; speedanalysis@SpeedAnalysis.com; c:\documents and settings\dalibor\application data\mozilla\extensions\speedanalysis@SpeedAnalysis.com
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=a84fa357000000000000001d92472bc2&q=
FF - user.js: extensions.BabylonToolbar.id - a84fa357000000000000001d92472bc2
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15808
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.11.10
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.11.10
FF - user.js: extensions.BabylonToolbar.vrsnTs - 1.8.11.1015:01:18
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - uninst
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.ffxUnstlRst - true
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=121182
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar.newTab - false
.
============= SERVICES / DRIVERS ===============
.
R1 NNSALPC;NNSAlpc;c:\windows\system32\drivers\NNSAlpc.sys [2012-11-26 82728]
R1 NNSHTTP;NNSHttp;c:\windows\system32\drivers\NNSHttp.sys [2012-11-26 119080]
R1 NNSHTTPS;NNSHttps;c:\windows\system32\drivers\NNSHttps.sys [2013-1-9 95584]
R1 NNSIDS;NNSids;c:\windows\system32\drivers\NNSIds.sys [2012-11-26 123944]
R1 NNSPICC;NNSPicc;c:\windows\system32\drivers\NNSpicc.sys [2012-11-26 94632]
R1 NNSPOP3;NNSPop3;c:\windows\system32\drivers\NNSPop3.sys [2012-11-26 105640]
R1 NNSPROT;NNSProt;c:\windows\system32\drivers\NNSProt.sys [2012-11-26 286888]
R1 NNSPRV;NNSPrv;c:\windows\system32\drivers\NNSPrv.sys [2012-11-26 159528]
R1 NNSSMTP;NNSSmtp;c:\windows\system32\drivers\NNSSmtp.sys [2012-11-26 108200]
R1 NNSSTRM;NNSStrm;c:\windows\system32\drivers\NNSStrm.sys [2012-11-28 218024]
R1 NNSTLSC;NNSTlsc;c:\windows\system32\drivers\NNStlsc.sys [2012-11-26 93096]
R1 PSINKNC;PSINKnc;c:\windows\system32\drivers\PSINKNC.sys [2012-11-9 178728]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-8-12 116608]
R2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\panda security\panda cloud antivirus\PSANHost.exe [2013-1-27 140512]
R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [2012-11-9 149288]
R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [2012-11-9 102184]
R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [2012-11-9 114216]
R2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [2012-11-9 123560]
R2 PSUAService;Panda Product Service;c:\program files\panda security\panda cloud antivirus\PSUAService.exe [2013-1-27 37088]
R3 PSKMAD;PSKMAD;c:\windows\system32\drivers\PSKMAD.sys [2013-4-13 46672]
R3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2013-4-3 428160]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.318\McCHSvc.exe [2013-2-5 235216]
S3 NNSNAHS;Network Activity Hook Server Service;c:\windows\system32\drivers\NNSNAHS.sys [2012-10-22 38824]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\i:\ntglm7x.sys --> i:\NTGLM7X.sys [?]
S4 NNSPIHS;NNSPihs;c:\windows\system32\drivers\NNSpihs.sys [2012-11-26 51496]
.
=============== Created Last 30 ================
.
2013-04-13 13:34:56 46672 ----a-w- c:\windows\system32\drivers\PSKMAD.sys
2013-04-13 13:00:43 -------- d-----w- c:\documents and settings\dalibor\application data\PerformerSoft
2013-04-13 13:00:34 18096 ----a-w- c:\windows\system32\roboot.exe
2013-04-13 13:00:08 -------- d-----w- c:\documents and settings\all users\application data\Babylon
2013-04-13 13:00:07 -------- d-----w- c:\documents and settings\dalibor\application data\Babylon
2013-04-13 12:59:18 -------- d-----w- c:\documents and settings\dalibor\application data\SpeedanAlysis
2013-04-13 12:59:04 -------- d-----w- c:\documents and settings\dalibor\application data\File Scout
2013-04-10 06:57:19 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2013-04-10 06:57:18 -------- d-----w- c:\program files\Hitman Pro 3.5
2013-04-10 06:57:11 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2013-04-09 11:15:19 -------- d-----w- C:\extensions
2013-04-09 11:13:27 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\ACD Systems
2013-04-09 11:13:27 -------- d-----w- c:\documents and settings\dalibor\application data\ACD Systems
2013-04-09 11:12:15 -------- d-----w- c:\documents and settings\all users\application data\ACD Systems
2013-04-09 11:12:08 -------- d-----w- c:\program files\common files\ACD Systems
2013-04-09 11:12:08 -------- d-----w- c:\program files\ACD Systems
2013-04-09 11:03:39 5888 ------w- c:\windows\system32\drivers\imagedrv.sys
2013-04-09 11:03:39 127488 ------w- c:\windows\system32\drivers\imagesrv.sys
2013-04-09 11:03:13 364544 ------w- c:\windows\system32\TwnLib4.dll
2013-04-09 11:03:12 471040 ------w- c:\windows\system32\ImagXRA7.dll
2013-04-09 11:03:12 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2013-04-09 11:03:11 476320 ------w- c:\windows\system32\ImagXpr7.dll
2013-04-09 11:03:11 262144 ------w- c:\windows\system32\ImagXR7.dll
2013-04-09 11:03:11 1568768 ------w- c:\windows\system32\ImagX7.dll
2013-04-09 11:03:10 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2013-04-08 17:46:51 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Identities
2013-04-08 16:50:50 -------- d-----w- c:\program files\Maxthon3
2013-04-06 06:46:11 -------- d-----w- c:\program files\FastStone Capture
2013-04-06 06:39:32 -------- d-----w- c:\program files\Defraggler
2013-04-05 07:31:04 5632 ----a-w- c:\windows\system32\ptpusb.dll
2013-04-05 07:31:03 159232 ----a-w- c:\windows\system32\ptpusd.dll
2013-04-05 07:31:03 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2013-04-05 07:31:03 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2013-04-04 13:00:48 630272 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2013-04-04 13:00:48 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2013-04-04 13:00:46 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2013-04-04 13:00:46 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2013-04-04 13:00:45 2004992 -c----w- c:\windows\system32\dllcache\iertutil.dll
2013-04-04 13:00:44 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2013-04-04 13:00:44 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-04-04 13:00:41 11111424 -c----w- c:\windows\system32\dllcache\ieframe.dll
2013-04-04 12:50:54 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll
2013-04-04 12:50:11 -------- d-----w- c:\windows\ie8updates
2013-04-04 12:49:27 99840 -c----w- c:\windows\system32\dllcache\srvsvc.dll
2013-04-04 12:48:54 75776 -c----w- c:\windows\system32\dllcache\strmfilt.dll
2013-04-04 12:48:53 265728 -c----w- c:\windows\system32\dllcache\http.sys
2013-04-04 12:48:53 25088 -c----w- c:\windows\system32\dllcache\httpapi.dll
2013-04-04 12:44:51 21336 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2013-04-04 12:38:50 -------- d-----w- c:\documents and settings\all users\application data\IObit
2013-04-04 12:32:57 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Yahoo
2013-04-04 12:17:58 -------- d-----w- c:\program files\Instant CD & DVD Burner
2013-04-04 12:16:21 -------- d-----w- c:\program files\MSECache
2013-04-04 12:14:15 -------- d-----w- C:\audiograbber
2013-04-04 12:12:43 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Adobe
2013-04-04 12:11:54 -------- d-----w- c:\program files\GRETECH
2013-04-04 12:09:22 -------- d-----w- c:\windows\Word 2 PDF
2013-04-04 12:09:22 -------- d-----w- c:\program files\Word 2 PDF
2013-04-04 11:58:57 -------- d-----w- c:\documents and settings\dalibor\application data\OpenCandy
2013-04-04 11:58:52 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2013-04-04 11:58:51 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2013-04-04 11:58:47 -------- d-----w- c:\windows\Logs
2013-04-04 11:58:41 -------- d-----w- c:\program files\Winamp Detect
2013-04-04 11:58:18 819200 ----a-w- c:\program files\windows media player\wmsetsdk.exe
2013-04-04 11:58:18 47616 ----a-w- c:\program files\windows media player\msoobci.dll
2013-04-04 11:57:52 -------- d-----w- c:\windows\RegisteredPackages
2013-04-04 11:52:35 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Sun
2013-04-04 11:41:37 -------- d-----w- c:\documents and settings\dalibor\application data\SUPERAntiSpyware.com
2013-04-04 11:41:05 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-04 11:41:05 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2013-04-04 11:38:57 -------- d-----w- c:\documents and settings\dalibor\application data\IObit
2013-04-04 11:38:52 -------- d-----w- c:\program files\IObit
2013-04-04 11:35:28 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-04-04 11:35:28 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-04-04 11:35:28 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-04-04 11:35:12 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-04-04 11:30:55 -------- d-----w- c:\documents and settings\all users\application data\McAfee Security Scan
2013-04-04 11:30:50 -------- d-----w- c:\program files\McAfee Security Scan
2013-04-04 11:30:47 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-04 11:30:47 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-04 09:19:20 -------- d-sh--w- c:\documents and settings\dalibor\IETldCache
2013-04-04 09:00:37 -------- dc-h--w- c:\windows\ie8
2013-04-04 08:36:35 -------- d-----w- c:\windows\system32\appmgmt
2013-04-04 08:28:30 -------- d-----w- c:\documents and settings\dalibor\application data\FastStone
2013-04-04 08:27:39 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Downloaded Installations
2013-04-04 06:11:54 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2013-04-04 06:11:28 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2013-04-04 06:11:18 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2013-04-04 06:10:43 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2013-04-04 06:10:34 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2013-04-04 06:10:12 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2013-04-04 06:10:12 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2013-04-04 06:10:03 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2013-04-04 06:09:36 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2013-04-04 06:09:23 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2013-04-04 06:09:22 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
2013-04-04 06:09:22 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys
2013-04-04 06:09:18 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2013-04-04 06:08:23 536576 -c----w- c:\windows\system32\dllcache\msado15.dll
2013-04-04 06:07:38 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2013-04-04 06:07:37 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2013-04-04 06:07:37 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2013-04-04 06:07:37 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2013-04-04 06:07:37 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2013-04-04 06:07:37 110592 -c----w- c:\windows\system32\dllcache\services.exe
2013-04-04 06:07:36 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2013-04-04 06:07:30 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2013-04-04 06:05:53 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2013-04-04 06:05:15 290560 -c----w- c:\windows\system32\dllcache\atmfd.dll
2013-04-04 06:04:41 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2013-04-04 06:04:39 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2013-04-03 22:54:45 -------- d-----w- c:\windows\system32\PreInstall
2013-04-03 22:54:43 -------- d--h--w- c:\windows\$hf_mig$
2013-04-03 22:49:41 -------- d-----w- c:\program files\Yahoo!
2013-04-03 22:09:27 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2013-04-03 22:08:41 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2013-04-03 22:07:57 74240 ----a-w- c:\windows\system32\usbui.dll
2013-04-03 22:07:22 -------- d-----r- c:\program files\Skype
2013-04-03 22:05:49 -------- d-----w- C:\Documents and Settings
.
==================== Find3M ====================
.
2013-04-03 20:54:56 315392 ----a-w- c:\windows\HideWin.exe
2013-03-25 20:39:46 4546560 ----a-w- c:\windows\system32\GPhotos.scr
2013-03-08 08:36:22 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32:25 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50:30 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-02 02:06:31 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06:30 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25:02 1867264 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08:47 385024 ----a-w- c:\windows\system32\html.iec
2013-02-27 07:56:51 2067456 ----a-w- c:\windows\system32\mstscax.dll
2013-02-12 00:32:23 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-12 00:32:23 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
2013-01-26 03:55:44 552448 ----a-w- c:\windows\system32\oleaut32.dll
.
============= FINISH: 17:01:00,90 ===============

https://www.mycity.rs/must-login.png

Poslao: 14 Apr 2013 17:29
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Pozdrav,





Preuzmi Junkware Removal Tool ( JRT ) i sacuvaj ga na desktop.

zatvori browser i ostale pokrenute programe;
Jel potrebno navesti napomenu za duzinu scana? Da postavim ovaj PG ili nema potrebe za tim?

Privremeno deaktiviraj zastitni softver (Uputstvo);

dvoklikom na ikonicu ( )pokreni program JRT;

Kod obavestenja "press any key" pritisnuti bilo koji taster i alat ce zapoceti skeniranje.
Napomena: u ovisnosti od sistemske specifikacije vreme skeniranja u nekim slucajevima moze da potraje.

Kada zavrsi otvorice se log sa izvestajem koji ce biti sacuvan na desktopu pod nazivom JRT.txt

Arrow Kopiraj sadrzaj tog loga u temu.


******************************


Preuzmi "Xplode"-ov AdwCleaner () i sacuvaj ga na Desktop

Dvoklikom pokreni program.
Klikni na dugme [Delete] i pricekaj da program zavrsi.
Program ce zatvoriti sve aktivne programe i izbaciti prozor sa tim upozorenjem. Klikni Ok kao potvrdu.
Na sledeca dva prozora koja se otvore (Informations i Restart required ) klikni Ok

Racunar ce se restartovati a potom otvoriti notepad (C:\AdwCleaner[S1].txt) sa izvestajem.
Sacuvaj taj notepad na Desktop i okaci ga uz poruku koristeci opciju "Prikaci fajl"
Napomena: Izvestaj ce takodje biti sacuvan na C:\AdwCleaner[S1].txt


******************************


> Ponovo pokreni DDS i postavi svez DDS.txt log na uvid.

Poslao: 14 Apr 2013 17:53
Idi na vrh
offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 445
  • Gde živiš: Landau and der Pfalz

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.8.3 (04.05.2013:1)
OS: Microsoft Windows XP x86
Ran by Dalibor on ned 14.04.2013 at 17:33:45,71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_users\S-1-5-21-1177238915-1677128483-725345543-1003\software\microsoft\internet explorer\main\\Start Page
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\DisplayName
Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{0633ee93-d776-472f-a0ff-e1416b8b2e3a}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_local_machine\software\babylon
Failed to delete: [Registry Key] hkey_current_user\software\datamngr
Failed to delete: [Registry Key] hkey_local_machine\software\datamngr
Successfully deleted: [Registry Key] hkey_current_user\software\performersoft llc
Successfully deleted: [Registry Key] hkey_local_machine\software\classes\prod.cap
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{02478d38-c3f9-4efb-9b51-7695eca05670}
Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{3bd44f0e-0596-4008-aee0-45d47e3a8f0e}
Successfully deleted: [Registry Key] hkey_classes_root\clsid\{ef99bd32-c1fb-11d2-892f-0090271d4f88}



~~~ Files

Successfully deleted: [File] "C:\WINDOWS\system32\roboot.exe"
Successfully deleted: [File] C:\WINDOWS\prefetch\BABYLONTOOLBAR4FFX.EXE-0E42DD66.pf
Successfully deleted: [File] C:\WINDOWS\prefetch\BABYLONTOOLBAR4IE.EXE-32ABF3CC.pf
Successfully deleted: [File] C:\WINDOWS\prefetch\BABYLONTOOLBARSRV.EXE-321ADE0A.pf
Successfully deleted: [File] C:\WINDOWS\prefetch\MYBABYLONTB.EXE-062DF470.pf



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\babylon"
Successfully deleted: [Folder] "C:\Documents and Settings\Dalibor\Application Data\babylon"
Successfully deleted: [Folder] "C:\Documents and Settings\Dalibor\Application Data\blekko"
Successfully deleted: [Folder] "C:\Documents and Settings\Dalibor\Application Data\file scout"
Successfully deleted: [Folder] "C:\Documents and Settings\Dalibor\Application Data\opencandy"
Successfully deleted: [Folder] "C:\Documents and Settings\Dalibor\Application Data\performersoft"



~~~ FireFox

Successfully deleted: [File] "C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml"
Successfully deleted: [File] C:\Documents and Settings\Dalibor\Application Data\mozilla\firefox\profiles\6e0jhsd5.default\user.js
Successfully deleted: [File] C:\Documents and Settings\Dalibor\Application Data\mozilla\firefox\profiles\6e0jhsd5.default\invalidprefs.js
Successfully deleted: [File] C:\Documents and Settings\Dalibor\Application Data\mozilla\firefox\profiles\6e0jhsd5.default\searchplugins\my-web-search.xml
Successfully deleted the following from C:\Documents and Settings\Dalibor\Application Data\mozilla\firefox\profiles\6e0jhsd5.default\prefs.js

user_pref("browser.search.defaultenginename", "My Web Search");
user_pref("browser.search.selectedEngine", "My Web Search");
user_pref("browser.startup.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722&n=77fc92a3&p2=^HJ^xdm238^YY^rs");
user_pref("extensions.BabylonToolbar.admin", false);
user_pref("extensions.BabylonToolbar.aflt", "babsst");
user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
user_pref("extensions.BabylonToolbar.autoRvrt", "false");
user_pref("extensions.BabylonToolbar.dfltLng", "en");
user_pref("extensions.BabylonToolbar.excTlbr", false);
user_pref("extensions.BabylonToolbar.ffxUnstlRst", true);
user_pref("extensions.BabylonToolbar.id", "a84fa357000000000000001d92472bc2");
user_pref("extensions.BabylonToolbar.instlDay", "15808");
user_pref("extensions.BabylonToolbar.instlRef", "sst");
user_pref("extensions.BabylonToolbar.newTab", false);
user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
user_pref("extensions.BabylonToolbar.rvrt", "false");
user_pref("extensions.BabylonToolbar.smplGrp", "none");
user_pref("extensions.BabylonToolbar.tlbrId", "uninst");
user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=a84fa357000000000000001d92472bc2&q=");
user_pref("extensions.BabylonToolbar.vrsn", "1.8.11.10");
user_pref("extensions.BabylonToolbar.vrsnTs", "1.8.11.1015:01:18");
user_pref("extensions.BabylonToolbar.vrsni", "1.8.11.10");
user_pref("extensions.BabylonToolbar_i.babExt", "");
user_pref("extensions.BabylonToolbar_i.babTrack", "affID=121182");
user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
user_pref("extensions.mywebsearch.prevKwdEnabled", true);
user_pref("extensions.mywebsearch.prevKwdURL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722&n=77fc92a3&ind=201304131
user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");
user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722&n=77fc92a3&p2=^HJ^xdm238^YY^rs
user_pref("extensions.toolbar.mindspark._4zMembers_.hp.enabled", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.hp.lastGuardTime", 58928459);
user_pref("extensions.toolbar.mindspark._4zMembers_.hp.numGuards", 1);
user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2013041315");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xdm238^YY^rs");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.toolbarId", "33BF75C7-66CC-49DD-A3A1-3FB9EDC53722");
user_pref("extensions.toolbar.mindspark._4zMembers_.lastActivePing", "1365858384630");
user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", true);
user_pref("extensions.toolbar.mindspark.hp.enabled", true);
user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "videodownloadconverter@mindspark.com");
user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");
user_pref("keyword.URL", "hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?st=kwd&ptb=33BF75C7-66CC-49DD-A3A1-3FB9EDC53722&n=77fc92a3&ind=2013041315&p2=^HJ^xdm238^YY^rs&





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ned 14.04.2013 at 17:42:55,34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png



DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.17.2
Run by Dalibor at 17:49:27 on 2013-04-14
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.340 [GMT 2:00]
.
AV: Panda Cloud Antivirus *Enabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}
FW: Cloud Antivirus Firewall *Disabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VMSnap3.EXE
C:\WINDOWS\Domino.EXE
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe
C:\Program Files\Skype\Updater\Updater.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\Program Files\Maxthon3\Bin\Maxthon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.yahoo.com
mDefault_Page_URL = hxxp://www.yahoo.com
dURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - <orphaned>
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
mRun: [VMSnap3] c:\windows\VMSnap3.EXE
mRun: [Domino] c:\windows\Domino.EXE
mRun: [PSUAMain] "c:\program files\panda security\panda cloud antivirus\PSUAMain.exe" /LaunchSysTray
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\dalibor\startm~1\programs\startup\yahoo!~1.lnk - c:\program files\yahoo!\widgets\YahooWidgets.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\3.0.318\SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{9F4E3ED5-5E40-425C-BD51-990C50442851} : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\dalibor\application data\mozilla\firefox\profiles\6e0jhsd5.default\
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.135\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mcafee security scan\3.0.318\npMcAfeeMSS.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_6_602_180.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: !HIDDEN! 2013-04-13 14:59; speedanalysis@SpeedAnalysis.com; c:\documents and settings\dalibor\application data\mozilla\extensions\speedanalysis@SpeedAnalysis.com
.
============= SERVICES / DRIVERS ===============
.
R1 NNSALPC;NNSAlpc;c:\windows\system32\drivers\NNSAlpc.sys [2012-11-26 82728]
R1 NNSHTTP;NNSHttp;c:\windows\system32\drivers\NNSHttp.sys [2012-11-26 119080]
R1 NNSHTTPS;NNSHttps;c:\windows\system32\drivers\NNSHttps.sys [2013-1-9 95584]
R1 NNSIDS;NNSids;c:\windows\system32\drivers\NNSIds.sys [2012-11-26 123944]
R1 NNSPICC;NNSPicc;c:\windows\system32\drivers\NNSpicc.sys [2012-11-26 94632]
R1 NNSPOP3;NNSPop3;c:\windows\system32\drivers\NNSPop3.sys [2012-11-26 105640]
R1 NNSPROT;NNSProt;c:\windows\system32\drivers\NNSProt.sys [2012-11-26 286888]
R1 NNSPRV;NNSPrv;c:\windows\system32\drivers\NNSPrv.sys [2012-11-26 159528]
R1 NNSSMTP;NNSSmtp;c:\windows\system32\drivers\NNSSmtp.sys [2012-11-26 108200]
R1 NNSSTRM;NNSStrm;c:\windows\system32\drivers\NNSStrm.sys [2012-11-28 218024]
R1 NNSTLSC;NNSTlsc;c:\windows\system32\drivers\NNStlsc.sys [2012-11-26 93096]
R1 PSINKNC;PSINKnc;c:\windows\system32\drivers\PSINKNC.sys [2012-11-9 178728]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-8-12 116608]
R2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\panda security\panda cloud antivirus\PSANHost.exe [2013-1-27 140512]
R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [2012-11-9 149288]
R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [2012-11-9 102184]
R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [2012-11-9 114216]
R2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [2012-11-9 123560]
R2 PSUAService;Panda Product Service;c:\program files\panda security\panda cloud antivirus\PSUAService.exe [2013-1-27 37088]
R2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]
R3 PSKMAD;PSKMAD;c:\windows\system32\drivers\PSKMAD.sys [2013-4-13 46672]
R3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2013-4-3 428160]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\3.0.318\McCHSvc.exe [2013-2-5 235216]
S3 NNSNAHS;Network Activity Hook Server Service;c:\windows\system32\drivers\NNSNAHS.sys [2012-10-22 38824]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\i:\ntglm7x.sys --> i:\NTGLM7X.sys [?]
S4 NNSPIHS;NNSPihs;c:\windows\system32\drivers\NNSpihs.sys [2012-11-26 51496]
.
=============== Created Last 30 ================
.
2013-04-14 15:33:44 -------- d-----w- c:\windows\ERUNT
2013-04-14 15:33:35 -------- d-----w- C:\JRT
2013-04-13 13:34:56 46672 ----a-w- c:\windows\system32\drivers\PSKMAD.sys
2013-04-10 06:57:19 23624 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2013-04-10 06:57:18 -------- d-----w- c:\program files\Hitman Pro 3.5
2013-04-10 06:57:11 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2013-04-09 11:15:19 -------- d-----w- C:\extensions
2013-04-09 11:13:27 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\ACD Systems
2013-04-09 11:13:27 -------- d-----w- c:\documents and settings\dalibor\application data\ACD Systems
2013-04-09 11:12:15 -------- d-----w- c:\documents and settings\all users\application data\ACD Systems
2013-04-09 11:12:08 -------- d-----w- c:\program files\common files\ACD Systems
2013-04-09 11:12:08 -------- d-----w- c:\program files\ACD Systems
2013-04-09 11:03:39 5888 ------w- c:\windows\system32\drivers\imagedrv.sys
2013-04-09 11:03:39 127488 ------w- c:\windows\system32\drivers\imagesrv.sys
2013-04-09 11:03:13 364544 ------w- c:\windows\system32\TwnLib4.dll
2013-04-09 11:03:12 471040 ------w- c:\windows\system32\ImagXRA7.dll
2013-04-09 11:03:12 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2013-04-09 11:03:11 476320 ------w- c:\windows\system32\ImagXpr7.dll
2013-04-09 11:03:11 262144 ------w- c:\windows\system32\ImagXR7.dll
2013-04-09 11:03:11 1568768 ------w- c:\windows\system32\ImagX7.dll
2013-04-09 11:03:10 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2013-04-08 17:46:51 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Identities
2013-04-08 16:50:50 -------- d-----w- c:\program files\Maxthon3
2013-04-06 06:46:11 -------- d-----w- c:\program files\FastStone Capture
2013-04-06 06:39:32 -------- d-----w- c:\program files\Defraggler
2013-04-05 07:31:04 5632 ----a-w- c:\windows\system32\ptpusb.dll
2013-04-05 07:31:03 159232 ----a-w- c:\windows\system32\ptpusd.dll
2013-04-05 07:31:03 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2013-04-05 07:31:03 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2013-04-04 13:00:48 630272 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2013-04-04 13:00:48 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2013-04-04 13:00:46 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2013-04-04 13:00:46 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2013-04-04 13:00:45 2004992 -c----w- c:\windows\system32\dllcache\iertutil.dll
2013-04-04 13:00:44 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2013-04-04 13:00:44 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2013-04-04 13:00:41 11111424 -c----w- c:\windows\system32\dllcache\ieframe.dll
2013-04-04 12:50:54 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll
2013-04-04 12:50:11 -------- d-----w- c:\windows\ie8updates
2013-04-04 12:49:27 99840 -c----w- c:\windows\system32\dllcache\srvsvc.dll
2013-04-04 12:48:54 75776 -c----w- c:\windows\system32\dllcache\strmfilt.dll
2013-04-04 12:48:53 265728 -c----w- c:\windows\system32\dllcache\http.sys
2013-04-04 12:48:53 25088 -c----w- c:\windows\system32\dllcache\httpapi.dll
2013-04-04 12:44:51 21336 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2013-04-04 12:38:50 -------- d-----w- c:\documents and settings\all users\application data\IObit
2013-04-04 12:32:57 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Yahoo
2013-04-04 12:17:58 -------- d-----w- c:\program files\Instant CD & DVD Burner
2013-04-04 12:16:21 -------- d-----w- c:\program files\MSECache
2013-04-04 12:14:15 -------- d-----w- C:\audiograbber
2013-04-04 12:12:43 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Adobe
2013-04-04 12:11:54 -------- d-----w- c:\program files\GRETECH
2013-04-04 12:09:22 -------- d-----w- c:\windows\Word 2 PDF
2013-04-04 12:09:22 -------- d-----w- c:\program files\Word 2 PDF
2013-04-04 11:58:52 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2013-04-04 11:58:51 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2013-04-04 11:58:47 -------- d-----w- c:\windows\Logs
2013-04-04 11:58:41 -------- d-----w- c:\program files\Winamp Detect
2013-04-04 11:58:18 819200 ----a-w- c:\program files\windows media player\wmsetsdk.exe
2013-04-04 11:58:18 47616 ----a-w- c:\program files\windows media player\msoobci.dll
2013-04-04 11:57:52 -------- d-----w- c:\windows\RegisteredPackages
2013-04-04 11:52:35 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Sun
2013-04-04 11:41:37 -------- d-----w- c:\documents and settings\dalibor\application data\SUPERAntiSpyware.com
2013-04-04 11:41:05 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-04-04 11:41:05 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2013-04-04 11:38:57 -------- d-----w- c:\documents and settings\dalibor\application data\IObit
2013-04-04 11:38:52 -------- d-----w- c:\program files\IObit
2013-04-04 11:35:28 861088 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-04-04 11:35:28 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-04-04 11:35:28 143872 ----a-w- c:\windows\system32\javacpl.cpl
2013-04-04 11:35:12 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-04-04 11:30:55 -------- d-----w- c:\documents and settings\all users\application data\McAfee Security Scan
2013-04-04 11:30:50 -------- d-----w- c:\program files\McAfee Security Scan
2013-04-04 11:30:47 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-04 11:30:47 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-04 09:19:20 -------- d-sh--w- c:\documents and settings\dalibor\IETldCache
2013-04-04 09:00:37 -------- dc-h--w- c:\windows\ie8
2013-04-04 08:36:35 -------- d-----w- c:\windows\system32\appmgmt
2013-04-04 08:28:30 -------- d-----w- c:\documents and settings\dalibor\application data\FastStone
2013-04-04 08:27:39 -------- d-----w- c:\documents and settings\dalibor\local settings\application data\Downloaded Installations
2013-04-04 06:11:54 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2013-04-04 06:11:28 456320 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2013-04-04 06:11:18 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2013-04-04 06:10:43 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2013-04-04 06:10:34 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys
2013-04-04 06:10:12 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2013-04-04 06:10:12 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2013-04-04 06:10:03 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2013-04-04 06:09:36 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2013-04-04 06:09:23 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2013-04-04 06:09:22 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys
2013-04-04 06:09:22 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys
2013-04-04 06:09:18 331776 -c----w- c:\windows\system32\dllcache\msadce.dll
2013-04-04 06:08:23 536576 -c----w- c:\windows\system32\dllcache\msado15.dll
2013-04-04 06:07:38 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2013-04-04 06:07:37 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2013-04-04 06:07:37 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2013-04-04 06:07:37 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2013-04-04 06:07:37 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2013-04-04 06:07:37 110592 -c----w- c:\windows\system32\dllcache\services.exe
2013-04-04 06:07:36 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2013-04-04 06:07:30 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2013-04-04 06:05:53 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2013-04-04 06:05:15 290560 -c----w- c:\windows\system32\dllcache\atmfd.dll
2013-04-04 06:04:41 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2013-04-04 06:04:39 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2013-04-03 22:54:45 -------- d-----w- c:\windows\system32\PreInstall
2013-04-03 22:54:43 -------- d--h--w- c:\windows\$hf_mig$
2013-04-03 22:49:41 -------- d-----w- c:\program files\Yahoo!
2013-04-03 22:09:27 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2013-04-03 22:08:41 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2013-04-03 22:07:57 74240 ----a-w- c:\windows\system32\usbui.dll
2013-04-03 22:07:22 -------- d-----r- c:\program files\Skype
2013-04-03 22:05:49 -------- d-----w- C:\Documents and Settings
.
==================== Find3M ====================
.
2013-04-03 20:54:56 315392 ----a-w- c:\windows\HideWin.exe
2013-03-25 20:39:46 4546560 ----a-w- c:\windows\system32\GPhotos.scr
2013-03-08 08:36:22 293376 ----a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32:25 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50:30 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-02 02:06:31 916480 ----a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06:30 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25:02 1867264 ----a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08:47 385024 ----a-w- c:\windows\system32\html.iec
2013-02-27 07:56:51 2067456 ----a-w- c:\windows\system32\mstscax.dll
2013-02-12 00:32:23 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-12 00:32:23 12928 ------w- c:\windows\system32\drivers\usb8023x.sys
2013-01-26 03:55:44 552448 ----a-w- c:\windows\system32\oleaut32.dll
.
============= FINISH: 17:50:23,73 ===============

Poslao: 14 Apr 2013 18:19
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Ok, idemo dalje;

Korak#1


Otvori Notepad i kopiraj sljedeći tekst:


@ECHO OFF
IF EXIST log.txt DEL log.txt
ECHO Deleting Folders>>log.txt
FOR %%i in (
"c:\program files\IObit"
"c:\documents and settings\all users\application data\IObit") DO (
IF EXIST %%i (
RD /S /Q %%i
IF EXIST %%i (
ECHO %%i not deleted>>log.txt
) ELSE (
ECHO %%i deleted successfully>>log.txt)
) ELSE (
ECHO %%i not found>>log.txt))

START NOTEPAD.EXE log.txt
DEL %0


Snimi ga na Desktop pod imenom fix.bat
Obrati pažnju na ekstenziju .bat

Pokreni fix.bat i kopiraj u poruku tekst koji će ti se otvoriti u Notepad-u.



*******************************

Korak#2


Arrow Idemo na dodatnu antirootkit proveru:


Preuzmite program GMER sa donjeg linka na Desktop:


GMER download
Kliknite dati link;
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberite Desktop i kliknite Save.


Dvoklikom pokrenite GMER.
Sačekajte da se završi uvodno skeniranje - ukoliko se pojavi bilo kakav upit, kliknite No;

kliknite Scan i sačekajte da skeniranje bude završeno;

kliknite Save ... - izveštaj sačuvajte na Desktop (pod nazivom Gmer1);

kliknite desnim tasterom u prozor programa Gmer i odaberite Options > 3rd party - kliknite Scan;

po završetku skeniranja kliknite Save ... - izveštaj sačuvajte na Desktop (pod nazivom Gmer2);

Priložite oba izveštaja uz poruku korišćenjem opcije Prikači fajl.

Poslao: 15 Apr 2013 08:58
Idi na vrh
offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 445
  • Gde živiš: Landau and der Pfalz

Ako moze da mi pojasnis malo bolje ovaj prvi korak u upustvu,nemogu da se snadjem!

Hvala !

Poslao: 15 Apr 2013 12:40
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Bilo je potrebno je da napravis batch file, evo ja sam ga napravio umesto tebe.
https://www.mycity.rs/must-login.png
Pokreni ga dvoklikom, cmd prozor ce bljesnuti i otvoriti notepad sa izvestajem. Kopiraj taj izvestaj ovde.
ako se ne snadjes, preskoci taj korak, predji na gmer

> Potom postavi mi Gmer1 i Gmer2 izvestaje.

Poslao: 15 Apr 2013 17:00
Idi na vrh
offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 445
  • Gde živiš: Landau and der Pfalz

Deleting Folders
"c:\program files\IObit" deleted successfully
"c:\documents and settings\all users\application data\IObit" deleted successfully


Gmer sa pokretao i nemogu da do kraja iskeniram iskljucivao sam i antivirus ali nevredi

Poslao: 15 Apr 2013 18:27
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Po fotki ja vidim da je Gmer zavrsio skeniranje. Klikni Save > sacuvaj izvestaj kao Gmer1 log na Desktop. Kakav god da je log, samo ga prosledi.
Odradi i Gmer2 log i okaci te logove ...






Daj 'bwe', nije to nista tesko. Razz

Poslao: 16 Apr 2013 10:15
Idi na vrh
offline
  • Dalibor
  • Pridružio: 03 Feb 2011
  • Poruke: 445
  • Gde živiš: Landau and der Pfalz

Evo snasao sam se i prilazem logove Gmer1 i Gmer2 Wink

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

Poslao: 16 Apr 2013 19:45
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

To je to, ne vidim aktivan malware. Tvoj sistem je cist ...


Rucno obrisi koriscene programe ( JRT; DDS; Gmer).

Ponovo pokreni AdwCleaner
Klikni na dugme [Uninstall] i pricekaj da se postupak uninstallacije zavrsi.

---- ---- ---- ---- ---- ---- ---- ---- ----

Arrow Proveri da li su tvoje aplikacije ažurirane, preko Secunia Online Scannera:


Poseti ovaj sajt: Online Software Inspector (OSI)

Klikni na dugme Start Scanner.
Dozvoli pokretanje Jave i po potrebi pričekaj Status/Currently proces.

Klikni na dugme Start da bi započeo analizu.
Vreme skeniranja ne bi trebalo da traje duže od jedne minute.

Kada se završi analiza, ispod sekcije Programs / Result: izlistaće se neažurirane aplikacije kao i download linkovi za preuzimanje ažurnih verzija.

Preuzmi i instaliraj navedena ažuriranja/aplikacije.

---- ---- ---- ---- ---- ---- ---- ---- ----

Idea Preporučujem ti da koristiš program MCShield za zaštitu USB memorijskih uređaja.

Program možeš preuzeti sa OVOG linka. Nakon instalacije programa, priključi USB memorijske uređaje, i oni će biti skenirani. Na kraju skeniranja ćeš dobiti izveštaj da je uređaj čist ili obaveštenje o uklonjenom malware-u.


Idea Takođe, poseti ovu temu da vidiš da li ti je pretraživač ranjiv i instaliraš ažurirane komponente
http://www.mycity.rs/Propusti-i-azuriranja/Testira.....anjiv.html

MyCity » Ambulanta -> Arhiva Ambulante » Superantispyware mi detektovao virus PUP.MyWebsearch

Ko je trenutno na forumu
 

Ukupno su 1021 korisnika na forumu :: 57 registrovanih, 3 sakrivenih i 961 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Acivi, ajo baba, Alibaba1981, amstel2, babaroga, BlekMen, bojank, bojcistv, BORUTUS, cavatina, ccoogg123, darcaud, Darko8, deimos25, Denaya, Dimitrije Paunovic, Dimitrise93, djboj, doklevise, doktor1964, Dorcolac, dragoljub11987, drimer, GenZee, gomago, hologram, hyla, Ivica1102, Kaplar2, karevski, kjkszpj, kokodakalo, Koridor, krkalon, MaksicZoran, Marko Marković, mercedesamg, Metanoja, milenko crazy north, Misirac, nemkea71, nextyamb, novator, oldtimer, procesor, Romibrat, royst33, ruma, S2M, Simon simonović, Stoilkovic, suton, vathra, virked, Vlada1389, Webb, šumar bk2