malicious software

malicious software

offline
  • Pridružio: 26 Jan 2006
  • Poruke: 233

dakle, imam racunar sa operativnim sistemom windows 7 x64 ultimate, anti virus software je bio microsoft security essentials.
simptomi su sledeci. chrome se otvara sam od sebe. ja sam brisao sa malware bytes-om malware i od tada je stao sa iskakanjem, ali stalno mu se pojavljuju u dodacima neki ruski dodaci i dodatak splinter search. microsoft esentials ne moze da se azurira izbacuje neku gresku i ja sam ga deinstalirao. praznio sam sve temp fajlove i primetio sam da se u c:\users pojavljuje folder {username}. Takodje,show hidden files kad ukljucim nista se ne desava, ne pokazuje skrivene fajlove isto tako i sistemske fajlove. kad pokusam da nesto promenim u registry prikazuje mi da je access denied iako imam vlasnistvo nad tim kljucevima. u control panel uninnstal programs sklonio sam sumljive programe bar koje sam ja mislio da su sumljivi.
frst.txt je

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-05-2017
Ran by Administrator (administrator) on HOME-PC (21-05-2017 15:43:12)
Running from C:\Users\Administrator\Downloads
Loaded Profiles: Administrator (Available Profiles: home & Administrator)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-t.....scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
(Microsoft Corporation) C:\Windows\System32\Locator.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Sysinternals - www.sysinternals.com) C:\Users\Administrator\Downloads\ProcessExplorer\procexp64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6843024 2012-10-29] (Realtek Semiconductor)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [5006536 2016-03-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14522512 2017-04-03] (Copyright 2017.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-05-20] (Oracle Corporation)
HKU\S-1-5-21-891269962-2659327078-604941568-500\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
ShellExecuteHooks: No Name - {F797446C-D3F2-11E6-AB72-64006A5CFC35} - C:\Users\home\AppData\Roaming\Terlcultclhach\Hejuck.dll -> No File
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\home\AppData\Local\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\home\AppData\Local\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\home\AppData\Local\MEGAsync\ShellExtX64.dll -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\home\AppData\Local\MEGAsync\ShellExtX32.dll -> No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\home\AppData\Local\MEGAsync\ShellExtX32.dll -> No File
ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\home\AppData\Local\MEGAsync\ShellExtX32.dll -> No File
Startup: C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\pLBfEuNP.lnk [2015-12-27]
Startup: C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\Twitch.lnk [2017-04-11]
ShortcutTarget: Twitch.lnk -> C:\Users\Administrator\AppData\Roaming\Curse Client\Bin\Twitch.exe (No File)
Startup: C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\xBchppIcvKkI.lnk [2015-12-27]
BootExecute: autocheck autochk * Partizan
GroupPolicyScripts\User: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{AB0801C9-0579-42DD-935D-4B2453D6B2CA}: [DhcpNameServer] 212.200.191.166 212.200.190.166

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-891269962-2659327078-604941568-500\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-891269962-2659327078-604941568-500\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-891269962-2659327078-604941568-500\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-05-31] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-31] (Oracle Corporation)
BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems Incorporated)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-04-02] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-02] (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-09-23] (Skype Technologies)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-12-10] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-31] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-31] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll [2013-12-05] (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-04-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-02] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-17] (Google Inc.)

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

Opera:
=======
StartMenuInternet: (HKLM) OPERASTABLE - Opera.exe

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S4 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
R2 Auhardwaregl; C:\Windows\SysWow64\Auhardwaregl.dll [454440 2017-05-17] ()
S4 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1465352 2017-01-13] ()
S4 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [428056 2017-03-03] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [406040 2017-03-03] (BlueStack Systems, Inc.)
S4 BstHdPlusAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Plus-Service.exe [452632 2017-03-03] (BlueStack Systems, Inc.)
S4 Disc Soft Lite Bus Service; E:\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1467072 2016-05-30] (Disc Soft Ltd)
S4 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [382504 2017-04-19] (EasyAntiCheat Ltd)
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [143872 2014-10-24] (Microsoft Corporation) [File not signed]
S4 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3416584 2017-03-02] (LogMeIn Inc.)
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S4 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2017-02-27] (LogMeIn, Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [122368 2015-02-26] (Microsoft Corporation) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 XperiaCompanionService; C:\Program Files\Sony\Xperia Companion\Service\XperiaCompanionService.exe [2205568 2017-03-21] (Sony)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14522512 2017-04-03] (Copyright 2017.)
S4 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [X]
S4 HnGSteamService; C:\Program Files (x86)\Steam\steamapps\common\Heroes & Generals\hngservice.exe [X]
S4 netsvc; C:\Program Files (x86)\UtilTool\Antivirus\netsvc.exe [X]
S4 Origin Client Service; "C:\Program Files (x86)\Origin\OriginClientService.exe" [X]
S4 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\KMPService.exe [X]
S4 SQLBrowser; "c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S3 AVFSFilter; C:\Windows\System32\DRIVERS\avfsfilter.sys [13720 2012-09-07] ()
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [152672 2017-03-03] (BlueStack Systems)
R2 BstkDrv; C:\Program Files (x86)\BlueStacks\BstkDrv.sys [270904 2017-03-03] (Bluestack System Inc. )
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-04-14] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-04-14] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-05-09] ()
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2017-04-16] (Sony Mobile Communications)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [55232 2017-05-19] ()
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [187320 2017-05-18] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [113592 2017-05-21] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-05-21] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [251832 2017-05-21] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [84256 2017-05-21] (Malwarebytes)
R1 netboostmaster; C:\Windows\system32\drivers\netboostmaster.sys [2894184 2017-05-18] () [File not signed]
S3 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [11973 2016-07-22] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [File not signed]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [394296 2016-04-14] (Duplex Secure Ltd.)
S3 tap0901_openvpn_accl; C:\Windows\System32\DRIVERS\tap0901_openvpn_accl.sys [37912 2016-11-10] (The OpenVPN Project)
R2 Uefochubsrv; C:\Windows\system32\drivers\Uefochubsrv.sys [196640 2017-05-17] ()
R1 ZAM; C:\Windows\System32\drivers\zam64.sys [203680 2017-05-21] (Zemana Ltd.)
R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-05-21] (Zemana Ltd.)
U3 asqw883q; no ImagePath
S1 aqhiqflc; \??\C:\Windows\system32\drivers\aqhiqflc.sys [X]
U0 aswVmm; no ImagePath
S1 lnsubgoh; \??\C:\Windows\system32\drivers\lnsubgoh.sys [X]
S1 netcontroller; system32\drivers\netcontroller.sys [X]
S1 p1483530829am; \??\C:\Users\home\AppData\Local\Temp\bk3BC8.tmp\p1483530829am.sys [X] <==== ATTENTION
U0 Partizan; system32\drivers\Partizan.sys [X]
S1 qaqjosyy; \??\C:\Windows\system32\drivers\qaqjosyy.sys [X]
S3 TrojanKillerDriver; system32\DRIVERS\gtkdrv.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 VSPerfDrv100; \??\C:\Program Files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [X]
S1 whklgyqq; \??\C:\Windows\system32\drivers\whklgyqq.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-22 01:26 - 2017-05-22 01:26 - 00005292 _____ C:\Users\Administrator\Documents\swprv.reg
2017-05-21 15:43 - 2017-05-21 15:43 - 00018672 _____ C:\Users\Administrator\Downloads\FRST.txt
2017-05-21 15:43 - 2017-05-21 15:43 - 00000000 ____D C:\FRST
2017-05-21 15:42 - 2017-05-21 15:42 - 02429952 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2017-05-21 15:31 - 2017-05-21 15:31 - 00000000 ____D C:\Users\{username}
2017-05-21 15:28 - 2017-05-21 15:43 - 00494578 _____ C:\Windows\ZAM.krnl.trace
2017-05-21 15:28 - 2017-05-21 15:43 - 00112193 _____ C:\Windows\ZAM_Guard.krnl.trace
2017-05-21 13:14 - 2017-05-21 13:14 - 00000406 _____ C:\Users\Administrator\Desktop\zemana.txt
2017-05-21 12:25 - 2017-05-21 12:29 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2017-05-21 12:25 - 2017-05-21 12:25 - 00203680 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zamguard64.sys
2017-05-21 12:25 - 2017-05-21 12:25 - 00203680 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zam64.sys
2017-05-21 12:25 - 2017-05-21 12:25 - 00001104 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2017-05-21 12:25 - 2017-05-21 12:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2017-05-21 12:24 - 2017-05-21 12:24 - 05774688 _____ (Zemana Ltd. ) C:\Users\Administrator\Downloads\Zemana.AntiMalware.Setup.exe
2017-05-21 10:26 - 2017-05-21 15:31 - 00002211 _____ C:\Users\Administrator\Desktop\Google Chrome.lnk
2017-05-21 10:14 - 2017-05-21 10:14 - 00000000 ____D C:\Users\Administrator\Desktop\osam_autorun_manager_5_0_portable
2017-05-21 10:10 - 2017-05-21 10:11 - 04272474 _____ C:\Users\Administrator\Desktop\osam_autorun_manager_5_0_portable.rar
2017-05-21 10:10 - 2017-05-21 10:10 - 00688992 ____R (Swearware) C:\Users\Administrator\Desktop\dds.scr
2017-05-20 23:49 - 2017-05-21 00:00 - 00000000 ____D C:\Users\Public\Documents\regruninfo
2017-05-20 23:49 - 2017-05-20 23:56 - 00000000 ____D C:\Users\Administrator\Documents\RegRun2
2017-05-20 23:49 - 2017-05-20 23:52 - 00000000 ____D C:\Program Files (x86)\UnHackMe
2017-05-20 23:49 - 2017-05-20 23:49 - 00000963 _____ C:\Users\Administrator\Desktop\UnHackMe.lnk
2017-05-20 23:49 - 2017-05-20 23:49 - 00000418 _____ C:\Windows\Tasks\UnHackMe Task Scheduler.job
2017-05-20 23:49 - 2017-05-20 23:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UnHackMe
2017-05-20 23:49 - 2017-04-14 12:48 - 00014984 _____ (Greatis Software, LLC.) C:\Windows\SysWOW64\Drivers\UnHackMeDrv.sys
2017-05-20 23:45 - 2017-05-20 23:45 - 00000000 ____D C:\Users\Administrator\Downloads\unhackme
2017-05-20 23:44 - 2017-05-20 23:45 - 18656117 _____ C:\Users\Administrator\Downloads\unhackme.zip
2017-05-20 23:41 - 2017-05-20 23:41 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2017-05-20 23:24 - 2017-05-20 23:24 - 00000000 ____D C:\Users\Administrator\Downloads\ProcessExplorer
2017-05-20 23:18 - 2017-05-20 23:19 - 01931969 _____ C:\Users\Administrator\Downloads\ProcessExplorer.zip
2017-05-20 22:59 - 2017-05-20 22:59 - 11098008 _____ C:\Users\Administrator\Documents\1.reg
2017-05-20 22:58 - 2017-05-20 22:58 - 00000082 _____ C:\Users\Administrator\Documents\security.reg
2017-05-20 22:56 - 2017-05-20 22:56 - 03635734 _____ (Sergey Filippov ) C:\Users\Administrator\Downloads\RegistryFinderSetup2.19.exe
2017-05-20 22:56 - 2017-05-20 22:56 - 00000000 ____D C:\Registry Finder
2017-05-20 22:45 - 2017-05-20 22:47 - 00145568 _____ (Sysinternals) C:\Windows\PSEXESVC.exe
2017-05-20 22:43 - 2017-05-20 22:43 - 00000000 ____D C:\pstools
2017-05-20 22:42 - 2017-05-20 22:42 - 02823905 _____ C:\Users\Administrator\Downloads\PSTools.zip
2017-05-20 22:38 - 2017-05-20 22:38 - 02655480 _____ (Resplendence Software Projects Sp. ) C:\Users\Administrator\Downloads\RegistrarHomeV8.exe
2017-05-20 19:22 - 2017-05-20 19:22 - 00000000 ____D C:\Windows\system32\MpEngineStore
2017-05-19 22:45 - 2017-05-19 22:45 - 01048576 _____ C:\Users\Administrator\Downloads\msert.exe
2017-05-19 22:36 - 2017-05-19 22:36 - 06752896 _____ (ESET spol. s r.o.) C:\Users\Administrator\Downloads\esetonlinescanner_enu.exe
2017-05-19 22:33 - 2017-05-19 22:34 - 15065792 _____ (Microsoft Corporation) C:\Users\Administrator\Downloads\mseinstall.exe
2017-05-19 22:07 - 2017-05-19 22:18 - 00000000 ____D C:\Program Files\Attribute Changer
2017-05-19 22:07 - 2017-05-19 22:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Attribute Changer
2017-05-19 22:07 - 2017-05-19 22:07 - 05126250 _____ (Romain Petges ) C:\Users\Administrator\Downloads\ac-860.exe
2017-05-19 22:03 - 2017-05-19 22:03 - 00000258 __RSH C:\ProgramData\ntuser.pol
2017-05-19 21:50 - 2017-05-19 21:50 - 00001001 _____ C:\Users\Administrator\Desktop\Total Commander 64 bit.lnk
2017-05-19 21:50 - 2017-05-19 21:50 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Commander
2017-05-19 21:50 - 2017-05-19 21:50 - 00000000 ____D C:\Program Files\totalcmd
2017-05-19 21:49 - 2017-05-19 21:49 - 04987672 _____ (Ghisler Software GmbH) C:\Users\Administrator\Downloads\tcmd900ax64.exe
2017-05-19 21:31 - 2017-05-19 21:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-05-19 21:30 - 2017-05-19 21:30 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Administrator\Downloads\mbar-1.09.3.1001.exe
2017-05-19 21:10 - 2017-05-19 21:18 - 00000000 ____D C:\AdwCleaner
2017-05-19 21:10 - 2017-05-19 21:10 - 04110280 _____ C:\Users\Administrator\Downloads\adwcleaner_6.047.exe
2017-05-19 20:19 - 2017-05-19 20:22 - 00055232 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2017-05-19 20:19 - 2017-05-19 20:22 - 00001889 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2017-05-19 20:19 - 2017-05-19 20:19 - 00000000 ____D C:\Program Files\HitmanPro
2017-05-19 20:17 - 2017-05-19 20:20 - 00000000 ____D C:\ProgramData\HitmanPro
2017-05-19 20:17 - 2017-05-19 20:18 - 11584088 _____ (SurfRight B.V.) C:\Users\Administrator\Downloads\HitmanPro_x64.exe
2017-05-19 20:16 - 2017-05-19 20:16 - 11023528 _____ (SurfRight B.V.) C:\Users\Administrator\Downloads\HitmanPro.exe
2017-05-19 20:10 - 2017-05-19 20:10 - 00427648 _____ (Bleeping Computer, LLC) C:\Users\Administrator\Downloads\unhide (1).exe
2017-05-19 19:32 - 2017-05-19 19:57 - 00000000 ____D C:\ComboFix
2017-05-19 19:30 - 2017-05-19 18:55 - 05659512 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe
2017-05-19 19:03 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2017-05-19 19:03 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2017-05-19 19:03 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-05-19 19:03 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-05-19 19:03 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-05-19 19:03 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2017-05-19 19:03 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2017-05-19 19:03 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2017-05-19 18:57 - 2017-05-19 21:21 - 00000000 ____D C:\Qoobox
2017-05-19 18:57 - 2017-05-19 19:54 - 00000000 ____D C:\Windows\erdnt
2017-05-19 18:55 - 2017-05-19 18:55 - 05659512 ____R (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe
2017-05-19 18:49 - 2017-05-19 18:49 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Administrator\Downloads\rkill.exe
2017-05-19 18:33 - 2017-05-19 18:33 - 00000000 ____D C:\Users\Administrator\Downloads\backups
2017-05-19 18:31 - 2017-05-19 18:31 - 00388608 _____ (Trend Micro Inc.) C:\Users\Administrator\Downloads\HijackThis.exe
2017-05-19 05:48 - 2017-05-19 05:48 - 00000000 ____D C:\found.000
2017-05-18 19:07 - 2017-05-18 19:07 - 00395171 _____ C:\Users\Administrator\Downloads\roex.zip
2017-05-18 19:07 - 2017-05-18 19:07 - 00000000 ____D C:\Users\Administrator\Downloads\roex
2017-05-18 18:55 - 2017-05-21 00:04 - 00521074 _____ C:\Windows\ntbtlog.txt
2017-05-18 18:47 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-05-18 18:47 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2017-05-18 18:40 - 2017-05-18 18:40 - 00427648 _____ (Bleeping Computer, LLC) C:\Users\Administrator\Downloads\unhide.exe
2017-05-18 18:29 - 2017-05-18 18:29 - 00001189 _____ C:\Users\Administrator\Documents\show.reg
2017-05-18 17:47 - 2017-05-18 17:49 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\DAEMON Tools Lite
2017-05-18 17:43 - 2017-05-18 17:43 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-05-18 17:43 - 2017-05-18 17:43 - 00000295 _____ C:\Windows\wininit.ini
2017-05-18 17:43 - 2017-05-18 17:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-05-18 17:43 - 2017-05-18 17:43 - 00000000 ____D C:\Program Files\CCleaner
2017-05-18 05:20 - 2017-05-21 13:47 - 00000000 ____D C:\ProgramData\XLiPlatform
2017-05-18 05:18 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2017-05-18 05:18 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-05-18 05:18 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-05-18 05:18 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2017-05-18 05:18 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2017-05-18 05:17 - 2017-05-21 15:28 - 02785072 _____ C:\Windows\netboostmasterHelp.dll
2017-05-18 05:17 - 2017-05-18 05:17 - 02894184 _____ C:\Windows\system32\Drivers\netboostmaster.sys
2017-05-18 05:15 - 2016-04-14 15:49 - 00603648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2017-05-18 05:15 - 2016-04-14 15:21 - 00647680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2017-05-18 05:15 - 2016-04-09 06:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-05-18 05:15 - 2016-04-09 05:52 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-05-18 05:15 - 2015-12-08 23:54 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2017-05-18 05:15 - 2015-12-08 21:07 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-05-18 05:15 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2017-05-18 05:15 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2017-05-18 05:09 - 2017-05-18 05:17 - 00000000 ____D C:\ProgramData\Cache
2017-05-17 18:38 - 2017-05-17 18:39 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Notepad++
2017-05-17 17:52 - 2017-05-21 15:29 - 00251832 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-05-17 17:52 - 2017-05-21 15:29 - 00113592 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-05-17 17:52 - 2017-05-21 15:29 - 00084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-05-17 17:52 - 2017-05-21 15:29 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-05-17 17:52 - 2017-05-18 19:12 - 00187320 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-05-17 17:52 - 2017-05-17 17:52 - 00001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-05-17 17:52 - 2017-05-17 17:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-17 17:51 - 2017-05-17 17:52 - 00000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2017-05-17 17:51 - 2017-05-17 17:51 - 00000000 ____D C:\Program Files\Malwarebytes
2017-05-17 17:51 - 2017-05-09 16:37 - 00077440 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-05-17 17:50 - 2017-05-17 17:50 - 00000000 ____D C:\Users\Public\Documents\Google
2017-05-17 17:43 - 2017-05-17 17:43 - 00454440 _____ C:\Windows\SysWOW64\Auhardwaregl.dll
2017-05-17 17:43 - 2017-05-17 17:43 - 00196640 _____ C:\Windows\system32\Drivers\Uefochubsrv.sys
2017-05-17 17:43 - 2017-05-17 17:43 - 00000000 ____D C:\Users\Public\Documents\XMUpdate
2017-05-17 17:39 - 2017-05-17 17:51 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Mozilla
2017-05-17 17:37 - 2017-05-17 21:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Opera Software
2017-05-17 17:37 - 2017-05-17 17:37 - 00000000 ____D C:\Program Files\Common Files\JOS26Z5TB4
2017-05-17 17:29 - 2017-05-17 17:29 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\WinRAR
2017-04-29 20:56 - 2017-04-29 20:56 - 00000000 ____D C:\Users\home\Documents\Flight Simulator X Files
2017-04-29 18:18 - 2017-05-01 11:12 - 00000000 ____D C:\Users\home\AppData\LocalLow\uTorrent
2017-04-29 11:26 - 2017-04-29 11:28 - 00000000 ____D C:\Users\home\Desktop\Drugi Svetski rat
2017-04-28 08:38 - 2017-04-28 08:38 - 00000000 ___SD C:\Windows\SysWOW64\{A24B87CE-67C9-49D1-B0A5-F06A1C73BC58}
2017-04-27 22:03 - 2017-04-27 22:03 - 00000222 _____ C:\Users\home\Desktop\Euro Truck Simulator 2.url
2017-04-27 21:04 - 2017-04-27 21:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2017-04-27 21:04 - 2017-04-27 21:04 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2017-04-27 20:58 - 2017-04-27 20:59 - 09777152 _____ C:\Users\home\Downloads\hamachi.msi
2017-04-27 19:15 - 2017-04-27 21:21 - 00000000 ___SD C:\Windows\SysWOW64\{D28A6CAB-8746-4CDE-9D38-C5395B6DEFCD}
2017-04-26 13:08 - 2017-04-26 13:08 - 00000000 ___SD C:\Windows\SysWOW64\{FA70E676-D02E-4F59-967B-2091A253A5FF}
2017-04-26 10:33 - 2017-04-26 10:34 - 00000000 ____D C:\Users\home\AppData\Roaming\discord
2017-04-26 10:33 - 2017-04-26 10:33 - 00002154 _____ C:\Users\home\Desktop\Discord.lnk
2017-04-26 10:33 - 2017-04-26 10:33 - 00000000 ____D C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hammer & Chisel, Inc
2017-04-26 10:31 - 2017-04-26 10:32 - 52553728 _____ (Hammer & Chisel, Inc.) C:\Users\home\Downloads\DiscordSetup.exe
2017-04-26 09:08 - 2017-04-26 09:08 - 00120601 _____ C:\Users\home\Downloads\Outlast.2-CODEX.torrent
2017-04-23 18:32 - 2017-04-23 18:32 - 00019016 _____ C:\Users\home\Downloads\Die Hard with a Vengeance (1995) [720p] [YTS.AG] (1).torrent
2017-04-21 14:50 - 2017-04-21 14:50 - 00000000 ____D C:\Users\home\AppData\LocalLow\Bossa Studios
2017-04-21 14:36 - 2017-04-21 14:36 - 00000222 _____ C:\Users\home\Desktop\Surgeon Simulator.url

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-05-21 15:33 - 2016-10-26 10:20 - 00000000 ____D C:\Users\Administrator
2017-05-21 15:28 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-21 15:28 - 2009-07-14 06:45 - 00503136 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-21 14:18 - 2016-04-18 20:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 12.0
2017-05-21 14:10 - 2016-01-16 23:49 - 00000000 ____D C:\Windows\system32\1033
2017-05-21 14:10 - 2016-01-16 23:49 - 00000000 ____D C:\Program Files\Microsoft Visual Studio 10.0
2017-05-21 14:10 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-05-21 14:05 - 2009-07-14 06:45 - 00047104 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-21 14:05 - 2009-07-14 06:45 - 00047104 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-21 14:02 - 2013-11-26 21:49 - 00000000 ____D C:\Program Files (x86)\WinRAR
2017-05-21 10:26 - 2015-11-03 22:56 - 00002227 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-21 00:23 - 2016-10-26 10:22 - 00001405 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2017-05-21 00:23 - 2016-10-26 10:22 - 00001399 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-05-20 23:49 - 2015-11-03 23:52 - 00000002 RSHOT C:\Windows\winstart.bat
2017-05-20 23:49 - 2015-11-03 23:52 - 00000002 __SOT C:\Windows\SysWOW64\CONFIG.NT
2017-05-20 23:49 - 2015-11-03 23:52 - 00000002 __SOT C:\Windows\SysWOW64\AUTOEXEC.NT
2017-05-20 23:12 - 2016-10-19 17:32 - 00001945 _____ C:\Windows\epplauncher.mif
2017-05-20 00:33 - 2016-03-17 23:33 - 00000000 ____D C:\Users\Public\Documents\Wondershare
2017-05-19 21:32 - 2015-11-01 13:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-19 21:16 - 2017-04-17 11:08 - 00000000 ____D C:\Windows\Update
2017-05-19 19:53 - 2017-03-07 19:21 - 00000000 _____ C:\Windows\system.ini
2017-05-19 19:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2017-05-19 19:28 - 2009-07-14 04:34 - 37486592 _____ C:\Windows\system32\config\system.bak
2017-05-19 19:28 - 2009-07-14 04:34 - 143130624 _____ C:\Windows\system32\config\software.bak
2017-05-19 19:28 - 2009-07-14 04:34 - 04980736 _____ C:\Windows\system32\config\default.bak
2017-05-19 19:28 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2017-05-19 19:28 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2017-05-18 23:46 - 2013-11-26 21:02 - 00000000 ____D C:\Users\home
2017-05-18 22:24 - 2017-01-05 12:53 - 00001908 _____ C:\Windows\diagwrn.xml
2017-05-18 22:24 - 2017-01-05 12:53 - 00001908 _____ C:\Windows\diagerr.xml
2017-05-18 22:18 - 2016-01-17 17:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-05-18 22:00 - 2016-01-17 17:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-05-18 21:59 - 2016-01-17 17:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-05-18 21:57 - 2016-06-05 13:07 - 156335152 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-05-18 21:56 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-05-18 17:43 - 2016-05-12 21:15 - 00000000 ____D C:\ProgramData\BlueStacksSetup
2017-05-18 17:43 - 2013-11-27 05:49 - 00000000 ____D C:\Windows\Panther
2017-05-18 17:28 - 2016-01-17 17:32 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs
2017-05-18 17:22 - 2016-04-30 18:22 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2017-05-18 17:07 - 2014-06-02 21:09 - 00000000 ____D C:\Windows\system32\appmgmt
2017-05-18 05:00 - 2016-12-27 20:43 - 00000000 ____D C:\Program Files (x86)\Courkaripack Center
2017-05-18 02:34 - 2015-11-01 19:16 - 00002328 _____ C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-05-18 02:27 - 2017-01-18 21:09 - 00001956 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-05-18 02:27 - 2017-01-18 21:09 - 00001886 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-05-17 21:35 - 2017-01-22 20:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2017-05-17 21:35 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-05-17 21:34 - 2017-03-07 19:22 - 00000000 ____D C:\Program Files\Opera
2017-05-17 21:32 - 2017-04-19 20:51 - 00000000 ____D C:\Program Files\FACEIT Client
2017-05-17 21:27 - 2017-02-23 15:41 - 00000000 ____D C:\Program Files\City Car Driving
2017-05-17 17:56 - 2017-04-13 11:16 - 00000000 ____D C:\Users\home\AppData\Roaming\Ckozoghgrrucult
2017-05-17 17:51 - 2015-11-01 13:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-05-17 17:21 - 2015-11-03 22:56 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-17 17:21 - 2015-11-03 22:56 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-05-01 11:33 - 2015-09-20 13:12 - 00000000 ____D C:\Users\home\AppData\Roaming\uTorrent
2017-05-01 11:15 - 2016-07-11 11:57 - 00000000 ____D C:\Users\home\AppData\Roaming\Curse Client
2017-04-30 23:37 - 2017-01-18 21:09 - 00000000 ____D C:\Users\home\AppData\LocalLow\Mozilla
2017-04-30 22:26 - 2015-05-20 14:07 - 00000000 ____D C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-04-28 22:51 - 2014-02-12 18:42 - 00000000 ____D C:\Users\home\AppData\Roaming\Skype
2017-04-28 21:31 - 2016-07-11 12:57 - 00000000 ____D C:\Users\home\AppData\Roaming\.minecraft
2017-04-28 21:04 - 2017-03-05 17:21 - 00000000 ____D C:\Users\home\Documents\Euro Truck Simulator 2
2017-04-27 08:59 - 2016-09-21 20:33 - 00000000 ____D C:\Users\home\Desktop\Cope
2017-04-25 20:19 - 2017-01-13 21:31 - 00000000 ____D C:\Users\home\AppData\Roaming\TS3Client
2017-04-25 19:06 - 2016-07-27 12:56 - 00000000 ____D C:\Users\home\Desktop\FPS

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


ATTENTION: ==> Could not access BCD.

LastRegBack: 2016-05-01 12:22

==================== End of FRST.txt ============================
https://www.mycity.rs/must-login.png

offline
  • Pridružio: 26 Avg 2010
  • Poruke: 10622
  • Gde živiš: Hypnos Control Room, Tokyo Metropolitan Government Building

Exclamation

Ubuduće ne pokreći ComboFix na svoju ruku.


Arrow

Deinstaliraj KMP Service.



Arrow

Otvori Notepad i iskopiraj sljedeći tekst koji se nalazi unutar Kod polja.

Start

ShellExecuteHooks: No Name - {F797446C-D3F2-11E6-AB72-64006A5CFC35} - C:\Users\home\AppData\Roaming\Terlcultclhach\Hejuck.dll -> No File
Startup: C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\pLBfEuNP.lnk [2015-12-27]
Startup: C:\Users\home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\xBchppIcvKkI.lnk [2015-12-27]
GroupPolicyScripts\User: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-891269962-2659327078-604941568-500\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll [No File]
R1 netboostmaster; C:\Windows\system32\drivers\netboostmaster.sys [2894184 2017-05-18] () [File not signed]
C:\Windows\system32\drivers\netboostmaster.sys
R2 Uefochubsrv; C:\Windows\system32\drivers\Uefochubsrv.sys [196640 2017-05-17] ()
C:\Windows\system32\drivers\Uefochubsrv.sys
3 asqw883q; no ImagePath
S1 aqhiqflc; \??\C:\Windows\system32\drivers\aqhiqflc.sys [X]
S1 lnsubgoh; \??\C:\Windows\system32\drivers\lnsubgoh.sys [X]
S1 netcontroller; system32\drivers\netcontroller.sys [X]
S1 p1483530829am; \??\C:\Users\home\AppData\Local\Temp\bk3BC8.tmp\p1483530829am.sys [X] <==== ATTENTION
S1 qaqjosyy; \??\C:\Windows\system32\drivers\qaqjosyy.sys [X]
S1 whklgyqq; \??\C:\Windows\system32\drivers\whklgyqq.sys [X]
C:\Users\home\AppData\Roaming\Ckozoghgrrucult
C:\Windows\netboostmasterHelp.dll
C:\Program Files\Common Files\JOS26Z5TB4
C:\Windows\winstart.bat
Task: {021C4957-C686-453D-BD97-A66E26541E43} - \{F6CFA049-C08E-4CFC-86EE-63F98121EEA3} -> No File <==== ATTENTION
Task: {0268EC37-1431-45DD-9DC7-0C27735ADF90} - \{F7F89A4C-C82A-4438-8F50-CEC78FD18EB1} -> No File <==== ATTENTION
Task: {04A1325A-8D93-44CD-A2C9-818ED9A22B77} - \{24B6AC44-C107-451E-A4DA-078451DE4AF2} -> No File <==== ATTENTION
Task: {0787CB74-F597-45F5-BB22-F6CA555B81C6} - \{FCD313EF-D517-4934-BDE0-D7A85EFBBE7B} -> No File <==== ATTENTION
Task: {07DAED8E-402E-460F-AEDB-3BEFD367E3BF} - \{94356EF3-D734-405A-B4C9-559EDF7A9B18} -> No File <==== ATTENTION
Task: {0A83CAC4-1F2C-4D68-A343-7836CA1160B0} - \{427C1731-1D98-4DC9-9EB6-C5F90371C640} -> No File <==== ATTENTION
Task: {0B81A675-E446-4595-9850-29A67CDECA44} - \{73122A63-0E63-4FBF-8F9B-F627E8BCC1F3} -> No File <==== ATTENTION
Task: {0C221DD8-8C7E-46B9-808A-E8033662E30D} - \{F95A9FED-2A82-4DF1-AB64-E843D8AB82A0} -> No File <==== ATTENTION
Task: {1158C734-B394-4536-8EEC-4396E234F5EC} - \Update\Updater -> No File <==== ATTENTION
Task: {11A25F9B-07CA-45AA-9E25-3498E25CB468} - \{9C9BB2DD-9439-4FD0-84C9-C7C85FABEBA8} -> No File <==== ATTENTION
Task: {11B01798-6D7B-4F00-A7EF-CAB02AC18E1C} - \{03EB0363-EC0B-4B8C-A9D8-2025D5449D9C} -> No File <==== ATTENTION
Task: {11BC7A69-6E31-4880-AB9B-70A78C57831E} - \{389F22FB-3E7F-4D1E-8940-D501B77ABB3B} -> No File <==== ATTENTION
Task: {12E87865-0062-4784-ADCD-67CB2ECE08A8} - \{8C6D75DB-DAFF-4FAF-AB04-7D050C6E93FF} -> No File <==== ATTENTION
Task: {12EE9DA0-5A07-4EC8-873F-61234C24A311} - \{8F3326B4-DB70-424E-B545-0C9F3A36A2E8} -> No File <==== ATTENTION
Task: {15846F7D-0E03-4F29-9880-FE07DE53C503} - \{E3A79E4C-0BB0-4A1D-9CA9-B3109D5F88C4} -> No File <==== ATTENTION
Task: {1657006A-B482-4D29-B6E3-3C63A54D999A} - \{6D2E81D6-124E-486A-AA10-EB285E6BE5B4} -> No File <==== ATTENTION
Task: {19CCC563-61D9-4700-839A-363BAE7514B1} - \{78F2655C-F6EC-4FBB-95EE-4F0D87FDD5C0} -> No File <==== ATTENTION
Task: {1C69C4BA-E0B2-4964-BA00-332F517CC7CE} - \{700CCB98-C22B-438A-86C8-90526553E5EE} -> No File <==== ATTENTION
Task: {1C8282BA-FC63-4B6F-A081-D1FABC0EF971} - \{7624EE48-5567-4747-903D-1850C68D71EA} -> No File <==== ATTENTION
Task: {1D317CFE-95FF-4C71-B570-22675D0A316E} - \{27E97674-BF6D-4907-9A21-73B7AEE9827C} -> No File <==== ATTENTION
Task: {213EEF9E-A9BF-45D4-94B5-7F0672D69B86} - \{23CE292F-0B03-4FE6-B281-B44E0AFAAB27} -> No File <==== ATTENTION
Task: {22AC9075-AA99-4A84-9C89-DEEB2AE47BD0} - \{2843C4F8-D8FD-4839-9AB4-D06BDCF52D19} -> No File <==== ATTENTION
Task: {2334D3C2-E9DD-4A32-986A-2F5A07B6EC66} - \{C48651E0-16C3-417D-B75D-D59BAEBD69E5} -> No File <==== ATTENTION
Task: {25D942F3-AB4A-4FA2-8DD3-0BAEAB0F5413} - \{E4BB30FD-3ADF-4D4C-A39E-E6ADBD588A94} -> No File <==== ATTENTION
Task: {28DD2185-73A6-49E1-9984-CC53976E14FE} - \{3D0F34FC-0E1F-4E31-ADC8-6E4C9BFD9398} -> No File <==== ATTENTION
Task: {299510A9-5B1D-40C5-AA39-91C26EEDB337} - \{5ABCC03E-72A9-40E9-B774-7860FB1FD3EB} -> No File <==== ATTENTION
Task: {2AE1E351-E9AB-4D9B-99E6-6734EFCB31B7} - \{DB2C459F-9B23-4422-9303-C3F115D827AC} -> No File <==== ATTENTION
Task: {2B120F5C-E9E5-4443-BAEA-F0C0A036987C} - \{86FA567A-92BE-45C5-B323-E899F5653BDA} -> No File <==== ATTENTION
Task: {2D097F08-6CA1-46E1-B35B-CA9C35934F18} - \{FEF9877C-F04D-4344-AC63-F36378F2B5E7} -> No File <==== ATTENTION
Task: {2DDC946B-D8EA-4387-BB01-55A21327F547} - \{43815921-8980-4422-B0D0-173D4829BD06} -> No File <==== ATTENTION
Task: {310AC1CB-BAA5-4A1B-90E0-D6FD3C1DFF6F} - \{3D08D6E2-80BB-4EA2-9F8A-6420F50ECF63} -> No File <==== ATTENTION
Task: {315DCF8D-1499-4E38-B473-0A0CC63682DB} - \{AD59F8AE-7E07-460E-9109-BB6F389F30F0} -> No File <==== ATTENTION
Task: {35321151-885E-4B54-A10F-6189D18BBEB2} - \{01262B77-5FB6-495B-97EE-27F154522AA3} -> No File <==== ATTENTION
Task: {369275DE-1BE3-4FB7-8710-DF9C8596B15F} - \Logic Bassbackpot -> No File <==== ATTENTION
Task: {37BE735E-15CF-4F3D-AAA4-00D25222C7BD} - \{38369675-750A-47A9-AFD2-30D2EA3C24E4} -> No File <==== ATTENTION
Task: {38EC7978-69FC-4F5B-B1E2-DB744E48A808} - \{009B5D71-9547-4842-BB2E-8A90542BA57B} -> No File <==== ATTENTION
Task: {395E7783-6E5A-4F5A-BA52-7CE727A631C8} - \{FFDA3A34-4FD6-4C2F-9CAB-11BB0296A920} -> No File <==== ATTENTION
Task: {399D3726-3517-404F-ADAB-F0AE68DACFC9} - \{95234E6B-6841-4EC0-A456-1C02AED6390C} -> No File <==== ATTENTION
Task: {3A87B0B1-70FF-4F1F-B32B-2ABC7E5FA1CE} - \{F2E92004-2383-42B4-B368-7A4663C906B6} -> No File <==== ATTENTION
Task: {3EBADDC8-0469-45DF-AFD2-F334E8BA4FF3} - \{47BC10E1-4D5C-4F2B-A447-4949BA6127CE} -> No File <==== ATTENTION
Task: {40152C18-E02E-45DE-B504-5FBC80D85D42} - \{6CC11460-A0B7-41FC-9647-D6E59AEEBA01} -> No File <==== ATTENTION
Task: {41040F92-74BA-4FF6-BE21-19564F0D5684} - \{35B19280-BF9E-4E04-94FD-CB5B7D6F58D8} -> No File <==== ATTENTION
Task: {42DDDD9C-E08F-432C-B9E7-4CA1F23C42F1} - \{D0821C58-F7C7-408E-9353-541B863B6645} -> No File <==== ATTENTION
Task: {43289BAB-AC88-4A93-8321-03D67B0DA86A} - \{36FCD34C-F42D-4663-B876-0A1569BBB5B9} -> No File <==== ATTENTION
Task: {438FAFA7-208F-45E0-AE26-EA7EB50BA204} - \{4BDFC975-6AE8-4FE0-AC32-5805339193C1} -> No File <==== ATTENTION
Task: {44E80608-507D-4CE6-876A-574D66CCD5C1} - \{BCEF3977-414A-4383-B832-A44771CE7A1E} -> No File <==== ATTENTION
Task: {44F60783-C46E-41C1-9C50-F01CDDB874DF} - \{F66304BD-6A26-41BA-9D14-75368E4E9BDF} -> No File <==== ATTENTION
Task: {452E5E3A-3C66-4C85-BCE6-7C675B42756D} - \{1F49CB54-F98A-42BD-87D4-D6A0DB593277} -> No File <==== ATTENTION
Task: {466B2988-F55B-4049-91A6-60C3267D9391} - \{9FE45E16-78A7-4FDE-817A-381A8E5AABD8} -> No File <==== ATTENTION
Task: {4EEA8BB4-657E-4B0B-84E3-B9A4C8236809} - \{E3D20143-DB69-4F24-B6FA-961CDE04C63F} -> No File <==== ATTENTION
Task: {4F171B57-8388-49B3-8D6A-F2B75BAD8E5F} - \CMEClient -> No File <==== ATTENTION
Task: {518E5831-E9C4-43D3-8678-127F1A62A383} - \{8B534022-41C8-4E48-B27A-91F6FCB35584} -> No File <==== ATTENTION
Task: {52D1F8CF-E25F-4DD1-9697-9C244A2CBFFC} - \{153951CF-F55F-492B-A8EF-F91AD3916FE5} -> No File <==== ATTENTION
Task: {54BEF785-FDF3-4FF4-B264-0CD4BC897EC5} - \{B21AA131-0883-4070-9ABB-3BF9A9D6EDE3} -> No File <==== ATTENTION
Task: {54F8CD3A-21CD-4F2D-A498-8402F1777188} - \{0FB69A1C-A51D-41E6-ABC7-D27EC02CA0FE} -> No File <==== ATTENTION
Task: {5534713C-2181-4AE5-B5F5-BFE88A5AF12A} - \Timesy -> No File <==== ATTENTION
Task: {5B67C233-0D8E-448F-BAA1-0FB41BC4DD5A} - \{73CA0C02-BD44-4D02-9E41-BF2A027F706B} -> No File <==== ATTENTION
Task: {5E89A5D6-AEC1-450D-B8E5-A9B16948FBB3} - \{14BFC73B-A8EF-48C1-A40A-20C2AC7C83D3} -> No File <==== ATTENTION
Task: {5EAA541C-C063-4868-8576-43F66AC33FA6} - \{78BAA4A5-01EA-4951-9D45-CB2C97CCA56E} -> No File <==== ATTENTION
Task: {5F2088AB-A85E-4542-8CEF-8281DA685356} - \{BCB5727A-FC57-469B-A966-71342A3924A8} -> No File <==== ATTENTION
Task: {5F6DF262-8DC7-4821-9F92-7BBBBBDB53EC} - \{9781F516-BAB2-46EB-9074-15207D52A8A3} -> No File <==== ATTENTION
Task: {5FCAE301-B644-463D-B3FB-E294F9A72623} - \Update\chrome -> No File <==== ATTENTION
Task: {606774B8-B2DA-44A1-A3B7-B7AB086C592F} - \{71B3850B-3ACE-4D70-A238-2280A89D72F7} -> No File <==== ATTENTION
Task: {60CCC08D-CE3E-4DB1-9370-90C03D9FE0BC} - \{6D4BC6F9-FEFD-4D1D-88D3-C09A390868F7} -> No File <==== ATTENTION
Task: {625F3F09-DA8F-4D23-9A2D-64122F9775ED} - \{F594B291-7678-4578-A441-63DA2C9DC34A} -> No File <==== ATTENTION
Task: {6263ED15-5E75-4A91-ADC3-937203CCAE69} - \{A609F35C-04DB-408F-A66C-36788AB0E610} -> No File <==== ATTENTION
Task: {628265FD-3492-4F05-8744-61CBA7A09C5E} - \{58B04F95-F089-40BB-853A-0FE943499A5E} -> No File <==== ATTENTION
Task: {62DCD9F9-4FAF-4B51-9002-E784ECB94E85} - \{AC81CFA9-EBEE-4052-9DB3-3E4B292851C2} -> No File <==== ATTENTION
Task: {6321355F-40F0-4517-A0A4-C24659D2EBDF} - \RestoreSearch -> No File <==== ATTENTION
Task: {676C0A8B-D51D-487D-BCE9-4D20F53C2338} - \{59F48C20-8D6B-4CF3-A829-D9D782ADE708} -> No File <==== ATTENTION
Task: {67D30E8B-5ABA-47E5-B0FC-5A8463FD9177} - \{FCF913AC-63A3-4B47-B20A-84EB47BF9A62} -> No File <==== ATTENTION
Task: {694122B9-9310-4E71-A633-E98913D44C85} - \{DDAAF7F6-489B-4367-ACE9-6B5DA4BCCEAC} -> No File <==== ATTENTION
Task: {6964A134-99F3-488D-B418-57B8D88096E7} - \{7DE087E5-1089-4F48-9805-C9702283890F} -> No File <==== ATTENTION
Task: {6AE5BF76-6347-4110-8B63-EF772468D21E} - \{6E5C8B73-CA6F-4E19-A489-FAE095EA3191} -> No File <==== ATTENTION
Task: {6C809F9D-A8D8-464A-804D-E5A572A7BA3C} - \{5C11A6CC-EFFE-4928-932E-F22AAA29F54F} -> No File <==== ATTENTION
Task: {6DE8F599-3777-492B-96CB-7FF633D27490} - \{79C16E31-3F5F-458C-AD00-2E2BC6C63A0A} -> No File <==== ATTENTION
Task: {6FE61E75-3A56-4909-BC70-127DF5266A14} - \{33E8DC49-90B4-4265-9778-FD3D7F41D848} -> No File <==== ATTENTION
Task: {7112AE87-6A6C-4055-9D86-6B626A63445D} - \{C34EB7DD-ED9D-4D51-85DF-24AF460D35E7} -> No File <==== ATTENTION
Task: {7384DAF5-6082-48D5-B8AE-DD724C0ABA6E} - \{9893F4A9-510A-43EE-90CE-F8E1AC28AAE4} -> No File <==== ATTENTION
Task: {752C8B01-3AF6-468B-89AB-83BB102BB7E7} - \{88D19BF8-D23C-44D3-8C4B-FC1480E45934} -> No File <==== ATTENTION
Task: {767A1E62-7ABC-4A34-8DD9-C40271F11450} - \{01577AE0-BDFB-4E42-AB57-A8A74314B8AD} -> No File <==== ATTENTION
Task: {76D76043-3116-4CB1-BCC1-8C9A9FE66476} - \{D1DDCCF3-85A8-4712-8801-1E3D362A0650} -> No File <==== ATTENTION
Task: {78F4BF09-6033-4608-AC24-E783F8280F6B} - \{0CB1D5F3-92A3-481B-A65B-6A9EDEF00966} -> No File <==== ATTENTION
Task: {7D6B779B-443A-4172-B65C-86AE9AA3C5EB} - \{D8F9C081-AA0F-47C7-B584-23B655C8EC69} -> No File <==== ATTENTION
Task: {7FC325A9-A41E-45FC-B13E-706E6E41AE0A} - \GridinSoft Anti-Malware -> No File <==== ATTENTION
Task: {808B3929-459F-4A2A-B4B4-01B1714B46C1} - \{68AFB766-E03B-4A14-B9C1-8DC184B4A0B1} -> No File <==== ATTENTION
Task: {80A00316-EE09-4814-A770-4BC79A4022DA} - \{ED9D075E-B974-4C02-A800-55F61758957D} -> No File <==== ATTENTION
Task: {83E6705B-06F6-4CF8-8533-77EF4E8026C9} - \Shawosataleent Cloud -> No File <==== ATTENTION
Task: {862B1AAA-60EB-40CB-A7F4-0E9D5B75477C} - \{E1475237-D29B-4BAB-9798-67BCD0F9EFD6} -> No File <==== ATTENTION
Task: {86368A01-38E3-413B-9061-C3BA096A45F4} - \{334CCA02-2E0A-44F2-8768-7F8A593ADD9A} -> No File <==== ATTENTION
Task: {868C3BD3-631D-4041-A3BB-34B3F6820EAE} - \{045BF733-EB7A-4C92-9A4D-3CC9A533F0DA} -> No File <==== ATTENTION
Task: {87AE5DA7-3B44-4993-B246-37C9AFB289CA} - \{DD52D378-7CB6-4103-B7CB-CEB8F713E300} -> No File <==== ATTENTION
Task: {87DAD38E-1C20-48EA-AAEB-08AC4739DC7D} - \{8CE2615C-6AC0-4030-A887-E42B94BFA9D6} -> No File <==== ATTENTION
Task: {9061F53A-D83E-4C4C-8DA3-8828AB66933D} - \{290B5832-29A8-4102-B459-E30303DD0EB1} -> No File <==== ATTENTION
Task: {906C166C-17CC-44B9-8F31-F9397F8CFF4D} - \{95AF7C6C-0D22-4097-A0BA-2115195ABE40} -> No File <==== ATTENTION
Task: {90904650-488E-475C-98E3-F58B67318F9B} - \coupons_and_fun_updating_service -> No File <==== ATTENTION
Task: {91536AF1-F484-46E7-B6B2-7D60EBB8CD4F} - \{FDCBD0CC-816D-46A0-9E6C-BD2E0F6DA37D} -> No File <==== ATTENTION
Task: {94205AF7-0FBB-467A-8876-4E200A967598} - \{7437A165-B02E-4AAF-AAEB-B092DE8494EA} -> No File <==== ATTENTION
Task: {94881163-641A-4A62-A6C8-8F6B63C8370A} - \{12333994-9EC9-4422-A640-CCC1ACA8AB1B} -> No File <==== ATTENTION
Task: {98D38215-B7F0-41BB-8D57-3C7CAB79D653} - \{BD27B57D-DB8E-4DDC-AAF2-61D5AF9686A1} -> No File <==== ATTENTION
Task: {99553831-921F-4CC7-AF74-4327DA32035A} - \{DBC3418B-1DE9-44FE-84BF-64B1973B56D7} -> No File <==== ATTENTION
Task: {9A109CC5-D9B4-4BE4-8AEF-393F8C2B8173} - \{FDF2D748-1C5B-4280-8473-AAB32D20CF76} -> No File <==== ATTENTION
Task: {9A449F88-9F49-4B3F-927A-7440B7EF8DE3} - \{07C70E3D-8BE3-41A9-830E-E491D9058401} -> No File <==== ATTENTION
Task: {9B10E5E6-F464-4E4D-B03D-F87240F54A8F} - \coupons_and_fun_notification_service -> No File <==== ATTENTION
Task: {9B6F8B34-85EA-44E2-9BD6-EA315D746569} - \{299DD45D-47D7-4C9D-BDF5-480CAA6302F6} -> No File <==== ATTENTION
Task: {9D462400-312F-49E9-B9F2-BC139103459A} - \{43639429-14DC-48D1-BF78-1987A1BB864E} -> No File <==== ATTENTION
Task: {9FA33983-7B4A-47E3-9BE3-F576C8BA33DF} - \{642C71FA-DCB4-4F75-B659-34EE9570F8D3} -> No File <==== ATTENTION
Task: {9FE6D745-2EA4-425D-B718-8661C57FAD75} - \{4CD0F658-AABF-40F2-A701-D1CBC68E7AF5} -> No File <==== ATTENTION
Task: {A040AD14-515A-4014-B66F-3975D92835FC} - \{561272E7-898C-4E50-A001-C727A7DBBF79} -> No File <==== ATTENTION
Task: {A1D603F9-F83B-49E4-824B-5B8ED922484D} - \{773DBD55-3BE1-4709-834A-EF28DA0DFEA3} -> No File <==== ATTENTION
Task: {A524C7A8-FD0E-4B5B-9381-975464C5748A} - \{5391EC33-AEFC-4950-8F95-32A7873E4882} -> No File <==== ATTENTION
Task: {A5B01224-EBB6-4A7E-B17D-49429F330104} - \{5131064A-5B24-4E9B-B40C-E42C890A10D5} -> No File <==== ATTENTION
Task: {A5F1A4C7-92D6-4578-8573-48531ABDACBB} - \{0C39D59B-64C6-4E6B-84C6-AB556C129457} -> No File <==== ATTENTION
Task: {A64F46F6-EC0E-491C-B0E5-F28DFE108C28} - \{D51392F9-FBA5-4083-8041-F06093568E46} -> No File <==== ATTENTION
Task: {AA1C1FD3-DF32-434A-8183-AD2DE31A02E1} - \{28A1E884-0527-43F2-ADB0-84CFB9B3C154} -> No File <==== ATTENTION
Task: {ACAAE61A-EA69-46F0-B9EC-3D49732E83C2} - \{C849BB67-932F-49BC-9939-BC60C5A25066} -> No File <==== ATTENTION
Task: {AED1B781-66DB-4AE7-8E9D-0838E255A7D0} - \{7341FAA7-1FCE-414E-9EA5-E9EEA188D6CE} -> No File <==== ATTENTION
Task: {AF53A491-0991-4606-8CC0-E77AD6E5BC62} - \{D522F370-A345-47DE-A74D-5A932F3705F4} -> No File <==== ATTENTION
Task: {B0982C98-F420-4B6F-AB9C-AEF909E0389D} - \{E50759DE-ACEC-435E-9CEA-FF942C9ED51D} -> No File <==== ATTENTION
Task: {B1062B71-0EB2-40A2-885E-FBAF93EA0B76} - \{86BFCAEA-FDF2-4FD6-9C42-645A56ED90B1} -> No File <==== ATTENTION
Task: {B15BC34C-DB97-4265-B869-B8B8FCE9E959} - \{A57A6081-5972-4FCF-8D2B-D793867341E2} -> No File <==== ATTENTION
Task: {B3B7B041-8FBE-443D-872A-E02EC330435E} - \{CB2747D4-01AC-4126-8FBF-CF6372A1B545} -> No File <==== ATTENTION
Task: {B4F13F0B-5510-4D04-AAF5-E6D7662014B1} - \{779A1025-9DAC-4907-9806-6AD0298EA532} -> No File <==== ATTENTION
Task: {BA5EA2B9-037E-402C-9CDC-76ED3144AFE8} - \{0B2E8D38-E2F4-4664-9ED5-2F65AD204AEC} -> No File <==== ATTENTION
Task: {BC63F092-3085-4230-8E35-FA61D8D8C7C5} - \{AD60BBB4-E956-4EA4-93C7-D6236328B21E} -> No File <==== ATTENTION
Task: {C013D968-E173-4B8A-A2AB-D1F978F52B5D} - \{D95DA88E-D1BD-41CE-8B93-0AE7C9229CE7} -> No File <==== ATTENTION
Task: {C0922C5B-27C4-4373-96AA-362CBCA7A228} - \{2570E579-544B-4476-B415-804957ABA4DA} -> No File <==== ATTENTION
Task: {C733F075-83C5-4815-A5B6-91F49D9BAFA6} - \{7A27D2EF-A219-49B9-9AE8-F260C76BCEC9} -> No File <==== ATTENTION
Task: {C86CD957-10C7-432B-9BEA-AAFE4F7755E6} - \{474D12C5-9E5C-4282-8229-3F734F98586C} -> No File <==== ATTENTION
Task: {C8A2ADBB-C4AB-48EE-A846-E4D5C82104E4} - \{32EBD1BF-8D5A-4778-9270-CDA181859C39} -> No File <==== ATTENTION
Task: {C9A3BFE3-D53F-46DF-935F-43E19D746CE9} - \{F4788590-2878-4246-9B65-997F436B1CE7} -> No File <==== ATTENTION
Task: {CB53B909-83D8-44BF-B11C-D94529186A30} - \{183E2C26-DE4A-43BE-83DF-7DB8EC808242} -> No File <==== ATTENTION
Task: {CDAFA60E-FC0E-4896-9D08-5F78F4663A1D} - \{DE7265C2-5B4E-403F-B90D-65D115F186C7} -> No File <==== ATTENTION
Task: {D08EF97B-0031-4E6F-826C-9F658D5DB1A3} - \{5CCEAA64-D75E-4BAF-BAA7-077EBA0F6D7E} -> No File <==== ATTENTION
Task: {D266B3CB-4EC3-43DA-9A78-AAC6C8F3A53F} - System32\Tasks\Norton Security Scan for home => C:\PROGRA~2\NORTON~2\Engine\420~1.38\Nss.exe
Task: {D3E55202-7584-488A-8567-E962501E73A2} - \{1FE525F5-9A9C-4BE0-A017-8C831E5E7E06} -> No File <==== ATTENTION
Task: {D774E6E4-BDB7-48DA-AEF9-7B89E4B2E917} - \{5E3C9803-0ABD-4BD1-BD6B-0D036EF107C6} -> No File <==== ATTENTION
Task: {D8AA1DA3-3C6A-4E6B-9DAE-3D3A072DEE3C} - \{BB4B2CBE-9F89-4B03-BEFA-30C2B0283936} -> No File <==== ATTENTION
Task: {D9141D10-FD8E-403D-A17E-99FD4D44CEBF} - \{90A6E678-98E9-4835-8FC7-3225E0878DE1} -> No File <==== ATTENTION
Task: {DACE5D1F-42B6-4ED3-B49C-BBA07A8A8E4F} - \{23ACFCAB-24DE-4D71-BB56-0121D15C9854} -> No File <==== ATTENTION
Task: {DEAE654C-724F-4C1E-9451-0D1399F15709} - \{7A6DBB70-ACE8-4BEF-AE40-0C74D35C3E3D} -> No File <==== ATTENTION
Task: {DF280203-FBEF-4DF6-B812-3806AABA4013} - \update-sys -> No File <==== ATTENTION
Task: {DFDB715A-39DE-47A0-800E-4C6AB8BE1F29} - \{26459E4A-3952-408A-B1C5-5ADD14DCF284} -> No File <==== ATTENTION
Task: {E401BC0F-53D9-4B28-AA6E-B1FA6527EA2E} - \{96CEAA70-C8B6-404C-B285-494EE7555670} -> No File <==== ATTENTION
Task: {E4F98165-1938-49EB-9C85-0988817B4F98} - \{8495F13A-38A9-4978-BA78-193F345D31FE} -> No File <==== ATTENTION
Task: {E5BC2D54-130A-43AD-A53F-545F77C95C36} - \{7F658C86-2B36-45D1-94D8-4D1E5ACADCBE} -> No File <==== ATTENTION
Task: {E6CFA8CC-BEDB-4685-8A47-F5BB9A5B7F34} - \{AA3DBA3F-71D6-484B-880A-54ABDF62C5D3} -> No File <==== ATTENTION
Task: {E8BA350F-DDD1-4A8D-BB0D-7C5D26CE6C6C} - \Bidaily Synchronize Task[973b] -> No File <==== ATTENTION
Task: {ED330281-44BB-410B-892B-7E074BA59184} - \{1BF87C55-2F88-45E8-9BAD-DF0F7E7D9C6F} -> No File <==== ATTENTION
Task: {EDDAB509-3037-42EF-BC49-A55743E8DC8A} - \{F6C3CCBA-79E8-4D43-BE04-BE15D6D8B58A} -> No File <==== ATTENTION
Task: {EE258BCB-564F-4DF1-A3C0-B2CEC098E9B8} - \{B4A21FD2-832A-4908-AD2A-6B38EC02D4AE} -> No File <==== ATTENTION
Task: {F174762F-70C0-4E7F-AE1D-E0BEC0253A36} - \UtilTool Antivirus Uninstallation task -> No File <==== ATTENTION
Task: {F22D5EB5-1E51-4FB1-ACA2-71CEB34AC400} - \{D2BA58CB-45A0-49BC-8B56-E98FF95E109A} -> No File <==== ATTENTION
Task: {F2397D82-3932-4DE2-ACE5-D558FF68651F} - \{62A89521-D82E-49A5-836B-6F5F121E7949} -> No File <==== ATTENTION
Task: {F27DB97D-892E-4C3C-8130-79A820D48563} - \{BC2AF270-358B-4662-A9C8-89EE38688826} -> No File <==== ATTENTION
Task: {F64BFCD1-BCB2-4A10-B8B3-8603D0B36129} - \{9E0E9A39-6A52-4322-98F7-825F10C2F1C9} -> No File <==== ATTENTION
Task: {F7ADF2F9-8CC8-4A91-B051-12116D4E078D} - \{191F0379-CC41-447E-BD4B-AE10DBF7D3DF} -> No File <==== ATTENTION
Task: {F8530F81-6AA9-4AA9-B2AD-DEC192D929AC} - no filepath
Task: {FAA3241D-CA85-4A20-A6C5-5F677E78EA6E} - \{E0AAE885-7FCF-4A2C-BA19-96CA5E6EE21B} -> No File <==== ATTENTION
Task: {FAF269ED-29A5-4509-AC44-70E9F6C0E6C8} - \{2E97BB2A-B64E-4E25-AE7A-303022D72EB5} -> No File <==== ATTENTION
Task: {FC4E7752-5966-45D7-ADAC-538F7431FEBF} - \{2AFF3FFF-C0C7-496D-9532-AA76389FF8E1} -> No File <==== ATTENTION
Task: {FC5B0757-55E1-4646-B036-7A47CBA1B012} - \{A5791B10-2C91-4460-B01D-31759DD53E9C} -> No File <==== ATTENTION
Task: {FE107C6A-91C2-48B5-B8B1-099DCDE12898} - \update-S-1-5-21-891269962-2659327078-604941568-1000 -> No File <==== ATTENTION
Task: {FE926D2E-8C67-40E6-B2B5-D3F6E50047C8} - \{CDEFA47E-F98A-4418-AE96-AE94152A81BB} -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> 
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\d249d9ddd424b688\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> 
C:\Windows\netboostmasterHelp.dll
c:\windows\syswow64\auhardwaregl.dll
AlternateDataStreams: C:\Users\home:Heroes & Generals [38]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"
FirewallRules: [{70FD5DB9-A671-43E2-94D8-9E65DB3ED14A}] => (Allow) C:\Users\home\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{B7EB6C5C-F8E2-49B8-A0F9-1ADFA184195F}] => (Allow) C:\Users\home\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{6137EFAD-4868-4962-878E-8742618C04A3}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{86F245D9-ED2D-46F8-BCF4-0DDEAE818BD6}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{2CC1DDD6-83E7-41A3-8845-AC1697E8C043}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{F0DDA18D-BFAC-422C-BE95-AD7497A2DAE1}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{0F331CC1-EA79-4E50-A4AD-A9C2D5F3F4C8}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{F7CDAA92-AFD1-4FF2-96C3-D208D12CB8BB}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{DE2F1828-8885-4EE8-80FE-4C3C1B5006DE}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{0C49A716-F777-4113-A047-E8B9E12EB716}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
C:\Users\home\AppData\Roaming\Terlcultclhach


End



U okviru Notepad-a klikni na File --> Save As
Pod Encoding izaberi UTF-8.
Fajl nazovi Fixlist i sačuvaj na Desktop
Dvoklikom ponovo pokreni FRST.exe
Klikni na Fix i sačekaj dok program ne završi.
Ukoliko program zatraži restart računara, omogući mu da to nesmetano obavi.
Nakon završetka rada, otvoriće se fixlog.txt, sa sadržajem koji treba da kopiraš u temu.
Takođe, na Desktop-u će se nalaziti (fixlog.txt).

Ko je trenutno na forumu
 

Ukupno su 1049 korisnika na forumu :: 65 registrovanih, 5 sakrivenih i 979 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., aBobban, amaterSRB, babaroga, bato, Bubili, danilopu, David.MyCity, dekao, djboj, djdjurica, djo97, dolinalima, Dorcolac, DucicM, dule10savic, goflja76, gomago, goran.vvv, Hektor, ikan, Ivan Campo, ivan979, JOntra, kairos, Kordon, kosticmilanko, Kotorac82, krlebgd77, Lieutenant, loon123, Mercury, mgolub, Miki01, MiloradKomadic, miodrag, mkukoleca, Pakito93, Parker, pein, Pomorac1, procesor, promajauglavi, repac, RJ, robertino, rovac, ruso, sakota79, shaja1, shone34, SlaKoj, slonic_tonic, Steeeefan, suton, Tas011, Taso, tubular, Van, virked, VJ, vladetije, Vladko, wizzardone, Šraf