MyCity » Ambulanta -> Arhiva Ambulante » kineski program

kineski program

Napisano na dan: 21.5.2016
1

kineski program
Sledeća strana Pagination

Idi na vrh

Poslao: 21 Maj 2016 12:57
Idi na vrh
offline
  • Pridružio: 23 Apr 2014
  • Poruke: 28

Udjem na ctrl+ALT+delete da vidim pokrenute programe, posto sam video da mi se komp zamara, i provalim neka kineska slova
Hteo sam danas da instaliram neki programcic i skontao da mi je neki kineski antivirus upao
pokusao sam da ga lociram i izbrisem ali bezuspesno... kako da ga se resim...

Poslao: 21 Maj 2016 13:05
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Pozdrav,

Postavi FRST izvestaje ovde. Neko od moderatora ce prebaciti ovu temu u Ambulantu.
http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

Poslao: 21 Maj 2016 13:11
Idi na vrh
offline
  • Pridružio: 23 Apr 2014
  • Poruke: 28

Ne razumem sta je FRST, slabo se razumem u racunare....znam da postoji neki teamviewer ili tako nesto preko cega bi neko drugi mogao da udje u moj racunar...je l bi mogao neko tako da mi resi ovaj problem?: D

Poslao: 21 Maj 2016 13:15
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Ne, ne pruzamo remote assistance. Da si procitao link koji sam ti lepo dao, znao bi sta je FRST.

Poslao: 21 Maj 2016 13:32
Idi na vrh
offline
  • Pridružio: 23 Apr 2014
  • Poruke: 28

Napisano: 21 Maj 2016 14:28

Video sam da je to izvestaj onog programa koji je sacuvan u textualnom dokumentu nego nailazim na jos jedan problem. Ne mogu da skinem taj program zato sto ovaj kinez ne dozvoljava prijavu na windows account, a bez nje ne moze da se skine nista na racunaru...
Znaci primorava me da iskljucim zastitu ali ne znam kako
Imam windows 10

Dopuna: 21 Maj 2016 14:32

Uspeo sam da pokrenem farbar scan

+ Addition.txt

Poslao: 21 Maj 2016 13:36
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Dostavi FRST.txt takodje, on je osnova.

Poslao: 21 Maj 2016 13:36
Idi na vrh
offline
  • Pridružio: 23 Apr 2014
  • Poruke: 28

Izve�taj skeniranja od Farbar Recovery Scan Tool (FRST) (x64) Verzija:21-05-2016
Pokrenuo Nikola (administrator) na DESKTOP-3LJ4T9R (21-05-2016 14:30:57)
Pokrenuto sa C:\Users\Nikola\AppData\Local\Microsoft\Windows\INetCache\IE\8P1K0IJJ
U�itani Profili: Nikola (Dostupani Profili: Nikola)
Platform: Windows 10 Pro (X64) Jezik: srpski (latinica, Srbija)
Internet Explorer Verzija 11 (Podrazumevani pregleda�: Edge)
Re�im pokretanja sistema: Normal
Vodi� za Farbar Recovery Scan Tool: geekstogo.com/forum/topic/335081-frst-t.....scan-tool/

==================== Procesi (Na Beloj Listi) =================

(Ukoliko je stavka une�ena u fixlist, proces ce biti zatvoren. Datoteka nece biti preme�ten.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Plays.tv, LLC) C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Plays.tv, LLC) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
(Tencent) C:\Program Files (x86)\Common Files\Tencent\QQDownload\130\Tencentdl.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\LicensingUI.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_ep64.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10240.16719_none_11647d1561f368c0\TiWorker.exe


==================== Registar (Na Beloj Listi) ===========================

(Ukoliko je stavka une�ena u fixlist, registru stavka ce biti vra�ena na podrazumevanu vrednost ili uklonjena. Datoteka ne�e biti preme�tena.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2771576 2015-12-09] (NVIDIA Corporation)
HKLM-x32\...\Run: [StereoLinksInstall] => C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvstlink.exe [596784 2015-11-24] (NVIDIA Corporation)
HKLM-x32\...\Run: [PlaysTV] => C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe [71440 2016-05-09] (Plays.tv, LLC)
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe [362304 2016-05-21] (Tencent)
HKU\S-1-5-21-4227490223-4105165237-4186389179-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8591272 2015-11-16] (Piriform Ltd)
HKU\S-1-5-21-4227490223-4105165237-4186389179-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-4227490223-4105165237-4186389179-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-04-30] (Valve Corporation)
HKU\S-1-5-21-4227490223-4105165237-4186389179-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => Nema Datoteke

==================== Internet (Na Beloj Listi) ====================

(Ukoliko je stavka une�ena u fixlist, ako je to registru stavka, bi�e uklonjena ili vra�ena na podrazumevanu vrednost.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.22
Tcpip\..\Interfaces\{b274b6aa-162a-4016-8dee-6c19f0e91b85}: [DhcpNameServer] 192.168.1.22

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://hao.qq.com/?unc=Af31026&s=o400493_1
HKU\S-1-5-21-4227490223-4105165237-4186389179-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hao.qq.com/?unc=Af31026&s=o400493_1
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSWebMon64.dat [2016-05-21] (Tencent)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-04-29] (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-04-29] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-04-29] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-04-29] (Microsoft Corporation)

Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-4227490223-4105165237-4186389179-1001 -> hxxp://www.google.rs/

FireFox:
========
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-11-24] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-11-24] (NVIDIA Corporation)
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\npQMExtensionsMozilla.dll [2016-05-21] (Tencent Technology (Shenzhen) Company Limited)

==================== Servisi (Na Beloj Listi) ========================

(Ukoliko je stavka une�ena u fixlist, bi�e uklonjena iz registra. Datoteka ne�e biti preme�tena ukoliko nije izlistana zasebno..)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-04-29] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-04-29] (Microsoft Corporation)
S3 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156400 2015-11-25] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-12-09] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [8133424 2015-11-25] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5915440 2015-11-25] (NVIDIA Corporation)
R2 PlaysService; C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe [32528 2016-05-09] (Plays.tv, LLC)
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe [313936 2016-05-21] (Tencent)
U2 QQRepair1816; C:\Program Files (x86)\Tencent\QQPCMGR\QQRepair1816 [147176 2016-05-21] ()
S2 QQRepairFixSVC; C:\Program Files (x86)\Tencent\QQPCMGR\QQRepairFixSVC [147176 2016-05-21] ()
S2 shefaleCloudservice; C:\Program Files (x86)\Shefale\shefaleCloudservice.exe [985752 2016-05-19] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

===================== Drajveri (Na Beloj Listi) ==========================

(Ukoliko je stavka une�ena u fixlist, bi�e uklonjena iz registra. Datoteka ne�e biti preme�tena ukoliko nije izlistana zasebno..)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19760 2015-11-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50472 2015-11-25] (NVIDIA Corporation)
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMUdisk64.sys [184952 2016-05-18] (Tencent)
R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQSysMonX64.sys [154744 2016-05-21] (电脑管家)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [587264 2015-07-10] (Realtek )
R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\softaal64.sys [44664 2016-05-21] (Tencent)
R1 SRepairDrv; \??\C:\Program Files (x86)\Tencent\QQPCMGR\SRepairDrv [179320 2016-05-21] ()
R3 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator64.sys [99480 2016-05-21] (Tencent)
R2 TAOKernelDriver; C:\Windows\system32\Drivers\TAOKernelEx64.sys [143992 2016-05-21] (Tencent Technology(Shenzhen) Company Limited)
R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [97400 2016-05-21] (电脑管家)
S1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSDefenseBT64.sys [28984 2016-05-21] (Tencent)
R2 tsnethlpx64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TsNetHlpX64.sys [57976 2016-05-21] ()
R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSSysKit64.sys [96888 2016-05-21] (电脑管家)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

==================== NetSvcs (Na Beloj Listi) ===================

(Ukoliko je stavka une�ena u fixlist, bi�e uklonjena iz registra. Datoteka ne�e biti preme�tena ukoliko nije izlistana zasebno..)


==================== Mesec Dana Kreirane Datoteke i Fascikli ========

(Ukoliko je stavka une�ena u fixlist, Datoteka/Fascikla �e biti preme�tena.)

2016-05-21 14:30 - 2016-05-21 14:30 - 00000000 ____D C:\FRST
2016-05-21 14:23 - 2016-05-21 14:23 - 00016148 _____ C:\Windows\system32\DESKTOP-3LJ4T9R_Nikola_HistoryPrediction.bin
2016-05-21 14:16 - 2016-05-21 14:16 - 00000000 ____D C:\Users\Nikola\AppData\Local\ElevatedDiagnostics
2016-05-21 13:51 - 2016-05-21 13:51 - 00005744 _____ C:\Users\Nikola\Desktop\fixlist.txt
2016-05-21 13:51 - 2016-05-21 13:51 - 00005744 _____ C:\Users\Nikola\Desktop\ficlist.txt
2016-05-21 13:50 - 2016-05-21 13:50 - 00000000 _____ C:\Users\Nikola\Desktop\Novi tekstualni dokument.txt
2016-05-21 13:48 - 2016-05-21 13:48 - 00000000 ____D C:\Users\Nikola\AppData\Local\Plugins
2016-05-21 13:42 - 2016-05-21 13:42 - 00002203 _____ C:\ProgramData\svchost.exe.lnk
2016-05-21 11:28 - 2016-05-21 11:28 - 00008942 _____ C:\Windows\System32\Tasks\Shefale Cloud
2016-05-21 11:28 - 2016-05-21 11:28 - 00000718 __RSH C:\ProgramData\ntuser.pol
2016-05-21 11:28 - 2016-05-21 11:28 - 00000000 ____D C:\extensions
2016-05-21 11:27 - 2016-05-21 13:38 - 00000000 ____D C:\Program Files (x86)\Razoghchak
2016-05-21 11:27 - 2016-05-21 11:28 - 00000000 ____D C:\Program Files (x86)\Shefale
2016-05-21 11:27 - 2016-05-21 11:28 - 00000000 ____D C:\Program Files (x86)\Platoward
2016-05-21 11:27 - 2016-05-21 11:27 - 00001138 _____ C:\Users\Nikola\Desktop\Continue installation .lnk
2016-05-21 11:16 - 2016-05-21 14:23 - 00000000 ____D C:\ProgramData\TXQMPC
2016-05-21 11:16 - 2016-05-21 11:16 - 00000000 ____D C:\Program Files\Common Files\Tencent
2016-05-21 11:16 - 2016-05-21 11:15 - 00143992 _____ (Tencent Technology(Shenzhen) Company Limited) C:\Windows\system32\Drivers\TAOKernelEx64.sys
2016-05-21 11:16 - 2016-05-21 11:15 - 00099480 _____ (Tencent) C:\Windows\system32\Drivers\TAOAccelerator64.sys
2016-05-21 11:15 - 2016-05-21 12:15 - 00000000 ____D C:\ProgramData\Tencent
2016-05-21 11:15 - 2016-05-21 11:38 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\Tencent
2016-05-21 11:15 - 2016-05-21 11:15 - 00097400 _____ (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2016-05-21 11:15 - 2016-05-21 11:15 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2016-05-21 11:15 - 2016-05-21 11:15 - 00000000 ____D C:\Program Files (x86)\Tencent
2016-05-21 11:13 - 2016-05-21 11:13 - 00293320 _____ (深圳市迅雷网络技术有限公司) C:\ProgramData\xldl.dll
2016-05-21 11:13 - 2016-05-21 11:13 - 00000000 ____D C:\Users\Public\Thunder Network
2016-05-21 11:13 - 2016-05-21 11:13 - 00000000 ____D C:\ProgramData\Thunder Network
2016-05-21 11:13 - 2016-05-21 11:13 - 00000000 ____D C:\ProgramData\download
2016-05-21 11:12 - 2016-05-21 11:12 - 02400202 _____ C:\Windows\chromebrowser.exe
2016-05-21 10:49 - 2016-05-21 10:49 - 00347884 _____ C:\Users\Nikola\Downloads\odbrana sokratova.pdf
2016-05-21 10:34 - 2016-05-21 10:34 - 00002689 _____ C:\Users\Nikola\Desktop\�Torrent.lnk
2016-05-21 10:33 - 2016-05-21 13:33 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\uTorrent
2016-05-20 22:30 - 2016-05-20 22:30 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\Raptr
2016-05-20 22:29 - 2016-05-21 14:24 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\PlaysTV
2016-05-20 22:29 - 2016-05-20 22:29 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\library_dir
2016-05-20 22:29 - 2016-05-20 22:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlaysTV
2016-05-20 22:29 - 2016-05-20 22:29 - 00000000 ____D C:\Program Files (x86)\Raptr Inc
2016-05-20 22:29 - 2016-05-20 22:29 - 00000000 ____D C:\Program Files (x86)\PlaysTV
2016-05-10 20:45 - 2016-04-22 07:52 - 00572928 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-05-10 20:45 - 2016-04-22 07:44 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-05-10 20:45 - 2016-04-15 09:21 - 01085776 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2016-05-10 20:45 - 2016-04-15 08:43 - 00916800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2016-05-10 20:45 - 2016-04-15 08:18 - 24593408 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-05-10 20:45 - 2016-04-15 08:14 - 00349184 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2016-05-10 20:45 - 2016-04-15 08:06 - 00602624 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2016-05-10 20:45 - 2016-04-15 08:05 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\CloudDomainJoinDataModelServer.dll
2016-05-10 20:45 - 2016-04-15 08:01 - 03586560 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-05-10 20:45 - 2016-04-15 08:01 - 01381376 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-05-10 20:45 - 2016-04-15 07:59 - 04791808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-05-10 20:45 - 2016-04-15 07:55 - 19325952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-05-10 20:45 - 2016-04-15 07:42 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2016-05-10 20:45 - 2016-04-15 07:39 - 03580416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-05-10 20:45 - 2016-04-09 12:58 - 01365584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-05-10 20:45 - 2016-04-09 12:53 - 01535032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-05-10 20:45 - 2016-04-09 12:52 - 00705520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-05-10 20:45 - 2016-04-09 12:52 - 00502504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2016-05-10 20:45 - 2016-04-09 12:12 - 08021856 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-05-10 20:45 - 2016-04-09 12:10 - 01824872 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-05-10 20:45 - 2016-04-09 12:10 - 00609976 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2016-05-10 20:45 - 2016-04-09 12:06 - 01981280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-05-10 20:45 - 2016-04-09 12:05 - 01199368 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-05-10 20:45 - 2016-04-09 12:05 - 00331616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2016-05-10 20:45 - 2016-04-09 12:04 - 02430304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-05-10 20:45 - 2016-04-09 12:04 - 01592360 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-05-10 20:45 - 2016-04-09 11:50 - 01515936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-05-10 20:45 - 2016-04-09 11:04 - 01780352 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-05-10 20:45 - 2016-04-09 10:13 - 05160960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-05-10 20:45 - 2016-04-09 10:09 - 01380864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-05-10 20:45 - 2016-04-09 10:09 - 00650240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-05-10 20:45 - 2016-04-09 10:09 - 00574464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakradiag.dll
2016-05-10 20:45 - 2016-04-09 09:55 - 00373248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-05-10 20:45 - 2016-04-09 09:54 - 00768000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-05-10 20:45 - 2016-04-09 09:52 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2016-05-10 20:45 - 2016-04-09 09:38 - 00464384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2016-05-10 20:45 - 2016-04-09 09:22 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2016-05-10 20:45 - 2016-04-09 09:18 - 11264000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-05-10 20:45 - 2016-04-09 09:18 - 05454848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-05-10 20:45 - 2016-04-09 09:14 - 18798080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-05-10 20:45 - 2016-04-09 09:10 - 12504576 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-05-10 20:45 - 2016-04-09 09:09 - 06788608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-05-10 20:45 - 2016-04-09 09:06 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-05-10 20:45 - 2016-04-09 09:05 - 01602560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-05-10 20:45 - 2016-04-09 09:05 - 00771072 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-05-10 20:45 - 2016-04-09 08:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-05-10 20:45 - 2016-04-09 08:42 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-05-10 20:45 - 2016-04-09 08:41 - 00253952 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2016-05-10 20:45 - 2016-04-09 08:27 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2016-05-10 20:45 - 2016-04-09 08:13 - 21859328 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-05-10 20:45 - 2016-04-09 08:02 - 07521280 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-04-24 15:03 - 2016-04-24 15:03 - 00235944 ____R C:\Users\Nikola\Downloads\Presentation 2 (1).pptx
2016-04-24 15:03 - 2016-04-24 15:03 - 00235944 _____ C:\Users\Nikola\Downloads\Presentation 2.pptx

==================== Mesec Dana Modifikovane Datoteke i Fascikli ========

(Ukoliko je stavka une�ena u fixlist, Datoteka/Fascikla �e biti preme�tena.)

2016-05-21 14:25 - 2015-12-21 20:48 - 00000000 ____D C:\Users\Nikola\AppData\Local\CrashDumps
2016-05-21 14:22 - 2015-12-13 18:21 - 00000000 ____D C:\ProgramData\NVIDIA
2016-05-21 14:22 - 2015-07-10 14:21 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-21 14:22 - 2015-07-10 11:05 - 00524288 ___SH C:\Windows\system32\config\BBI
2016-05-21 14:14 - 2015-12-13 17:49 - 00003378 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{04DC5424-BBC2-4748-8961-70E57534DF28}
2016-05-21 14:05 - 2015-12-13 17:53 - 00002224 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-05-21 13:52 - 2015-07-10 13:04 - 00000000 ____D C:\Windows\AppReadiness
2016-05-21 13:48 - 2016-01-03 17:32 - 00000000 ____D C:\Users\Nikola\AppData\Local\MalwareProtectionLive
2016-05-21 13:40 - 2015-07-10 14:20 - 00202704 _____ C:\Windows\system32\FNTCACHE.DAT
2016-05-21 11:28 - 2015-07-10 13:04 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-05-21 11:28 - 2015-07-10 13:04 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2016-05-21 11:15 - 2015-12-14 00:32 - 00000000 ____D C:\Users\Nikola\AppData\Local\VirtualStore
2016-05-20 22:30 - 2016-01-09 23:57 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\NVIDIA
2016-05-20 15:25 - 2015-12-25 22:48 - 00000000 ____D C:\Program Files (x86)\Steam
2016-05-20 14:34 - 2015-07-10 13:04 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-15 04:57 - 2015-12-14 00:32 - 00000000 ____D C:\Users\Nikola
2016-05-15 04:48 - 2016-01-08 22:08 - 00000000 ____D C:\Users\Nikola\AppData\Roaming\ActivePresenter
2016-05-14 22:31 - 2015-07-10 12:55 - 00000000 ____D C:\Windows\CbsTemp
2016-05-12 19:46 - 2015-12-17 20:20 - 00000000 ____D C:\Users\Nikola\Desktop\Nova fascikla
2016-05-12 18:08 - 2015-07-10 13:04 - 00000000 ____D C:\Windows\rescache
2016-05-11 21:50 - 2015-07-10 13:06 - 00829944 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-05-11 21:50 - 2015-07-10 13:06 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-05-11 13:22 - 2015-12-14 00:34 - 00830266 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-11 13:22 - 2015-07-10 13:02 - 00000000 ____D C:\Windows\INF
2016-05-11 11:21 - 2015-07-10 18:00 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-10 22:04 - 2015-12-15 15:17 - 00000000 ____D C:\Windows\system32\MRT
2016-05-10 21:58 - 2015-12-15 15:17 - 139319312 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-05-08 20:44 - 2015-12-17 01:23 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-05-03 12:05 - 2015-12-14 00:32 - 00000000 ____D C:\Users\Nikola\AppData\Local\Packages
2016-04-22 09:57 - 2015-12-13 21:27 - 00453288 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Datoteke u korenu nekih direktorijuma =======

2016-01-15 18:26 - 2016-01-15 18:26 - 0007598 _____ () C:\Users\Nikola\AppData\Local\Resmon.ResmonCfg
2016-05-21 13:42 - 2016-05-21 13:42 - 0002203 _____ () C:\ProgramData\svchost.exe.lnk
2016-05-21 11:13 - 2016-05-21 11:13 - 0293320 _____ (深圳市迅雷网络技术有限公司) C:\ProgramData\xldl.dll

Files to move or delete:
====================
C:\ProgramData\xldl.dll


Neke Datoteke u TEMP:
====================
C:\Users\Nikola\AppData\Local\Temp\acc.exe
C:\Users\Nikola\AppData\Local\Temp\ads.exe
C:\Users\Nikola\AppData\Local\Temp\appstart.exe
C:\Users\Nikola\AppData\Local\Temp\CodecFixDivx.exe
C:\Users\Nikola\AppData\Local\Temp\dxdiag.exe
C:\Users\Nikola\AppData\Local\Temp\MediaPlayer__11426.exe
C:\Users\Nikola\AppData\Local\Temp\msconfig.exe
C:\Users\Nikola\AppData\Local\Temp\nvStInst.exe
C:\Users\Nikola\AppData\Local\Temp\qqpcmgr_v11.5.17490.219_45527_Silence.exe


==================== Bamital & volsnap =================

(Ne postoji automatizovan popravak za datoteke koji nisu pro�le verifikaciju.)

C:\Windows\system32\winlogon.exe => Datoteka je digitalno potpisana
C:\Windows\system32\wininit.exe => Datoteka je digitalno potpisana
C:\Windows\explorer.exe => Datoteka je digitalno potpisana
C:\Windows\SysWOW64\explorer.exe => Datoteka je digitalno potpisana
C:\Windows\system32\svchost.exe => Datoteka je digitalno potpisana
C:\Windows\SysWOW64\svchost.exe => Datoteka je digitalno potpisana
C:\Windows\system32\services.exe => Datoteka je digitalno potpisana
C:\Windows\system32\User32.dll => Datoteka je digitalno potpisana
C:\Windows\SysWOW64\User32.dll => Datoteka je digitalno potpisana
C:\Windows\system32\userinit.exe => Datoteka je digitalno potpisana
C:\Windows\SysWOW64\userinit.exe => Datoteka je digitalno potpisana
C:\Windows\system32\rpcss.dll => Datoteka je digitalno potpisana
C:\Windows\system32\dnsapi.dll => Datoteka je digitalno potpisana
C:\Windows\SysWOW64\dnsapi.dll => Datoteka je digitalno potpisana
C:\Windows\system32\Drivers\volsnap.sys => Datoteka je digitalno potpisana


LastRegBack: 2016-05-11 14:35

==================== Kraj od FRST.txt ============================

Poslao: 21 Maj 2016 13:40
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Eto, vidis da se moze. Smile

Prvo da probamo ovo da odradimo na jednostavniji nacin i bez velike filozofije.

Pronadji C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219 i u njemu bi trebao da se nalazi file Uninst.exe. Pokreni ga kao Administrator i klikci dugmice (kineska slova) dok ne ubodes dugme za potvrdu deinstalacije. Odgledaj video klip (od 0:50 -> ) za pomoc;



Malo se pomuci i kada uspes (ako uspes) javi rezultate da bih znao moj sledeci korak.

Poslao: 21 Maj 2016 13:49
Idi na vrh
offline
  • Pridružio: 23 Apr 2014
  • Poruke: 28

Sredjeno...
Dodjem ti pice Very Happy
HVALA Very Happy

Poslao: 21 Maj 2016 13:53
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6103

Nije jos gotovo... Smile

Ponovo pokreni FRST i iskopiraj mi svez FRST.txt da vidim ima li nekih ostataka.

MyCity » Ambulanta -> Arhiva Ambulante » kineski program

Ko je trenutno na forumu
 

Ukupno su 746 korisnika na forumu :: 31 registrovanih, 2 sakrivenih i 713 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., Alibaba1981, Boris BM, Dannyboy, darkangel, Djokislav, Djole, DragoslavS, indja, janbo, Komentator, krkalon, Lazarus, loon123, Luka1998, marsovac 2, Mi lao shu, Mixelotti, naki011, nenad81, nikoladim, Njemac, pein, Petar35, RecA, ruma, Trpe Grozni, vladetije, vladulns, W123, |_MeD_|