Task manager i registy editing has been disabled

3

Task manager i registy editing has been disabled

offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Hajde ponovi skeniranje dr.Web CureIt-om i postavi ovde log skeniranja.

offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

Sad nece ni to.....na pola skeniranja plavi ekran i restart!

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Da li je nešto detektovao dok je radio?


Restartuj PC i postavi svež Gmer: Rootkit/Malware log.

offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-27 21:18:29
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT d347bus.sys (PnP BIOS Extension/ ) ZwClose [0xBA679818]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwCreateKey [0xBA6797D0]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwCreatePagingFile [0xBA66DA20]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwEnumerateKey [0xBA66E2A8]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwEnumerateValueKey [0xBA679910]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwOpenKey [0xBA679794]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwQueryKey [0xBA66E2C8]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwQueryValueKey [0xBA679866]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwSetSystemPowerState [0xBA6790B0]
SSDT sphn.sys ZwSetValueKey [0xBA6C919A]

INT 0x62 ? 8A822BF8
INT 0x63 ? 8A50ABF8
INT 0x73 ? 8A822BF8
INT 0x73 ? 8A822BF8
INT 0x73 ? 8A893BF8
INT 0x73 ? 8A50ABF8
INT 0x73 ? 8A822BF8
INT 0x82 ? 8A822BF8
INT 0x83 ? 8A50ABF8
INT 0x94 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8

---- Kernel code sections - GMER 1.0.14 ----

? sphn.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload B8F9D8AC 5 Bytes JMP 8A50A1D8
? C:\WINDOWS\system32\drivers\kkjpp.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.14 ----

.text D:\live\Windows Live\Messenger\msnmsgr.exe[980] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 5 Bytes JMP 0056DBBD D:\live\Windows Live\Messenger\msnmsgr.exe (Windows Live Messenger/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6BBD92] sphn.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A8201F8
Device \FileSystem\Ntfs \Ntfs 8A77A280
Device \FileSystem\Fastfat \FatCdrom 8A123500
Device \FileSystem\Fastfat \FatCdrom 8A0CCB88
Device \FileSystem\Udfs \UdfsCdRom 8961F1F8
Device \FileSystem\Udfs \UdfsCdRom 8A60DC58
Device \FileSystem\Udfs \UdfsDisk 8961F1F8
Device \FileSystem\Udfs \UdfsDisk 8A60DC58

AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)

Device \Driver\usbuhci \Device\USBPDO-0 8A5091F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A8911F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A8911F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A8911F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A8911F8
Device \Driver\usbuhci \Device\USBPDO-1 8A5091F8
Device \Driver\usbuhci \Device\USBPDO-2 8A5091F8
Device \Driver\usbehci \Device\USBPDO-3 8A4D91F8
Device \Driver\usbuhci \Device\USBPDO-4 8A5091F8

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

Device \Driver\usbuhci \Device\USBPDO-5 8A5091F8
Device \Driver\usbuhci \Device\USBPDO-6 8A5091F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\usbehci \Device\USBPDO-7 8A4D91F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\Cdrom \Device\CdRom0 8A2212A0
Device \FileSystem\Rdbss \Device\FsWrap 8A07C790
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\Cdrom \Device\CdRom1 8A2212A0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A27B190
Device \Driver\atapi \Device\Ide\IdePort0 8A27B190
Device \Driver\atapi \Device\Ide\IdePort1 8A27B190
Device \Driver\atapi \Device\Ide\IdePort2 8A27B190
Device \Driver\atapi \Device\Ide\IdePort3 8A27B190
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-10 8A27B190
Device \Driver\Ftdisk \Device\HarddiskVolume4 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\Ftdisk \Device\HarddiskVolume5 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\NetBT \Device\NetBT_Tcpip_{DAE50B85-7031-49ED-B3B3-EE6BD618DB5E} 89FAA500
Device \Driver\NetBT \Device\NetBt_Wins_Export 89FAA500
Device \Driver\NetBT \Device\NetbiosSmb 89FAA500
Device \Driver\usbhub \Device\00000092 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\NetBT \Device\NetBT_Tcpip_{D9516BC9-0F7C-4CD7-B884-86DBDAB7FDE8} 89FAA500
Device \Driver\usbhub \Device\00000093 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000094 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Srv \Device\LanmanServer 8A0C1308
Device \Driver\usbhub \Device\00000095 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\NetBT \Device\NetBT_Tcpip_{EBE1A9A0-31A4-42EF-A421-FEC25EA4AB54} 89FAA500

AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

Device \Driver\usbuhci \Device\USBFDO-0 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-1 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-2 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A3072E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A071BE8
Device \Driver\usbehci \Device\USBFDO-3 8A4D91F8
Device \Driver\usbehci \Device\USBFDO-3 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A3072E8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A071BE8
Device \FileSystem\Npfs \Device\NamedPipe 89FF1150
Device \Driver\usbuhci \Device\USBFDO-4 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-4 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\Ftdisk \Device\FtControl 8A8231F8
Device \Driver\usbuhci \Device\USBFDO-5 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-5 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\NetBT \Device\NetBT_Tcpip_{E12A78D5-456D-4396-9125-6F2025FE350F} 89FAA500
Device \FileSystem\Msfs \Device\Mailslot 8A310030
Device \Driver\usbuhci \Device\USBFDO-6 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-6 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbehci \Device\USBFDO-7 8A4D91F8
Device \Driver\usbehci \Device\USBFDO-7 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\0000008c hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\d347prt \Device\Scsi\d347prt1Port5Path0Target0Lun0 8A28B6F0
Device \Driver\JRAID \Device\Scsi\JRAID1 8A8901F8
Device \Driver\d347prt \Device\Scsi\d347prt1 8A28B6F0
Device \Driver\usbhub \Device\0000008d hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Fastfat \Fat 8A123500
Device \FileSystem\Fastfat \Fat 8A0CCB88

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer 8A1588D8
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer 8A1588D8
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer 8A1588D8
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer 8A1588D8
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer 8A1588D8
Device \FileSystem\Cdfs \Cdfs 89FCD500
Device \FileSystem\Cdfs \Cdfs 8A2CAAF8

---- Modules - GMER 1.0.14 ----

Module _________ BA5D0000-BA5E8000 (98304 bytes)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF9 0x9E 0xD1 0x91 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xAD 0xBA 0xD2 0xA1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x5C 0x0B 0xA5 0xF0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x19 0xD8 0x1A 0x54 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40@khjeh 0x20 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40@hj34z0 0x42 0x57 0x6D 0xA1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF9 0x9E 0xD1 0x91 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF9 0x9E 0xD1 0x91 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

---- Files - GMER 1.0.14 ----

File C:\Documents and Settings\veljko™\My Documents\Downloads\Adobe Fireworks CS4 v10.0 [RH]\Adobe CS4 Master Collection - (zabranjeno)s only [RH]\ACS4MC- Keygen (X-FORCE)\Keygen\Script blocker\Extra Script Block\Block Adobe Activation.app\Contents\Resources\description.rtfd\TXT.rtf 101 bytes
File C:\Documents and Settings\veljko™\My Documents\Downloads\Adobe Fireworks CS4 v10.0 [RH]\Adobe CS4 Master Collection - (zabranjeno)s only [RH]\ACS4MC- Keygen (X-FORCE)\Keygen\Script blocker\Extra Script Block\__MACOSX\Block Adobe Activation.app\Contents\Resources\Scripts\._main.scpt 82 bytes

---- EOF - GMER 1.0.14 ----

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:

Files to delete:
C:\WINDOWS\system32\drivers\kkjpp.sys

Drivers to delete:
asc3360pr


Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati (u određenim slučajevima: dva puta) i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u

Iskopiraj sadržaj dobijenog loga u temu na forumu.

offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

evo ga
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "dupv" found!
Could not open driver dupv for rootkit scan. Error:c0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Rootkit scan completed.


Error: file "C:\WINDOWS\system32\drivers\kkjpp.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\kkjpp.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\asc3360pr" not found!
Deletion of driver "asc3360pr" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Hajde daj još (samo) jedan svež Gmer Rootkit/malware log.

offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-27 22:49:38
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT d347bus.sys (PnP BIOS Extension/ ) ZwClose [0xBA679818]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwCreateKey [0xBA6797D0]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwCreatePagingFile [0xBA66DA20]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwEnumerateKey [0xBA66E2A8]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwEnumerateValueKey [0xBA679910]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwOpenKey [0xBA679794]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwQueryKey [0xBA66E2C8]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwQueryValueKey [0xBA679866]
SSDT d347bus.sys (PnP BIOS Extension/ ) ZwSetSystemPowerState [0xBA6790B0]
SSDT spww.sys ZwSetValueKey [0xBA6C919A]

INT 0x62 ? 8A822BF8
INT 0x63 ? 8A50ABF8
INT 0x73 ? 8A822BF8
INT 0x73 ? 8A822BF8
INT 0x73 ? 8A893BF8
INT 0x73 ? 8A50ABF8
INT 0x73 ? 8A822BF8
INT 0x82 ? 8A822BF8
INT 0x83 ? 8A50ABF8
INT 0x94 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8
INT 0xB4 ? 8A50ABF8

---- Kernel code sections - GMER 1.0.14 ----

? spww.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload B8EDC8AC 5 Bytes JMP 8A50A1D8

---- User code sections - GMER 1.0.14 ----

.text D:\live\Windows Live\Messenger\msnmsgr.exe[964] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 5 Bytes JMP 0056DBBD D:\live\Windows Live\Messenger\msnmsgr.exe (Windows Live Messenger/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6BBD92] spww.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A8201F8
Device \FileSystem\Ntfs \Ntfs 8A7426F0
Device \FileSystem\Fastfat \FatCdrom 8A0944D8
Device \FileSystem\Fastfat \FatCdrom 89FCE0B8

AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)

Device \Driver\usbuhci \Device\USBPDO-0 8A5091F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A8911F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A8911F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A8911F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A8911F8
Device \Driver\usbuhci \Device\USBPDO-1 8A5091F8
Device \Driver\usbuhci \Device\USBPDO-2 8A5091F8
Device \Driver\usbehci \Device\USBPDO-3 8A4D81F8
Device \Driver\usbuhci \Device\USBPDO-4 8A5091F8

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

Device \Driver\usbuhci \Device\USBPDO-5 8A5091F8
Device \Driver\IpFilterDriver \Device\IPFILTERDRIVER B4EF12B4
Device \Driver\usbuhci \Device\USBPDO-6 8A5091F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\usbehci \Device\USBPDO-7 8A4D81F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\Cdrom \Device\CdRom0 8A274008
Device \FileSystem\Rdbss \Device\FsWrap 89F6B4B8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\Cdrom \Device\CdRom1 8A274008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8A23E8A0
Device \Driver\atapi \Device\Ide\IdePort0 8A23E8A0
Device \Driver\atapi \Device\Ide\IdePort1 8A23E8A0
Device \Driver\atapi \Device\Ide\IdePort2 8A23E8A0
Device \Driver\atapi \Device\Ide\IdePort3 8A23E8A0
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-10 8A23E8A0
Device \Driver\Ftdisk \Device\HarddiskVolume4 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\Ftdisk \Device\HarddiskVolume5 8A8231F8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\NetBT \Device\NetBT_Tcpip_{DAE50B85-7031-49ED-B3B3-EE6BD618DB5E} 89FBA500
Device \Driver\NetBT \Device\NetBt_Wins_Export 89FBA500
Device \Driver\usbhub \Device\00000091 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\NetBT \Device\NetbiosSmb 89FBA500
Device \Driver\usbhub \Device\00000092 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\NetBT \Device\NetBT_Tcpip_{D9516BC9-0F7C-4CD7-B884-86DBDAB7FDE8} 89FBA500
Device \Driver\usbhub \Device\00000093 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\00000094 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Srv \Device\LanmanServer 8A16E320
Device \Driver\NetBT \Device\NetBT_Tcpip_{EBE1A9A0-31A4-42EF-A421-FEC25EA4AB54} 89FBA500

AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)

Device \Driver\usbuhci \Device\USBFDO-0 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-1 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-2 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A087500
Device \Driver\usbehci \Device\USBFDO-3 8A4D81F8
Device \Driver\usbehci \Device\USBFDO-3 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A087500
Device \Driver\usbuhci \Device\USBFDO-4 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-4 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Npfs \Device\NamedPipe 8A2C9500
Device \Driver\Ftdisk \Device\FtControl 8A8231F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{E12A78D5-456D-4396-9125-6F2025FE350F} 89FBA500
Device \Driver\usbuhci \Device\USBFDO-5 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-5 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Msfs \Device\Mailslot 8A2D0C48
Device \Driver\asc3360pr \Device\asc3360pr BAE165A0
Device \Driver\usbuhci \Device\USBFDO-6 8A5091F8
Device \Driver\usbuhci \Device\USBFDO-6 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\0000008b hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbehci \Device\USBFDO-7 8A4D81F8
Device \Driver\usbehci \Device\USBFDO-7 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbhub \Device\0000008c hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\d347prt \Device\Scsi\d347prt1Port5Path0Target0Lun0 8A2DB820
Device \Driver\JRAID \Device\Scsi\JRAID1 8A8901F8
Device \Driver\d347prt \Device\Scsi\d347prt1 8A2DB820
Device \Driver\usbhub \Device\0000008d hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\Fastfat \Fat 8A0944D8
Device \FileSystem\Fastfat \Fat 89FCE0B8

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer 8A2D3380
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer 8A2D3380
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer 8A2D3380
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer 8A2D3380
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer 8A2D3380
Device \FileSystem\Cdfs \Cdfs 8A13F500
Device \FileSystem\Cdfs \Cdfs 89F463C8

---- Modules - GMER 1.0.14 ----

Module _________ BA5D0000-BA5E8000 (98304 bytes)

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF9 0x9E 0xD1 0x91 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xAD 0xBA 0xD2 0xA1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x5C 0x0B 0xA5 0xF0 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x19 0xD8 0x1A 0x54 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40@khjeh 0x20 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40@hj34z0 0x3A 0x7A 0x10 0x63 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF9 0x9E 0xD1 0x91 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF9 0x9E 0xD1 0x91 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000

---- Files - GMER 1.0.14 ----

File C:\Documents and Settings\veljko™\My Documents\Downloads\Adobe Fireworks CS4 v10.0 [RH]\Adobe CS4 Master Collection - (zabranjeno)s only [RH]\ACS4MC- Keygen (X-FORCE)\Keygen\Script blocker\Extra Script Block\Block Adobe Activation.app\Contents\Resources\description.rtfd\TXT.rtf 101 bytes
File C:\Documents and Settings\veljko™\My Documents\Downloads\Adobe Fireworks CS4 v10.0 [RH]\Adobe CS4 Master Collection - (zabranjeno)s only [RH]\ACS4MC- Keygen (X-FORCE)\Keygen\Script blocker\Extra Script Block\__MACOSX\Block Adobe Activation.app\Contents\Resources\Scripts\._main.scpt 82 bytes

---- EOF - GMER 1.0.14 ----

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Reci mi kakvo je sada stanje.

Ko je trenutno na forumu
 

Ukupno su 677 korisnika na forumu :: 23 registrovanih, 6 sakrivenih i 648 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: baza, Boris90, BraneS, Cufo, flash12, Jovan Nenad, Leonardo, Libertas, Misirac, mk, mushroom, pein, Polemarchoi, roka79, rovac, ruso, S2M, sale755, srecko81, Steeeefan, uhogrlonos, VJ, Zi0mek