Virusi

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 16 Mar 2016 19:58

Problem je nastao juče kada sam po internetu pretraživao programe.Napalo me više tipova virusa,skenirao sa spy hunterom i on mi posle skeniranja uporno ide na restart i posle restarta sj..o računar.Do pre pola sata nisam mogo ni da upalim računar,problem je bio u boot sektoru.Probao sa razne programe i na kraju iz cmd-a uspeo da upalim računar.
Spybot mi našao neverovatnih nekoliko hiljada problema..Uspeo sam i 2 fleške da zarazim i to odlično,sa ms shildom jedva sredio.E sad pogledajte log jer mi antivirus stalno nešto izbacuje.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Hranca (administrator) on HRANCA-PC (16-03-2016 19:48:22)
Running from C:\Users\Hranca\Desktop
Loaded Profiles: Hranca (Available Profiles: Hranca)
Platform: Windows 7 Ultimate (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: [Link mogu videti samo ulogovani korisnici]

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(ClanServers Hosting LLC) C:\Program Files (x86)\GameTracker\GSInGameService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
() C:\Program Files (x86)\ZTE Join Air\AssistantServices.exe
(Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
(MyCity) C:\Program Files (x86)\MCShield\MCShieldRTM.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7833120 2009-05-23] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5595848 2015-07-08] (ESET)
HKLM\...\Policies\Explorer\Run: [1763311169] => C:\ProgramData\msndzjj.exe [68385536 2009-07-14] ()
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\Run: [{FFB5E17E-AC0F-44C6-89D7-EE0C0C709CF6}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\XIVNTI').JGCKFJMGMD)));
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\Run: [MCShield Monitor] => C:\Program Files (x86)\MCShield\mcshieldrtm.exe [650816 2014-04-11] (MyCity)
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {9e1da422-da21-11e4-ad16-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {9e1da4b0-da21-11e4-ad16-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {cbb27afe-1cfc-11e5-9c45-0022158832e8} - F:\Setup.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {d4edc13f-6ff2-11e5-a6cf-0022158832e8} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Install_driver
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {ed56db45-da07-11e4-a2ba-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {f04c3943-94b5-11e4-b748-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {f04c395e-94b5-11e4-b748-0022158832e8} - F:\Autorun.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 192.168.1.1
Tcpip\..\Interfaces\{D0A0AF1D-E6E6-40D8-8B24-6AFCB0526CF8}: [DhcpNameServer] 8.8.8.8 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = [Link mogu videti samo ulogovani korisnici]
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1293919426-2142621105-2511924792-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-02-21] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-02-21] (Oracle Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-11] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-11] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2015-02-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-02-21] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-03-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-02-26] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Profile 9 -> [Link mogu videti samo ulogovani korisnici]
CHR StartupUrls: Profile 9 -> "hxxp://www.google.rs/","hxxp://mystart.incredibar.com/mb178?a=6PQKupxmne&i=26","hxxp://mystart.incredibar.com/mb201?a=6PQVF0H2ju&i=26"
CHR Profile: C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 6
CHR Extension: (Google документи) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-21]
CHR Extension: (Adblock Plus) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-03-11]
CHR Extension: (AdBlock) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-03-31]
CHR Extension: (Google новчаник) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 6\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-03]
CHR Profile: C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7
CHR Extension: (Google презентације) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-03]
CHR Extension: (Google документи) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-03]
CHR Extension: (Google диск) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-04-03]
CHR Extension: (YouTube) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-04-03]
CHR Extension: (Google Search) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-03]
CHR Extension: (Google табеле) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-03]
CHR Extension: (Google новчаник) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-04-03]
CHR Extension: (Gmail) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 7\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-03]
CHR Profile: C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8
CHR Extension: (Google документи) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\aohghmighlieiainnegkcijnfilokake [2015-04-03]
CHR Extension: (Google диск) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Adblock Plus) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-09]
CHR Extension: (Google Search) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Unfriend Notify for Facebook) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\fpmgjphoccjhianiglkbcajadaaaonge [2016-03-14]
CHR Extension: (Google документи офлајн) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-03-11]
CHR Extension: (Плаћања у Chrome веб-продавници) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR Extension: (Gmail) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 8\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-03]
CHR Profile: C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9
CHR Extension: (Google документи) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-16]
CHR Extension: (Google диск) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-16]
CHR Extension: (YouTube) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-16]
CHR Extension: (Adblock Plus) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-16]
CHR Extension: (Google документи офлајн) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
CHR Extension: (AdBlock) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-03-16]
CHR Extension: (Плаћања у Chrome веб-продавници) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-03-16]
CHR Extension: (Gmail) - C:\Users\Hranca\AppData\Local\Google\Chrome\User Data\Profile 9\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-16]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1353720 2015-07-08] (ESET)
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2014-12-17] () [File not signed]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-12-17] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5495056 2015-06-18] (TeamViewer GmbH)
R2 UI Assistant Service; C:\Program Files (x86)\ZTE Join Air\AssistantServices.exe [241664 2009-03-24] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 afoir; C:\ProgramData\\afoir\\afoir.exe -f "C:\ProgramData\\afoir\\afoir.dat" -l -a

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-13] (ESET)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-13] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [231520 2015-07-13] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [53360 2015-07-13] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [72400 2015-07-13] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [146928 2010-08-26] (CyberLink Corp.)
S3 cpuz134; \??\C:\Users\Hranca\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 esgiguard; \??\C:\Program Files (x86)\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 massfilter; system32\DRIVERS\massfilter.sys [X]
S3 motandroidusb; System32\Drivers\motoandroid.sys [X]
S3 XFDriver64; \??\C:\Program Files (x86)\Xfire2\XFDriver64.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-16 19:48 - 2016-03-16 19:48 - 00016870 _____ C:\Users\Hranca\Desktop\FRST.txt
2016-03-16 19:48 - 2016-03-16 19:48 - 00000000 ____D C:\FRST
2016-03-16 19:47 - 2016-03-16 19:47 - 02374144 _____ (Farbar) C:\Users\Hranca\Desktop\FRST64.exe
2016-03-16 19:41 - 2016-03-16 19:44 - 00000000 ____D C:\ProgramData\MCShield
2016-03-16 19:41 - 2016-03-16 19:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
2016-03-16 19:41 - 2016-03-16 19:41 - 00000000 ____D C:\Program Files (x86)\MCShield
2016-03-16 19:40 - 2016-03-16 19:41 - 02856736 _____ (MyCity) C:\Users\Hranca\Downloads\MCShield-Setup.exe
2016-03-16 19:25 - 2016-03-16 19:25 - 00383592 __RSH C:\gdrop
2016-03-16 19:25 - 2016-03-16 19:25 - 00171136 __RSH C:\xeldr
2016-03-16 19:25 - 2016-03-16 19:25 - 00008192 _____ C:\bootsect.lxe.bak
2016-03-16 18:58 - 2016-03-16 19:29 - 00002261 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-16 18:57 - 2016-03-16 19:32 - 00000928 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-16 18:57 - 2016-03-16 19:02 - 00000932 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-16 18:57 - 2016-03-16 18:57 - 00003928 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-03-16 18:57 - 2016-03-16 18:57 - 00003676 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-03-16 18:45 - 2016-03-16 18:46 - 00001040 _____ C:\Users\Hranca\malvare.txt
2016-03-16 18:30 - 2016-03-16 19:29 - 00001100 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-03-16 18:30 - 2016-03-16 18:31 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-16 18:30 - 2016-03-16 18:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-03-16 18:30 - 2016-03-16 18:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-03-16 18:30 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-03-16 18:30 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-03-16 18:30 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-03-16 18:28 - 2016-03-16 18:29 - 22908888 _____ (Malwarebytes ) C:\Users\Hranca\Downloads\mbam-setup-org-2.2.0.1024.exe
2016-03-16 18:13 - 2016-03-16 19:27 - 00000000 ____D C:\ProgramData\afoir
2016-03-16 17:57 - 2016-03-16 17:57 - 00000000 ____D C:\boot-sav
2016-03-15 19:26 - 2016-03-15 19:26 - 00340170 _____ C:\Users\Hranca\Downloads\n1.pdf
2016-03-15 19:24 - 2016-03-15 19:24 - 03667302 _____ C:\Users\Hranca\Downloads\1.bmp
2016-03-15 19:24 - 2016-03-15 19:24 - 03596454 _____ C:\Users\Hranca\Downloads\2.bmp
2016-03-15 19:24 - 2016-03-15 19:24 - 00000020 _____ C:\Users\Hranca\pdf2wordocr.ini
2016-03-15 18:23 - 2016-03-15 18:23 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\Free PDF to Word Converter
2016-03-15 18:09 - 2016-03-15 19:24 - 00000567 _____ C:\Windows\docimg.INI
2016-03-15 18:00 - 2016-03-15 18:00 - 06775152 _____ C:\Users\Hranca\Downloads\conver1.pdf
2016-03-15 17:58 - 2016-03-15 17:59 - 00000000 ____D C:\Users\Hranca\Downloads\New folder
2016-03-15 17:57 - 2016-03-15 17:57 - 00000000 ____D C:\Users\Hranca\AppData\Local\Spoon
2016-03-15 17:57 - 2011-12-09 08:56 - 01931256 _____ (Codejock Software) C:\Windows\SysWOW64\Codejock.Controls.Unicode.v15.2.1.ocx
2016-03-15 17:57 - 2011-12-09 08:56 - 00587768 _____ (Codejock Software) C:\Windows\SysWOW64\Codejock.SkinFramework.Unicode.v15.2.1.ocx
2016-03-15 17:57 - 2011-12-09 08:55 - 02775032 _____ (Codejock Software) C:\Windows\SysWOW64\Codejock.CommandBars.Unicode.v15.2.1.ocx
2016-03-15 17:57 - 2009-12-29 11:35 - 02536072 _____ (gdpicture.com) C:\Windows\SysWOW64\gdpicturepro5.ocx
2016-03-15 17:57 - 2009-12-29 11:35 - 02524808 _____ (gdpicture.com) C:\Windows\SysWOW64\gdimgplug.dll
2016-03-15 17:37 - 2016-03-15 17:37 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\Mozilla
2016-03-15 17:36 - 2016-03-16 19:27 - 00000000 ____D C:\Program Files\BitTorrent
2016-03-15 17:36 - 2016-03-15 17:36 - 07600640 _____ C:\Users\Hranca\AppData\Roaming\agent.dat
2016-03-15 17:36 - 2016-03-15 17:36 - 01787087 _____ C:\Users\Hranca\AppData\Roaming\Zuntax.tst
2016-03-15 17:36 - 2016-03-15 17:36 - 00072715 _____ C:\Users\Hranca\AppData\Roaming\BlackRonbam.tst
2016-03-15 17:36 - 2016-03-15 17:36 - 00018432 _____ C:\Users\Hranca\AppData\Roaming\Main.dat
2016-03-15 17:35 - 2016-03-15 17:35 - 00127488 _____ C:\Users\Hranca\AppData\Roaming\Installer.dat
2016-03-15 17:33 - 2016-03-15 17:33 - 00000000 ____D C:\extensions
2016-03-15 17:32 - 2016-03-15 17:33 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-03-15 17:09 - 2016-03-15 17:42 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\Soft Solutions
2016-03-15 17:09 - 2010-05-05 10:49 - 00978624 _____ (Dosadi (www.dosadi.com)) C:\Windows\SysWOW64\Eztwain3.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00978624 _____ (Dosadi (www.dosadi.com)) C:\Windows\Eztwain3.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00458432 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZTiff.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00458432 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZTiff.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00396984 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZPdf.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00396984 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZPdf.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00356024 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZPng.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00356024 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZPng.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00290496 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZCurl.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00290496 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZCurl.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00274112 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZJpeg.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00274112 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZJpeg.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00233152 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZSymbol.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00233152 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZSymbol.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00229048 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZGif.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00229048 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZGif.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00171704 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZOcr.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00171704 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\SysWOW64\EZDcx.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00171704 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZOcr.dll
2016-03-15 17:09 - 2010-05-05 10:49 - 00171704 _____ (Dosadi LLC (www.dosadi.com)) C:\Windows\EZDcx.dll
2016-03-15 17:09 - 2006-12-01 23:26 - 02404352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc80d.dll
2016-03-15 17:09 - 2006-12-01 21:03 - 01175552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr80d.dll
2016-03-15 17:09 - 2006-12-01 21:03 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp80d.dll
2016-03-15 17:09 - 2005-02-28 21:08 - 00901120 _____ C:\Windows\SysWOW64\ctocr32.dll
2016-03-15 17:09 - 2005-02-10 16:03 - 00245408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unicows.dll
2016-03-15 17:09 - 2004-12-21 23:02 - 00053248 _____ C:\Windows\SysWOW64\ctocrc32.dll
2016-03-15 17:09 - 2004-05-04 09:53 - 01645320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2016-03-15 17:09 - 2003-03-19 05:28 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71d.dll
2016-03-15 17:09 - 2003-03-19 04:03 - 00544768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71d.dll
2016-03-15 17:09 - 2003-03-18 21:20 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFC71.dll
2016-03-15 17:09 - 2002-01-05 11:54 - 01933312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc70d.dll
2016-03-15 17:09 - 2002-01-05 10:16 - 00536576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr70d.dll
2016-03-15 15:01 - 2016-03-15 15:35 - 00000075 _____ C:\Users\Hranca\Desktop\New Text Document (3).txt
2016-03-14 16:19 - 2016-03-14 16:19 - 03002192 _____ C:\Users\Hranca\Downloads\MR - Evaluacija radnog ucinka i upravljanje radnom efektivnoscu.pdf
2016-03-14 15:38 - 2016-03-14 15:38 - 00473267 _____ C:\Users\Hranca\Desktop\11.7.pdf
2016-03-12 19:17 - 2016-03-16 19:29 - 00002204 _____ C:\Users\Public\Desktop\CyberLink PowerDVD 10.lnk
2016-03-12 19:17 - 2016-03-12 19:20 - 00000000 ____D C:\ProgramData\CyberLink
2016-03-12 19:17 - 2016-03-12 19:17 - 00000000 ____D C:\Users\Hranca\Documents\CyberLink
2016-03-12 19:17 - 2016-03-12 19:17 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\CyberLink
2016-03-12 19:17 - 2016-03-12 19:17 - 00000000 ____D C:\Users\Hranca\AppData\Local\Cyberlink
2016-03-12 19:15 - 2016-03-12 19:17 - 00000000 ____D C:\Program Files (x86)\CyberLink
2016-03-12 19:15 - 2016-03-12 19:14 - 00029480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2016-03-08 18:14 - 2016-03-16 19:29 - 00001203 _____ C:\Users\Hranca\Desktop\Any Audio Converter.lnk
2016-03-08 18:14 - 2016-03-08 18:14 - 00000000 ____D C:\Users\Hranca\Documents\Any Audio Converter
2016-03-08 18:11 - 2016-03-08 18:28 - 00000000 ____D C:\Program Files (x86)\GoGo MP3 To CD Burner
2016-03-08 18:11 - 2016-03-08 18:27 - 00000027 _____ C:\Windows\lang.ini
2016-03-08 18:11 - 2016-03-08 18:11 - 01344916 _____ ( ) C:\Users\Hranca\Downloads\MP32CD.exe
2016-03-08 17:57 - 2016-03-08 18:49 - 00000000 ____D C:\Users\Hranca\Desktop\Kola muyika
2016-03-06 19:05 - 2016-03-06 19:06 - 00018168 _____ C:\Users\Hranca\Documents\wegowego.mp3.sfk
2016-03-06 17:13 - 2016-03-06 17:15 - 00000000 ____D C:\Users\Hranca\Downloads\slike
2016-03-06 16:47 - 2016-03-06 16:47 - 00000000 ____D C:\Program Files (x86)\MSECache
2016-03-02 17:03 - 2016-03-02 17:03 - 00000035 _____ C:\Users\Hranca\Desktop\5.marta.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-16 19:37 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-16 19:37 - 2009-07-14 05:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-16 19:32 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-16 19:29 - 2015-12-05 15:05 - 00002070 _____ C:\Users\Hranca\Desktop\Subtitle Workshop.lnk
2016-03-16 19:29 - 2015-11-11 08:52 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-16 19:29 - 2015-11-11 08:52 - 00002041 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk
2016-03-16 19:29 - 2015-09-16 15:31 - 00001035 _____ C:\Users\Hranca\Desktop\TeamViewer 10.lnk
2016-03-16 19:29 - 2015-08-29 13:11 - 00001020 _____ C:\Users\Hranca\Desktop\GameTracker.lnk
2016-03-16 19:29 - 2015-08-10 18:43 - 00000968 _____ C:\Users\Public\Desktop\CPUID HWMonitor.lnk
2016-03-16 19:29 - 2015-07-10 16:35 - 00001035 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2016-03-16 19:29 - 2015-06-27 19:35 - 00002055 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2016-03-16 19:29 - 2015-04-18 12:47 - 00000776 _____ C:\Users\Public\Desktop\ONE TOUCH Upgrade S 2.8.0 .lnk
2016-03-16 19:29 - 2015-04-04 09:55 - 00001938 _____ C:\Users\Public\Desktop\Telstra Turbo Connection Manager.lnk
2016-03-16 19:29 - 2015-04-03 20:46 - 00001732 _____ C:\Users\Public\Desktop\Join Air.lnk
2016-03-16 19:29 - 2015-03-29 17:36 - 00001223 _____ C:\Users\Hranca\Desktop\Wondershare.lnk
2016-03-16 19:29 - 2015-03-29 15:50 - 00000962 _____ C:\Users\Hranca\Desktop\DVD-lab PRO 2.lnk
2016-03-16 19:29 - 2015-03-29 15:38 - 00001232 _____ C:\Users\Hranca\Desktop\ConvertXtoDVD 4.lnk
2016-03-16 19:29 - 2015-03-29 12:41 - 00001064 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-03-16 19:29 - 2015-02-26 22:37 - 00001203 _____ C:\Users\Hranca\Desktop\Any Video Converter.lnk
2016-03-16 19:29 - 2015-02-22 00:16 - 00001321 _____ C:\Users\Public\Desktop\Burning.lnk
2016-03-16 19:29 - 2014-12-18 10:02 - 00002160 _____ C:\Users\Public\Desktop\PhotoImpact 12.lnk
2016-03-16 19:29 - 2014-12-18 09:41 - 00001116 _____ C:\Users\Public\Desktop\Sound Forge Pro 11.0.lnk
2016-03-16 19:29 - 2014-12-17 18:02 - 00000515 _____ C:\Users\Hranca\Desktop\COD4.lnk
2016-03-16 19:29 - 2014-12-17 17:10 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-03-16 19:29 - 2014-12-17 17:10 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-03-16 19:29 - 2014-12-17 16:12 - 00000529 _____ C:\Users\Public\Desktop\WarThunder.lnk
2016-03-16 19:29 - 2014-12-17 13:12 - 00000694 _____ C:\Users\Hranca\Desktop\FlashTool64 - Shortcut.lnk
2016-03-16 19:29 - 2014-12-17 13:09 - 00000512 _____ C:\Users\Public\Desktop\Steam.lnk
2016-03-16 19:29 - 2014-12-17 12:24 - 00003003 _____ C:\Users\Hranca\Desktop\Microsoft Word 2010.lnk
2016-03-16 19:29 - 2014-12-17 12:24 - 00002933 _____ C:\Users\Hranca\Desktop\Microsoft Excel 2010.lnk
2016-03-16 19:29 - 2014-12-17 11:53 - 00000619 _____ C:\Users\Hranca\Desktop\Text - Shortcut.lnk
2016-03-16 19:29 - 2014-12-17 11:27 - 00001090 _____ C:\Users\Hranca\Desktop\Your Unin-staller!.lnk
2016-03-16 19:29 - 2014-12-17 11:24 - 00000505 _____ C:\Users\Hranca\Desktop\Programs and Features - Shortcut.lnk
2016-03-16 19:29 - 2014-12-17 11:17 - 00000860 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-03-16 19:29 - 2014-12-17 08:16 - 00001203 _____ C:\Users\Hranca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-03-16 19:29 - 2014-12-17 08:16 - 00000901 _____ C:\Users\Hranca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-16 19:29 - 2009-07-14 06:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-03-16 19:29 - 2009-07-14 05:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-03-16 19:29 - 2009-07-14 05:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-03-16 19:29 - 2009-07-14 05:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-03-16 19:29 - 2009-07-14 05:54 - 00001266 _____ C:\Users\Hranca\Desktop\dfrgui.lnk
2016-03-16 19:29 - 2009-07-14 05:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-03-16 19:29 - 2009-07-14 05:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-03-16 19:15 - 2009-07-14 06:13 - 00783728 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-16 19:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-03-16 18:57 - 2015-04-14 19:49 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-16 18:57 - 2014-12-17 11:05 - 00000000 ____D C:\Program Files (x86)\Google
2016-03-16 18:57 - 2014-12-17 11:04 - 00000000 ____D C:\Users\Hranca\AppData\Local\Deployment
2016-03-16 18:52 - 2014-12-17 11:27 - 00000000 ____D C:\ProgramData\TEMP
2016-03-16 18:46 - 2014-12-17 08:15 - 00000000 ____D C:\Users\Hranca
2016-03-16 18:22 - 2015-02-21 23:44 - 00000000 ____D C:\AdwCleaner
2016-03-16 18:20 - 2015-04-03 21:40 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2016-03-16 18:19 - 2015-06-27 20:59 - 00000000 ____D C:\Windows\system32\appmgmt
2016-03-16 07:39 - 2015-06-27 19:41 - 00000000 ____D C:\Temp
2016-03-15 20:32 - 2014-12-17 16:19 - 00000000 ____D C:\Game
2016-03-15 20:18 - 2015-08-29 13:11 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\GameTracker
2016-03-15 20:18 - 2014-12-17 19:04 - 00281768 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2016-03-15 20:18 - 2014-12-17 18:09 - 00281768 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2016-03-15 19:26 - 2009-07-14 03:34 - 00000528 _____ C:\Windows\win.ini
2016-03-14 19:46 - 2014-12-17 13:40 - 00281768 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2016-03-14 15:43 - 2015-09-30 14:21 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-03-14 15:38 - 2014-12-18 10:10 - 00000000 ____D C:\Users\Hranca\AppData\Local\Adobe
2016-03-13 19:14 - 2015-03-29 12:42 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\vlc
2016-03-12 19:17 - 2014-12-17 17:49 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision
2016-03-12 19:16 - 2014-12-17 11:46 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-03-12 19:14 - 2009-07-14 12:04 - 00505128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2016-03-12 19:14 - 2009-07-14 12:04 - 00353576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2016-03-12 18:22 - 2015-03-29 17:31 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\dvdcss
2016-03-11 15:57 - 2015-04-14 19:49 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-11 15:57 - 2015-04-14 19:49 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-11 15:57 - 2015-04-14 19:49 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-03-08 18:39 - 2015-02-26 22:37 - 00000000 ____D C:\Users\Hranca\AppData\Roaming\Anvsoft
2016-03-08 18:14 - 2015-02-26 22:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvsoft
2016-03-08 18:13 - 2015-02-26 22:37 - 00000000 ____D C:\Program Files (x86)\Anvsoft
2016-02-26 14:29 - 2015-07-10 16:35 - 00000000 ____D C:\Program Files (x86)\TeamViewer

==================== Files in the root of some directories =======

2016-03-15 17:36 - 2016-03-15 17:36 - 7600640 _____ () C:\Users\Hranca\AppData\Roaming\agent.dat
2016-03-15 17:36 - 2016-03-15 17:36 - 0072715 _____ () C:\Users\Hranca\AppData\Roaming\BlackRonbam.tst
2016-03-15 17:35 - 2016-03-15 17:35 - 0127488 _____ () C:\Users\Hranca\AppData\Roaming\Installer.dat
2016-03-15 17:36 - 2016-03-15 17:36 - 0018432 _____ () C:\Users\Hranca\AppData\Roaming\Main.dat
2015-03-29 15:38 - 2015-11-05 21:30 - 0001057 _____ () C:\Users\Hranca\AppData\Roaming\vso_ts_preview.xml
2016-03-15 17:36 - 2016-03-15 17:36 - 1787087 _____ () C:\Users\Hranca\AppData\Roaming\Zuntax.tst
2015-05-02 22:23 - 2015-05-02 22:23 - 0000000 _____ () C:\Users\Hranca\AppData\Local\{C02F135B-4326-40A0-B41B-D9009FAA357F}
2015-11-05 19:16 - 2015-11-05 19:41 - 0000040 ___SH () C:\ProgramData\.zreglib
2009-07-14 00:31 - 2009-07-14 02:14 - 68385536 ___SH () C:\ProgramData\msndzjj.exe

Files to move or delete:
====================
C:\ProgramData\msndzjj.exe


Some files in TEMP:
====================
C:\Users\Hranca\AppData\Local\Temp\cdo3516791983.dll
C:\Users\Hranca\AppData\Local\Temp\cdo4147093641.dll
C:\Users\Hranca\AppData\Local\Temp\cdo921053709.dll
C:\Users\Hranca\AppData\Local\Temp\Quarantine.exe
C:\Users\Hranca\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-03-10 16:43

==================== End of FRST.txt ============================

Dopuna: 16 Mar 2016 20:06

Ah da i ovaj pop up mi ide na živce Disorderstatus.ru

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Pozdrav!

Zamolio bih te da dostavis i Addition.txt izvestaj koji si dobio uz FRST.txt.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

[Link mogu videti samo ulogovani korisnici]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Za pocetak ti predlazem da obrises program Your Uninstaller! 2010 jer vec imas, na primer, CCleaner, koji takodje mozes iskoristiti kao alat za brisanje programa. Ovaj Your Uninstaller! 2010 je alat koji, jednostavno, ne sluzi svrsi i jedini cilj je da od krajnjeg korisnika izvuce novac, kako bi ovaj kupio "pro" verziju. A zasto bi, kad ima mnogo boljih besplatnih alternativa, kao CCleaner na primer?

Onda,

1. Otvori Notepad (Text Document) i iskopiraj sledeći tekst unutar kod polja ispod:

CreateRestorePoint:
CHR StartupUrls: Profile 9 -> "hxxp://www.google.rs/","hxxp://mystart.incredibar.com/mb178?a=6PQKupxmne&i=26","hxxp://mystart.incredibar.com/mb201?a=6PQVF0H2ju&i=26"
S2 afoir; C:\ProgramData\\afoir\\afoir.exe -f "C:\ProgramData\\afoir\\afoir.dat" -l -a
C:\ProgramData\\afoir
2016-03-15 17:36 - 2016-03-15 17:36 - 07600640 _____ C:\Users\Hranca\AppData\Roaming\agent.dat
2016-03-15 17:36 - 2016-03-15 17:36 - 01787087 _____ C:\Users\Hranca\AppData\Roaming\Zuntax.tst
2016-03-15 17:36 - 2016-03-15 17:36 - 00072715 _____ C:\Users\Hranca\AppData\Roaming\BlackRonbam.tst
2016-03-15 17:36 - 2016-03-15 17:36 - 00018432 _____ C:\Users\Hranca\AppData\Roaming\Main.dat
2016-03-15 17:35 - 2016-03-15 17:35 - 00127488 _____ C:\Users\Hranca\AppData\Roaming\Installer.dat
2015-03-29 15:38 - 2015-11-05 21:30 - 0001057 _____ () C:\Users\Hranca\AppData\Roaming\vso_ts_preview.xml
2015-05-02 22:23 - 2015-05-02 22:23 - 0000000 _____ () C:\Users\Hranca\AppData\Local\{C02F135B-4326-40A0-B41B-D9009FAA357F}
2015-11-05 19:16 - 2015-11-05 19:41 - 0000040 ___SH () C:\ProgramData\.zreglib
2009-07-14 00:31 - 2009-07-14 02:14 - 68385536 ___SH () C:\ProgramData\msndzjj.exe
HKLM\...\Policies\Explorer\Run: [1763311169] => C:\ProgramData\msndzjj.exe [68385536 2009-07-14] ()
Task: {0F3012C6-F1EC-44AC-A5C8-361362F8CF29} - System32\Tasks\{06167329-14ED-46FE-BE57-E76D72B38A01} => pcalua.exe -a C:\Users\Hranca\AppData\Roaming\mystartsearch\UninstallManager.exe -c  -ptid=smt
Task: {ED9E74B7-9DFB-4DD6-82DC-FF6FC50C6997} - System32\Tasks\{8B8EF6AB-FC9B-407B-89BD-F2344279460E} => pcalua.exe -a C:\Users\Hranca\AppData\Roaming\luckysearches\UninstallManager.exe -c  -ptid=exp
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [166]
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\Run: [{FFB5E17E-AC0F-44C6-89D7-EE0C0C709CF6}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\XIVNTI').JGCKFJMGMD)));
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {9e1da422-da21-11e4-ad16-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {9e1da4b0-da21-11e4-ad16-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {cbb27afe-1cfc-11e5-9c45-0022158832e8} - F:\Setup.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {d4edc13f-6ff2-11e5-a6cf-0022158832e8} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Install_driver
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {ed56db45-da07-11e4-a2ba-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {f04c3943-94b5-11e4-b748-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {f04c395e-94b5-11e4-b748-0022158832e8} - F:\Autorun.exe
2016-03-16 19:25 - 2016-03-16 19:25 - 00383592 __RSH C:\gdrop
2016-03-16 19:25 - 2016-03-16 19:25 - 00171136 __RSH C:\xeldr
EmptyTemp:

2. Sačuvaj notepad na Desktop pod nazivom fixlist.txt
To možes uraditi i iz notepad-a => klik na File potom na Save As i u novom prozoru, dole pod File Name: staviš za naziv fixlist.txt
Napomena: Važno je da se oba fajla, FRST i fixlist nalaze na istoj lokaciji jer u suprotnom fix nece raditi.

3. Ponovo pokreni FRST/FRST64, klikni jednom na dugme Fix i sačekaj.
Ukoliko alat zatraži restart sistema, dozvoli mu i postaraj se da alat kompletira fix nakon restarta sistema.



Alat će formirati log (Fixlog.txt) na Desktop-u. Potrebno je sadržaj tog loga iskopirati u poruku.
Napomena: Ukoliko te alat upozori da postoji novija verzija, postaraj se da preuzmes i koristiš ažuriranu kopiju FRST-a.



Nakon toga,

Preuzmi "Xplode"-ov AdwCleaner i sačuvaj ga na Desktop
Dvoklikom pokreni program.
U EULA prozoru klikni na I agree.
U Options isključi Reset Winsock settings ako je uključen.
Klikni na dugme Scan i sačekaj da se završi skeniranje.
Klikni na dugme Cleaning i pričekaj da program završi.
Program će zatvoriti sve aktivne programe i izbaciti prozor sa tim upozorenjem. Klikni OK kao potvrdu.
Na sljedeća dva prozora koja se otvore (Informations i Restart required ) klikni OK
Računar će se restartovati, a potom otvoriti Notepad (C:\Adwcleaner\AdwCleaner[C1].txt) sa izvještajem.
Sačuvaj taj izvještaj na Desktop i okači ga uz poruku koristeći opciju "Prikači fajl"


Na kraju, dostavi mi i Malwarebytes izvestaje skeniranja. Ako ih ima vise, zapakuj, pa posalji ovde.
Evo uputstva, za slucaj da ne znas kako da ih nadjes: [Link mogu videti samo ulogovani korisnici]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Uloguj se preko Facebooka da bi skinuo fajl:

Napisano: 17 Mar 2016 0:02

Fix result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01
Ran by Hranca (2016-03-16 23:54:18) Run:1
Running from C:\Users\Hranca\Desktop
Loaded Profiles: Hranca (Available Profiles: Hranca)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CHR StartupUrls: Profile 9 -> "hxxp://www.google.rs/","hxxp://mystart.incredibar.com/mb178?a=6PQKupxmne&i=26","hxxp://mystart.incredibar.com/mb201?a=6PQVF0H2ju&i=26"
S2 afoir; C:\ProgramData\\afoir\\afoir.exe -f "C:\ProgramData\\afoir\\afoir.dat" -l -a
C:\ProgramData\\afoir
2016-03-15 17:36 - 2016-03-15 17:36 - 07600640 _____ C:\Users\Hranca\AppData\Roaming\agent.dat
2016-03-15 17:36 - 2016-03-15 17:36 - 01787087 _____ C:\Users\Hranca\AppData\Roaming\Zuntax.tst
2016-03-15 17:36 - 2016-03-15 17:36 - 00072715 _____ C:\Users\Hranca\AppData\Roaming\BlackRonbam.tst
2016-03-15 17:36 - 2016-03-15 17:36 - 00018432 _____ C:\Users\Hranca\AppData\Roaming\Main.dat
2016-03-15 17:35 - 2016-03-15 17:35 - 00127488 _____ C:\Users\Hranca\AppData\Roaming\Installer.dat
2015-03-29 15:38 - 2015-11-05 21:30 - 0001057 _____ () C:\Users\Hranca\AppData\Roaming\vso_ts_preview.xml
2015-05-02 22:23 - 2015-05-02 22:23 - 0000000 _____ () C:\Users\Hranca\AppData\Local\{C02F135B-4326-40A0-B41B-D9009FAA357F}
2015-11-05 19:16 - 2015-11-05 19:41 - 0000040 ___SH () C:\ProgramData\.zreglib
2009-07-14 00:31 - 2009-07-14 02:14 - 68385536 ___SH () C:\ProgramData\msndzjj.exe
HKLM\...\Policies\Explorer\Run: [1763311169] => C:\ProgramData\msndzjj.exe [68385536 2009-07-14] ()
Task: {0F3012C6-F1EC-44AC-A5C8-361362F8CF29} - System32\Tasks\{06167329-14ED-46FE-BE57-E76D72B38A01} => pcalua.exe -a C:\Users\Hranca\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=smt
Task: {ED9E74B7-9DFB-4DD6-82DC-FF6FC50C6997} - System32\Tasks\{8B8EF6AB-FC9B-407B-89BD-F2344279460E} => pcalua.exe -a C:\Users\Hranca\AppData\Roaming\luckysearches\UninstallManager.exe -c -ptid=exp
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [166]
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\Run: [{FFB5E17E-AC0F-44C6-89D7-EE0C0C709CF6}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\XIVNTI').JGCKFJMGMD)));
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {9e1da422-da21-11e4-ad16-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {9e1da4b0-da21-11e4-ad16-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {cbb27afe-1cfc-11e5-9c45-0022158832e8} - F:\Setup.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {d4edc13f-6ff2-11e5-a6cf-0022158832e8} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Install_driver
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {ed56db45-da07-11e4-a2ba-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {f04c3943-94b5-11e4-b748-0022158832e8} - F:\Autorun.exe
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\...\MountPoints2: {f04c395e-94b5-11e4-b748-0022158832e8} - F:\Autorun.exe
2016-03-16 19:25 - 2016-03-16 19:25 - 00383592 __RSH C:\gdrop
2016-03-16 19:25 - 2016-03-16 19:25 - 00171136 __RSH C:\xeldr
EmptyTemp:
*****************

Restore point was successfully created.
Chrome StartupUrls => removed successfully
afoir => service removed successfully
C:\ProgramData\\afoir => moved successfully
C:\Users\Hranca\AppData\Roaming\agent.dat => moved successfully
C:\Users\Hranca\AppData\Roaming\Zuntax.tst => moved successfully
C:\Users\Hranca\AppData\Roaming\BlackRonbam.tst => moved successfully
C:\Users\Hranca\AppData\Roaming\Main.dat => moved successfully
C:\Users\Hranca\AppData\Roaming\Installer.dat => moved successfully
C:\Users\Hranca\AppData\Roaming\vso_ts_preview.xml => moved successfully
C:\Users\Hranca\AppData\Local\{C02F135B-4326-40A0-B41B-D9009FAA357F} => moved successfully
C:\ProgramData\.zreglib => moved successfully
"C:\ProgramData\msndzjj.exe" => not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\1763311169 => value not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0F3012C6-F1EC-44AC-A5C8-361362F8CF29}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0F3012C6-F1EC-44AC-A5C8-361362F8CF29}" => key removed successfully
C:\Windows\System32\Tasks\{06167329-14ED-46FE-BE57-E76D72B38A01} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{06167329-14ED-46FE-BE57-E76D72B38A01}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ED9E74B7-9DFB-4DD6-82DC-FF6FC50C6997}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED9E74B7-9DFB-4DD6-82DC-FF6FC50C6997}" => key removed successfully
C:\Windows\System32\Tasks\{8B8EF6AB-FC9B-407B-89BD-F2344279460E} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8B8EF6AB-FC9B-407B-89BD-F2344279460E}" => key removed successfully
C:\ProgramData\TEMP => ":1CE11B51" ADS removed successfully.
HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\Software\Microsoft\Windows\CurrentVersion\Run\\{FFB5E17E-AC0F-44C6-89D7-EE0C0C709CF6} => value removed successfully
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e1da422-da21-11e4-ad16-0022158832e8}" => key removed successfully
HKCR\CLSID\{9e1da422-da21-11e4-ad16-0022158832e8} => key not found.
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e1da4b0-da21-11e4-ad16-0022158832e8}" => key removed successfully
HKCR\CLSID\{9e1da4b0-da21-11e4-ad16-0022158832e8} => key not found.
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cbb27afe-1cfc-11e5-9c45-0022158832e8}" => key removed successfully
HKCR\CLSID\{cbb27afe-1cfc-11e5-9c45-0022158832e8} => key not found.
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4edc13f-6ff2-11e5-a6cf-0022158832e8}" => key removed successfully
HKCR\CLSID\{d4edc13f-6ff2-11e5-a6cf-0022158832e8} => key not found.
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed56db45-da07-11e4-a2ba-0022158832e8}" => key removed successfully
HKCR\CLSID\{ed56db45-da07-11e4-a2ba-0022158832e8} => key not found.
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f04c3943-94b5-11e4-b748-0022158832e8}" => key removed successfully
HKCR\CLSID\{f04c3943-94b5-11e4-b748-0022158832e8} => key not found.
"HKU\S-1-5-21-1293919426-2142621105-2511924792-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f04c395e-94b5-11e4-b748-0022158832e8}" => key removed successfully
HKCR\CLSID\{f04c395e-94b5-11e4-b748-0022158832e8} => key not found.
C:\gdrop => moved successfully
C:\xeldr => moved successfully
EmptyTemp: => 334.8 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 23:54:47 ====

Dopuna: 17 Mar 2016 0:13

[Link mogu videti samo ulogovani korisnici]

Dopuna: 17 Mar 2016 0:30

[Link mogu videti samo ulogovani korisnici]

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Izvrsi i ovo skeniranje, pa reci kakvo je stanje.

Preuzmi TDSSKiller, sacuvaj alat na Desktop i dvoklikom pokreni TDSSKiller.exe
U "End user Licence Agreement" dijalogu klikni na Accept.
Takođe, u "KSN Statement" dijalogu klikni na Accept.

klikni na dugme Start Scan

Ukoliko sumnjive stavke Suspicious object budu detektovani, podrazumevana opcija (default action) jeste Skip, klikni na Continue.
Ukoliko maliciozni objekti Malicious objects budu detektovani, izaberi opciju Cure.
Okaci mi sadrzaj log-a sa sledece lokacije:
C:\TDSSKiller_verzija programa_DD.MM.GG_HH.MM.SS.txt
(DD-dan, MM-mesec, GG-godina, HH-sat, MM-minut, SS-sekunda; datum i vreme kada je log napravljen)