MyCity » Ambulanta -> Arhiva Ambulante » Zašto spybot ne može da ih ukloni?

Zašto spybot ne može da ih ukloni?

Napisano na dan: 25.7.2013
1

Zašto spybot ne može da ih ukloni?
Sledeća strana Pagination

Idi na vrh

Poslao: 25 Jul 2013 17:17
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 424
  • Gde živiš: U kući

Kad sam skenirao sa spybotom pronašao mi je probleme ali ih nije uklonio. Evo slika



A evo i izveštaja
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.25.2
Run by Home at 17:14:56 on 2013-07-25
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.381.1033.18.3545.1767 [GMT 2:00]
.
AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\vssvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
C:\Windows\system32\AUDIODG.EXE
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mWinlogon: Userinit = userinit.exe
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{A2EEAB71-9E59-4F0A-A90F-D432E29D2661} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.rs
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-07-05 21:00; 57ffxtbr@MarineAquarium3Free_57.com; C:\Program Files (x86)\MarineAquarium3Free_57\bar\1.bin
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2013-2-8 71480]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2013-2-8 311096]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2013-2-8 116536]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2013-2-8 45880]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2013-3-29 246072]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2013-2-8 206136]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2013-3-21 240952]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2013-4-1 235520]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-5-14 4937264]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-4-18 283136]
R2 MarineAquarium3Free_57Service;Marine Aquarium LiteService;C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe [2013-7-5 42504]
R3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2013-4-1 110744]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-6-3 162408]
S3 3xHybr64;3xHybrid service;C:\Windows\System32\drivers\3xHybr64.sys [2007-4-20 873216]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;C:\Windows\System32\drivers\RTL2832U_IRHID.sys [2013-5-30 44320]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;C:\Windows\System32\drivers\RTL2832UBDA.sys [2013-5-30 117152]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;C:\Windows\System32\drivers\RTL2832UUSB.sys [2013-5-30 38944]
S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2010-11-21 34816]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WatAdminSvc;Usluga tehnologije aktivacije operativnog sistema Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-4-1 1255736]
SUnknown tsusbhub;tsusbhub; [x]
.
=============== Created Last 30 ================
.
2013-07-25 14:21:03 -------- d-----w- C:\Users\Home\AppData\Local\RockMelt
2013-07-25 11:51:50 -------- d-----w- C:\ProgramData\BetterSoft
2013-07-25 11:50:48 -------- d-----w- C:\ProgramData\InstallMate
2013-07-14 08:03:27 -------- d-----w- C:\Windows\SysWow64\Adobe
2013-07-11 11:18:28 -------- d-----w- C:\Users\Home\AppData\Roaming\DAEMON Tools Lite
2013-07-11 11:17:26 -------- d-----w- C:\ProgramData\DAEMON Tools Lite
2013-07-07 07:28:47 -------- d-----w- C:\ProgramData\MCShield
2013-07-07 07:28:47 -------- d-----w- C:\Program Files (x86)\MCShield
2013-07-06 17:36:16 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-07-05 19:43:03 2455886 ----a-w- C:\Windows\Sim AQUARIUM 3.scr
2013-07-05 19:42:52 1998168 ----a-w- C:\Windows\D3DX9_43.dll
2013-07-05 19:42:52 -------- d-----w- C:\ProgramData\SA3
2013-07-05 19:01:38 -------- d-----w- C:\Users\Home\AppData\Local\MarineAquarium3Free_57
2013-07-05 18:57:11 -------- d-----w- C:\Program Files (x86)\MarineAquarium3Free_57
2013-07-04 09:38:32 -------- d-----w- C:\Users\Home\Nova fascikla
2013-07-02 08:50:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-01 16:08:06 -------- d-----w- C:\Windows\pss
2013-06-29 16:51:57 -------- d-----w- C:\FRST
2013-06-29 14:16:48 -------- d-----w- C:\ProgramData\Simply Super Software
2013-06-29 13:01:16 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-06-29 11:12:10 -------- d-----w- C:\Users\Home\AppData\Local\Adobe
2013-06-29 10:57:06 -------- d-----w- C:\Users\Home\AppData\Local\Deployment
2013-06-29 10:57:06 -------- d-----w- C:\Users\Home\AppData\Local\Apps
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\StarApp
2013-06-28 14:56:03 -------- d-----w- C:\Users\Home\AppData\Roaming\Foxit Software
2013-06-27 07:41:44 -------- d-----w- C:\Users\Home\AppData\Roaming\PhotoScape
2013-06-27 07:41:20 -------- d-----w- C:\Program Files (x86)\PhotoScape
2013-06-26 17:33:42 -------- d-----w- C:\Users\Home\AppData\Roaming\AVG
2013-06-26 17:33:04 -------- d-----w- C:\ProgramData\AVG
2013-06-26 17:32:51 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-26 14:06:17 -------- d-----w- C:\Users\Home\AppData\Roaming\DownLite
2013-06-26 14:03:49 -------- d-----w- C:\Users\Home\AppData\Local\Google
.
==================== Find3M ====================
.
2013-06-29 11:14:42 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-29 11:14:42 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-21 12:45:43 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 12:45:43 867240 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-06-21 12:45:43 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll
.
============= FINISH: 17:15:10,17 ===============

https://www.mycity.rs/must-login.png

Poslao: 25 Jul 2013 18:59
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Preuzmi zoek.exe sa ovog ili ovog linka i sačuvaj ga na Desktop.


zatvori browser i ostale pokrenute programe;
deaktiviraj zaštitni softver ( po potrebi ) Uputstvo ;
dvoklikom pokreni zoek.exe;
pričekaj da se alat startuje ...


U beli okvir prozora iskopiraj sledeći tekst:


process;
filesrcm;
startupall;
skipfix-iedefaults;
firefoxlook;
chromelook;


Klikni na dugme i pričekaj da se skeniranje završi.


zoek ce po potrebi, restartovati Windows a na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Napomena:Izveštaj će biti sačuvan pod nazivom zoek-results.log na sistemskoj particiji (tipična lokacija: C:\zoek-results.log)


Arrow Kopiraj sadrzaj tog loga u poruku.

Poslao: 26 Jul 2013 10:48
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 424
  • Gde živiš: U kući

Zoek.exe Version 4.0.0.4 Updated 21-07-2013
Tool run by Home on pet 26.07.2013 at 10:44:06,20.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Home\Desktop\zoek.exe [Script inserted]

==== System Restore Info ======================

26.7.2013 10:45:26 Zoek.exe System Restore Point Created Succesfully.

==== Running Processes ======================

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Users\Home\Desktop\zoek.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2013-07-05 19:43:03 A5F1CA585B977FB04129E1B4C6374403 2455886 ----a-w- C:\Windows\Sim AQUARIUM 3.scr
2013-07-05 19:42:52 86E39E9161C3D930D93822F1563C280D 1998168 ----a-w- C:\Windows\D3DX9_43.dll
====== C:\Users\Home\AppData\Local\Temp ====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
2013-07-25 16:27:37 393138B07104721B1B4AF95D8F45893A 414656 ----a-w- C:\Windows\Sysnative\FNTCACHE.DAT
====== C:\Windows\Sysnative\drivers =====
2013-07-14 11:38:33 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
====== C:\Windows\Tasks ======
2013-07-25 11:51:51 90A58E6FD85E0B5958C5BFE0A9C5959B 2708 ----a-w- C:\Windows\Sysnative\Tasks\schedule!3036567561
2013-07-25 11:51:50 DEEE82D9517975C88FB853259328EA3C 414 ---ha-w- C:\Windows\Tasks\schedule!3036567561.job
2013-07-01 19:17:51 5666272FF1F9F5D683972D704DC4C1AE 894 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 19:17:51 46A6029C54F5C1D974DF9914A7BEC4DB 3890 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineUA
2013-07-01 19:17:50 039073D6E4C93969C54D8AB19AD41FEE 890 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-01 19:17:50 03532F0783F429E1095F3985991320B0 3638 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineCore
2013-06-29 11:14:43 1CCAD292AB20218AA3D46D33C8892BAF 830 ----a-w- C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:14:43 0E2E029782F39969FADA56D652F107FB 3768 ----a-w- C:\Windows\Sysnative\Tasks\Adobe Flash Player Updater
2013-06-29 10:57:15 D622EFB007881C595B664E2C4090DFCB 3148 ----a-w- C:\Windows\Sysnative\Tasks\{D91E0789-2B12-4F67-8B11-D7FC0A36A75F}
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-07-07 07:28:47 -------- d-----w- C:\Program Files (x86)\MCShield
2013-07-06 17:36:16 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-07-05 18:57:11 -------- d-----w- C:\Program Files (x86)\MarineAquarium3Free_57
2013-07-02 08:50:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-01 19:17:46 -------- d-----w- C:\Program Files (x86)\Google
2013-06-27 07:41:20 -------- d-----w- C:\Program Files (x86)\PhotoScape
======= C: =====
====== C:\Users\Home\AppData\Roaming ======
2013-07-25 15:09:07 3267661C28EEBE52A6991CF9207A3655 108840 ----a-w- C:\users\Home\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-25 14:21:03 -------- d-----w- C:\users\Home\AppData\Local\RockMelt
2013-07-15 19:19:43 -------- d-----w- C:\users\Home\AppData\Locallow\Adobe
2013-07-11 11:18:28 -------- d-----w- C:\users\Home\AppData\Roaming\DAEMON Tools Lite
2013-07-05 19:01:38 -------- d-----w- C:\users\Home\AppData\Local\MarineAquarium3Free_57
2013-07-05 18:57:15 -------- d-----w- C:\users\Home\AppData\Locallow\MarineAquarium3Free_57
2013-07-04 09:39:20 -------- d-----w- C:\users\Home\AppData\Roaming\GRETECH
2013-07-02 08:50:10 -------- d-----w- C:\users\Home\AppData\Roaming\Mozilla
2013-06-29 11:12:10 -------- d-----w- C:\users\Home\AppData\Local\Adobe
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Deployment
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Apps
2013-06-28 14:56:03 -------- d-----w- C:\users\Home\AppData\Roaming\Foxit Software
2013-06-27 07:41:44 -------- d-----w- C:\users\Home\AppData\Roaming\PhotoScape
2013-06-26 17:33:42 -------- d-----w- C:\users\Home\AppData\Roaming\AVG
2013-06-26 14:06:17 -------- d-----w- C:\users\Home\AppData\Roaming\DownLite
2013-06-26 14:03:49 -------- d-----w- C:\users\Home\AppData\Local\Google
====== C:\Users\Home ======
2013-07-25 11:51:50 -------- d-----w- C:\ProgramData\BetterSoft
2013-07-25 11:50:48 -------- d-----w- C:\ProgramData\InstallMate
2013-07-11 11:17:26 -------- d-----w- C:\ProgramData\DAEMON Tools Lite
2013-07-09 08:17:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2013-07-07 07:28:49 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
2013-07-07 07:28:47 -------- d-----w- C:\ProgramData\MCShield
2013-07-06 17:36:20 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2013-07-05 19:42:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sim AQUARIUM 3
2013-07-05 19:42:52 -------- d-----w- C:\ProgramData\SA3
2013-07-04 13:28:27 6FC234AD3752E1267B34FB12BCD6718B 20 --sh--w- C:\Users\Home\ntuser.ini
2013-07-04 09:38:32 -------- d-----w- C:\Users\Home\Nova fascikla
2013-07-01 19:21:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-06-29 14:16:48 -------- d-----w- C:\ProgramData\Simply Super Software
2013-06-29 13:01:16 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\StarApp
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSearchh-NeWWTab
2013-06-28 19:07:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSafe savvee
2013-06-27 07:41:28 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
2013-06-26 19:08:15 -------- d-----w- C:\ProgramData\TEMP
2013-06-26 18:58:25 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SearchNewTab
2013-06-26 18:57:26 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ssaFe! save
2013-06-26 17:33:04 -------- d-----w- C:\ProgramData\AVG
2013-06-26 17:32:51 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-26 14:09:25 -------- d-----w- C:\ProgramData\Real

====== C: exe-files ==
2013-07-25 11:52:07 E717F6CE3A7429BFA6D7F3CF66737A4B 15968 --s-a-r- C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe
2013-07-25 11:51:50 98B03BEF5A2808C5EFA2A0D2430144DE 15968 --s-a-r- C:\ProgramData\InstallMate\OptimizerPro\Setup.exe
2013-07-25 11:51:50 2960400094498DAE47B36173286D76A0 348160 ------w- C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
=== C: other files ==
2013-07-25 15:07:12 25B26E1D9D179E4F0F9762B911463595 634 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave26.zip
2013-07-25 15:07:11 D91B6CFDA90E0375B0E5CF2132D679C3 348691 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave23.zip
2013-07-25 15:07:11 1D33E88320A669EBC989698383CD422D 16413 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave25.zip
2013-07-25 15:07:11 09BB28518A1A14EE66D182FBAC3041DD 348682 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave24.zip
2013-07-25 15:07:09 6EB3A1B1A86F3DD52DB19A9A7C961A57 348616 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave22.zip
2013-07-25 14:52:56 4075459DD814B6269EDC70158CC8B733 652867 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\94da88d1-2b48-47d3-89de-e1ccefac356f.zip
2013-07-25 14:29:21 6A2BD3B434BCED0A8C7CCD3927A75C05 1171317 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\45e76c82-2b25-47d3-8a24-e1ccefac356f.zip
2013-07-19 14:06:56 6F3AAC92A4F83948B47CECB8DC1E744F 3960 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\ef21813c-268e-47d3-867e-e1ccefac356f.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="C:\Program Files (x86)\AVG\AVG2013\avgui.exe /TRAYONLY"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]
"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""


==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BCSSync]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BCSSync"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MCShield Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MCShield Monitor"
"hkey"="HKCU"
"command"="C:\\Program Files (x86)\\MCShield\\MCShieldRTM.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WinampAgent"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Winamp\\winampa.exe\""


==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undetermined Task]
C:\Windows\tasks\schedule\Undetermined Task.exe []

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default
3D76B5C0E02ECC19C1F5756E8FD97F72 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director
2EE9DCAE1D70ABF4D058688DE35F8221 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.16
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dhfcbmlocifngpbjdpgnkbjmgkadkjpp - C:\Program Files (x86)\Industriya\privitize\1.8.21.6\privitize.crx[]
nbmafkdmkkckhggblphicnnhlgljnoje - C:\Program Files (x86)\TornTV.com\torn2_10.crx[]

Google Docs - Home - default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Home - default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Home - default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Home - default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Slagalica fer igra - Ludara.com - Home - default\Extensions\ejpifakoabdhigpeebhalfkjkoidenba
Gmail - Home - default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{18401191-9920-4692-8096-1EA7F09EA828} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}"

==== EOF on pet 26.07.2013 at 10:47:22,29 ======================

Poslao: 26 Jul 2013 13:01
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje


zatvori browser i ostale pokrenute programe;
deaktiviraj zaštitni softver ( po potrebi ) Uputstvo ;
dvoklikom pokreni zoek.exe;
pričekaj da se alat startuje ...


U beli okvir prozora iskopiraj sledeći tekst:


emptyclsid;
C:\WINDOWS\Tasks\At*.job;f 
C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe;f
C:\ProgramData\InstallMate\OptimizerPro\Setup.exe;f
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe;f
FFdefaults;
chrdefaults;
iedefaults; 
C:\Program Files (x86)\TornTV.com;fs
C:\Program Files (x86)\Industriya;fs
nbmafkdmkkckhggblphicnnhlgljnoje;chr
dhfcbmlocifngpbjdpgnkbjmgkadkjpp;chr
emptyalltemp;
autoclean;


Klikni na dugme i pričekaj da se skeniranje završi.


zoek ce po potrebi, restartovati Windows a na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Napomena:Izveštaj će biti sačuvan pod nazivom zoek-results.log na sistemskoj particiji (tipična lokacija: C:\zoek-results.log)


Arrow Kopiraj sadrzaj tog loga u poruku.

Poslao: 26 Jul 2013 14:19
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 424
  • Gde živiš: U kući

Napisano: 26 Jul 2013 14:04

Zoek.exe Version 4.0.0.4 Updated 21-07-2013
Tool run by Home on pet 26.07.2013 at 10:44:06,20.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Home\Desktop\zoek.exe [Script inserted]

==== System Restore Info ======================

26.7.2013 10:45:26 Zoek.exe System Restore Point Created Succesfully.

==== Running Processes ======================

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Users\Home\Desktop\zoek.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2013-07-05 19:43:03 A5F1CA585B977FB04129E1B4C6374403 2455886 ----a-w- C:\Windows\Sim AQUARIUM 3.scr
2013-07-05 19:42:52 86E39E9161C3D930D93822F1563C280D 1998168 ----a-w- C:\Windows\D3DX9_43.dll
====== C:\Users\Home\AppData\Local\Temp ====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
2013-07-25 16:27:37 393138B07104721B1B4AF95D8F45893A 414656 ----a-w- C:\Windows\Sysnative\FNTCACHE.DAT
====== C:\Windows\Sysnative\drivers =====
2013-07-14 11:38:33 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
====== C:\Windows\Tasks ======
2013-07-25 11:51:51 90A58E6FD85E0B5958C5BFE0A9C5959B 2708 ----a-w- C:\Windows\Sysnative\Tasks\schedule!3036567561
2013-07-25 11:51:50 DEEE82D9517975C88FB853259328EA3C 414 ---ha-w- C:\Windows\Tasks\schedule!3036567561.job
2013-07-01 19:17:51 5666272FF1F9F5D683972D704DC4C1AE 894 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 19:17:51 46A6029C54F5C1D974DF9914A7BEC4DB 3890 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineUA
2013-07-01 19:17:50 039073D6E4C93969C54D8AB19AD41FEE 890 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-01 19:17:50 03532F0783F429E1095F3985991320B0 3638 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineCore
2013-06-29 11:14:43 1CCAD292AB20218AA3D46D33C8892BAF 830 ----a-w- C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:14:43 0E2E029782F39969FADA56D652F107FB 3768 ----a-w- C:\Windows\Sysnative\Tasks\Adobe Flash Player Updater
2013-06-29 10:57:15 D622EFB007881C595B664E2C4090DFCB 3148 ----a-w- C:\Windows\Sysnative\Tasks\{D91E0789-2B12-4F67-8B11-D7FC0A36A75F}
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-07-07 07:28:47 -------- d-----w- C:\Program Files (x86)\MCShield
2013-07-06 17:36:16 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-07-05 18:57:11 -------- d-----w- C:\Program Files (x86)\MarineAquarium3Free_57
2013-07-02 08:50:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-01 19:17:46 -------- d-----w- C:\Program Files (x86)\Google
2013-06-27 07:41:20 -------- d-----w- C:\Program Files (x86)\PhotoScape
======= C: =====
====== C:\Users\Home\AppData\Roaming ======
2013-07-25 15:09:07 3267661C28EEBE52A6991CF9207A3655 108840 ----a-w- C:\users\Home\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-25 14:21:03 -------- d-----w- C:\users\Home\AppData\Local\RockMelt
2013-07-15 19:19:43 -------- d-----w- C:\users\Home\AppData\Locallow\Adobe
2013-07-11 11:18:28 -------- d-----w- C:\users\Home\AppData\Roaming\DAEMON Tools Lite
2013-07-05 19:01:38 -------- d-----w- C:\users\Home\AppData\Local\MarineAquarium3Free_57
2013-07-05 18:57:15 -------- d-----w- C:\users\Home\AppData\Locallow\MarineAquarium3Free_57
2013-07-04 09:39:20 -------- d-----w- C:\users\Home\AppData\Roaming\GRETECH
2013-07-02 08:50:10 -------- d-----w- C:\users\Home\AppData\Roaming\Mozilla
2013-06-29 11:12:10 -------- d-----w- C:\users\Home\AppData\Local\Adobe
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Deployment
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Apps
2013-06-28 14:56:03 -------- d-----w- C:\users\Home\AppData\Roaming\Foxit Software
2013-06-27 07:41:44 -------- d-----w- C:\users\Home\AppData\Roaming\PhotoScape
2013-06-26 17:33:42 -------- d-----w- C:\users\Home\AppData\Roaming\AVG
2013-06-26 14:06:17 -------- d-----w- C:\users\Home\AppData\Roaming\DownLite
2013-06-26 14:03:49 -------- d-----w- C:\users\Home\AppData\Local\Google
====== C:\Users\Home ======
2013-07-25 11:51:50 -------- d-----w- C:\ProgramData\BetterSoft
2013-07-25 11:50:48 -------- d-----w- C:\ProgramData\InstallMate
2013-07-11 11:17:26 -------- d-----w- C:\ProgramData\DAEMON Tools Lite
2013-07-09 08:17:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2013-07-07 07:28:49 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
2013-07-07 07:28:47 -------- d-----w- C:\ProgramData\MCShield
2013-07-06 17:36:20 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2013-07-05 19:42:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sim AQUARIUM 3
2013-07-05 19:42:52 -------- d-----w- C:\ProgramData\SA3
2013-07-04 13:28:27 6FC234AD3752E1267B34FB12BCD6718B 20 --sh--w- C:\Users\Home\ntuser.ini
2013-07-04 09:38:32 -------- d-----w- C:\Users\Home\Nova fascikla
2013-07-01 19:21:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-06-29 14:16:48 -------- d-----w- C:\ProgramData\Simply Super Software
2013-06-29 13:01:16 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\StarApp
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSearchh-NeWWTab
2013-06-28 19:07:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSafe savvee
2013-06-27 07:41:28 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
2013-06-26 19:08:15 -------- d-----w- C:\ProgramData\TEMP
2013-06-26 18:58:25 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SearchNewTab
2013-06-26 18:57:26 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ssaFe! save
2013-06-26 17:33:04 -------- d-----w- C:\ProgramData\AVG
2013-06-26 17:32:51 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-26 14:09:25 -------- d-----w- C:\ProgramData\Real

====== C: exe-files ==
2013-07-25 11:52:07 E717F6CE3A7429BFA6D7F3CF66737A4B 15968 --s-a-r- C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe
2013-07-25 11:51:50 98B03BEF5A2808C5EFA2A0D2430144DE 15968 --s-a-r- C:\ProgramData\InstallMate\OptimizerPro\Setup.exe
2013-07-25 11:51:50 2960400094498DAE47B36173286D76A0 348160 ------w- C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
=== C: other files ==
2013-07-25 15:07:12 25B26E1D9D179E4F0F9762B911463595 634 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave26.zip
2013-07-25 15:07:11 D91B6CFDA90E0375B0E5CF2132D679C3 348691 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave23.zip
2013-07-25 15:07:11 1D33E88320A669EBC989698383CD422D 16413 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave25.zip
2013-07-25 15:07:11 09BB28518A1A14EE66D182FBAC3041DD 348682 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave24.zip
2013-07-25 15:07:09 6EB3A1B1A86F3DD52DB19A9A7C961A57 348616 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave22.zip
2013-07-25 14:52:56 4075459DD814B6269EDC70158CC8B733 652867 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\94da88d1-2b48-47d3-89de-e1ccefac356f.zip
2013-07-25 14:29:21 6A2BD3B434BCED0A8C7CCD3927A75C05 1171317 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\45e76c82-2b25-47d3-8a24-e1ccefac356f.zip
2013-07-19 14:06:56 6F3AAC92A4F83948B47CECB8DC1E744F 3960 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\ef21813c-268e-47d3-867e-e1ccefac356f.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="C:\Program Files (x86)\AVG\AVG2013\avgui.exe /TRAYONLY"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]
"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""


==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BCSSync]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BCSSync"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MCShield Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MCShield Monitor"
"hkey"="HKCU"
"command"="C:\\Program Files (x86)\\MCShield\\MCShieldRTM.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WinampAgent"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Winamp\\winampa.exe\""


==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undetermined Task]
C:\Windows\tasks\schedule\Undetermined Task.exe []

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default
3D76B5C0E02ECC19C1F5756E8FD97F72 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director
2EE9DCAE1D70ABF4D058688DE35F8221 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.16
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dhfcbmlocifngpbjdpgnkbjmgkadkjpp - C:\Program Files (x86)\Industriya\privitize\1.8.21.6\privitize.crx[]
nbmafkdmkkckhggblphicnnhlgljnoje - C:\Program Files (x86)\TornTV.com\torn2_10.crx[]

Google Docs - Home - default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Home - default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Home - default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Home - default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Slagalica fer igra - Ludara.com - Home - default\Extensions\ejpifakoabdhigpeebhalfkjkoidenba
Gmail - Home - default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{18401191-9920-4692-8096-1EA7F09EA828} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}"

==== EOF on pet 26.07.2013 at 10:47:22,29 ======================

Dopuna: 26 Jul 2013 14:07

Greška ovo je isti sadržaj sad ću vam dati pravi.

Dopuna: 26 Jul 2013 14:19

Kad mi se restartovao kompjuter dobio sam dve datoteke pod imenom folders i files. Evo sadržaja
https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

Poslao: 26 Jul 2013 14:21
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Pogledaj na C:\zoek-results.log

Poslao: 26 Jul 2013 14:42
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 424
  • Gde živiš: U kući

Napisano: 26 Jul 2013 14:41

Zoek.exe Version 4.0.0.4 Updated 21-07-2013
Tool run by Home on pet 26.07.2013 at 14:06:21,05.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Home\Desktop\zoek.exe [Script inserted]

==== System Restore Info ======================

26.7.2013 14:08:05 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\prefs.js:
user_pref("browser.startup.homepage", "www.google.rs");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.useDBForOrder", "false");

Added to C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\prefs.js:

ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default

user.js not found
---- Lines toolbar removed from prefs.js ----


---- Lines toolbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ----

prefs_26.07.2013_1410_.backup

==== Deleting Files \ Folders ======================

"C:\WINDOWS\Tasks\At*.job" not found
"C:\Program Files (x86)\TornTV.com" not found
"C:\Program Files (x86)\Industriya" not found
"C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe" deleted
"C:\ProgramData\InstallMate\OptimizerPro\Setup.exe" deleted
"C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe" deleted
"C:\windows\SysNative\Tasks\EPUpdater" deleted
"C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\searchplugins\ask-web-search.xml" deleted
"C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\searchplugins\ask-web-search.xml" deleted
"C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe" deleted
"C:\Users\Home\AppData\Roaming\DRPSu" deleted
"C:\Program Files (x86)\Vittalia" deleted
"C:\Users\Home\AppData\Roaming\DRPSu" deleted
"C:\ProgramData\StarApp" deleted
"C:\ProgramData\BetterSoft" not deleted
"C:\ProgramData\InstallMate" deleted
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SearchNewTab" deleted
"C:\ProgramData\BetterSoft\OptimizerPro" not deleted

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default
3D76B5C0E02ECC19C1F5756E8FD97F72 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director
2EE9DCAE1D70ABF4D058688DE35F8221 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.16
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dhfcbmlocifngpbjdpgnkbjmgkadkjpp - C:\Program Files (x86)\Industriya\privitize\1.8.21.6\privitize.crx[]
nbmafkdmkkckhggblphicnnhlgljnoje - C:\Program Files (x86)\TornTV.com\torn2_10.crx[]

Google Docs - Home - default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Home - default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Home - default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Home - default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Slagalica fer igra - Ludara.com - Home - default\Extensions\ejpifakoabdhigpeebhalfkjkoidenba
Gmail - Home - default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{18401191-9920-4692-8096-1EA7F09EA828} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\users\Home\AppData\Local\Google\Chrome\User Data\default\Preferences was reset successfully
C:\users\Home\AppData\Local\Google\Chrome\User Data\default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\dhfcbmlocifngpbjdpgnkbjmgkadkjpp deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\users\Home\AppData\Local\Mozilla\Firefox\Profiles\94yugiu7.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\users\Home\AppData\Local\Google\Chrome\User Data\default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

Dopuna: 26 Jul 2013 14:42

Našao sam samo ovo.

Poslao: 26 Jul 2013 14:45
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Ima li detekcije sada?

Poslao: 26 Jul 2013 15:06
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 424
  • Gde živiš: U kući

Sad je ovako

Poslao: 26 Jul 2013 15:33
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Uradi update SpyBot-a, pokreni ga desni klik Run as Administrator, trebalo bi da obrise taj reg unos.

MyCity » Ambulanta -> Arhiva Ambulante » Zašto spybot ne može da ih ukloni?

Ko je trenutno na forumu
 

Ukupno su 901 korisnika na forumu :: 13 registrovanih, 2 sakrivenih i 886 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: bato, BlekMen, gorican, goxin, Kriglord, Kristian_KG, Sir Budimir, sovanova95, Valter071, vaso1, vlad4, wizzardone, zdrebac