MyCity » Ambulanta -> Arhiva Ambulante » virus opet

virus opet

Napisano na dan: 3.9.2012
1

virus opet
Sledeća strana Pagination

Idi na vrh

Poslao: 03 Sep 2012 09:51
Idi na vrh
offline
  • Pridružio: 07 Nov 2011
  • Poruke: 78

Napisano: 03 Sep 2012 9:48

pozdrav svima sa mycity foruma kao sto vidite opet ja imam problem sa virusima Sad
znaci pre nekoliko nedelja mi se kompjuter usporio primetio sam da vise saljem internet paketa nego sto dobijam npr. sada mi pokazuje konekcija da saljem 44,280 a primam 21.850 znaci sigurno imam malware keyloger ili nesto .
skenirao sam kompjuter sa avast internet security 7 pro verzijom i otkrio je neke rootkit viruse pokusao sam da ih uklonim ali dobio sam error 50 nemogu sad da se setim nesto sam procitao na avast forumu da nije obrisao nekom liku virus pa sam ja probao da ubacim viruse u karantin ali sad mi je izbaci error da fajl ne postoji pa sam onda instalirao malwarebytes anti malware pro verziju najnoviju i nije otkrilo viruse takodje i nesto mi youtube kad pusta video primetim kad uvecavam da sporo uveca video nije bitno da li je 360P 720p ili 1080p mada uvek mi secka na 1080p komp je kriv za to xD
------------------------------------------------------------------------------------------------------
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by tracer at 9:14:20 on 2012-09-03
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1175 [GMT -7:00]
.
AV: avast! Internet Security *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\AVAST Software\Avast\afwServ.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Update\1.3.21.115\GoogleCrashHandler.exe
C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\tracer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
mWinlogon: Userinit=userinit.exe,
mWinlogon: SFCDisable=4 (0x4)
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [Google Update] "c:\documents and settings\tracer\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" /MINIMIZED
uRun: [AtiTrayTools] "c:\program files\ray adams\ati tray tools\atitray.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [EM_EXEC] c:\progra~1\mousew~1\system\em_exec.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
uPolicies-explorer: NoRecentDocsNetHood = 1 (0x1)
IE: Download Video on This Page - c:\program files\tomato\youtube video downloader\MDIEEx.dll/211
IE: Download Video This Links To - c:\program files\tomato\youtube video downloader\MDIEEx.dll/212
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {11F19C45-9675-488A-A8E0-8E8234DC245D}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
Trusted Zone: microsoft.com\www.update
DPF: DirectAnimation Java Classes - [Link mogu videti samo ulogovani korisnici]\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - [Link mogu videti samo ulogovani korisnici]\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - [Link mogu videti samo ulogovani korisnici]
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - [Link mogu videti samo ulogovani korisnici]
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [Link mogu videti samo ulogovani korisnici]
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{5D4D47ED-FA3A-4955-82BB-DFD5C24E3320} : DhcpNameServer = 192.168.1.1
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
IFEO: presentationhost.exe - "c:\program files\tuneup utilities 2012\TUAutoReactivator32.exe"
IFEO: taskmgr.exe - "c:\program files\process hacker 2\ProcessHacker.exe"
.
============= SERVICES / DRIVERS ===============
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2012-3-13 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2012-3-13 5248]
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [2012-1-28 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [2012-1-28 202928]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2012-3-14 14776]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [2012-1-28 113776]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2012-2-25 18544]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-1-28 729752]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-1-28 355632]
R1 atitray;atitray;c:\program files\ray adams\ati tray tools\atitray.sys [2011-8-15 20512]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2012-1-28 13696]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-1-28 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-1-28 44808]
R2 avast! Firewall;avast! Firewall;c:\program files\avast software\avast\afwServ.exe [2012-1-28 133912]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-9-1 655944]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2012\TuneUpUtilitiesService32.exe [2012-2-9 1529152]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-9-1 22344]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2012\TuneUpUtilitiesDriver32.sys [2012-2-9 10064]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [2012-3-15 17792]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\drivers\vmci.sys --> c:\windows\system32\drivers\vmci.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 IBUpdaterService;Updater Service; [x]
S2 PfFilter;PfFilter;\??\g:\protected folder\pffilter.sys --> g:\protected folder\pffilter.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-6-20 250568]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-6-26 1691480]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2012-1-30 103040]
S3 getbus;getbus; [x]
S3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\drivers\HIDUSBF.SYS [2012-7-21 3616]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys --> c:\windows\system32\drivers\nvhda32.sys [?]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [2011-8-15 104752]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\drivers\vboxnetflt.sys --> c:\windows\system32\drivers\VBoxNetFlt.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2002-8-30 14336]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-09-03 05:12:43 -------- d-----w- c:\program files\Ray Adams
2012-09-01 22:10:06 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-01 22:10:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-08-30 21:42:33 138992 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-08-30 21:42:05 281152 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-08-30 21:42:03 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-08-30 21:42:02 840264 ----a-w- c:\windows\system32\pbsvc (1).exe
2012-08-30 21:35:43 -------- d-----w- C:\BF2
2012-08-29 22:58:16 -------- d-----w- c:\program files\uTorrent
2012-08-29 22:42:28 -------- d-----w- c:\documents and settings\tracer\application data\atitray
2012-08-29 22:38:13 -------- d-----w- c:\program files\MultiRes
2012-08-29 22:37:50 472576 ----a-w- c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe
2012-08-29 22:37:50 -------- d-----w- c:\program files\Radeon Omega Drivers
2012-08-29 18:35:19 34 ----a-w- c:\documents and settings\tracer\application data\DCUQKH.dll
2012-08-28 17:50:43 -------- d-----w- c:\documents and settings\tracer\application data\Qualys
2012-08-27 23:13:54 -------- d-----w- c:\documents and settings\tracer\local settings\application data\PassMark
2012-08-27 23:13:35 -------- d-----w- c:\documents and settings\all users\application data\PassMark
2012-08-27 06:52:59 -------- d-----w- c:\documents and settings\all users\application data\Premium
2012-08-27 06:52:02 -------- d-----w- c:\documents and settings\all users\application data\OptimizerPro1
2012-08-27 06:49:53 -------- d-----w- c:\documents and settings\all users\application data\InstallMate
2012-08-26 01:10:31 -------- d-----w- c:\documents and settings\tracer\local settings\application data\Darkpedia_Network
2012-08-26 01:07:37 -------- d-----w- c:\program files\DarkSteam
2012-08-23 23:42:02 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2012-08-23 23:41:37 -------- d-----w- c:\program files\TuneUp Utilities 2012
2012-08-19 07:36:09 -------- d-----w- c:\documents and settings\tracer\local settings\application data\Facebook
2012-08-17 05:14:25 -------- d-----w- c:\documents and settings\tracer\local settings\application data\VMware
2012-08-17 03:18:37 -------- d-----w- c:\documents and settings\tracer\AppData
2012-08-17 03:11:19 -------- d-----w- c:\program files\IObit
2012-08-17 03:11:19 -------- d-----w- c:\documents and settings\all users\application data\IObit
2012-08-17 02:39:47 -------- d-----w- c:\program files\(zabranjeno)ed Steam
2012-08-17 01:58:51 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-16 23:34:41 -------- d-----w- c:\documents and settings\tracer\application data\Free Download Manager
2012-08-16 23:27:31 -------- d-----w- c:\documents and settings\tracer\application data\DAEMON Tools Lite
2012-08-16 23:26:43 -------- d-----w- c:\documents and settings\all users\application data\DAEMON Tools Lite
2012-08-16 18:46:22 -------- d-----w- c:\documents and settings\tracer\application data\ElevatedDiagnostics
2012-08-16 18:20:57 73728 ----a-w- c:\windows\system32\waitwnd.exe
2012-08-16 18:20:57 6584 ----a-w- c:\windows\system32\InstFunc.dll
2012-08-16 18:20:57 180224 ----a-w- c:\windows\system32\setuplib.dll
2012-08-16 18:19:41 36864 ----a-w- c:\windows\system32\amdk8.sys
2012-08-16 18:11:12 6912 ----a-w- c:\windows\system32\drivers\vulfnth.sys
2012-08-16 18:11:12 45056 ----a-w- c:\windows\system32\vusetup.dll
2012-08-16 18:11:12 11392 ----a-w- c:\windows\system32\drivers\vulfntr.sys
2012-08-16 07:46:29 -------- d-----w- c:\documents and settings\tracer\local settings\application data\WMTools Downloaded Files
2012-08-16 07:36:25 -------- d-----w- c:\documents and settings\tracer\application data\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-08-16 04:44:10 -------- d-----w- c:\documents and settings\tracer\local settings\application data\PC_Drivers_Headquarters
2012-08-16 04:14:47 -------- d-----w- c:\documents and settings\tracer\local settings\application data\Innovative Solutions
2012-08-16 03:56:04 -------- d-----w- c:\documents and settings\tracer\local settings\application data\Downloaded Installations
2012-08-16 03:54:34 -------- d-----w- c:\documents and settings\tracer\application data\uTorrent
2012-08-16 03:52:22 -------- d-----w- c:\documents and settings\tracer\application data\GetRightToGo
2012-08-16 03:29:10 -------- d-----w- c:\documents and settings\tracer\application data\Easeware
2012-08-16 02:57:41 -------- d-----w- c:\program files\common files\ATI Technologies
2012-08-16 02:56:58 593920 ------w- c:\windows\system32\ati2sgag.exe
2012-08-15 23:51:25 55296 ----a-w- c:\windows\system32\SET2A1.tmp
2012-08-15 23:51:25 105984 ----a-w- c:\windows\system32\SET29C.tmp
2012-08-15 23:51:23 916992 ----a-w- c:\windows\system32\SET29A.tmp
2012-08-15 23:51:19 629760 ----a-w- c:\windows\system32\SET2A2.tmp
2012-08-15 23:51:19 2000384 ----a-w- c:\windows\system32\SET2A6.tmp
2012-08-15 23:51:17 1212416 ----a-w- c:\windows\system32\SET29B.tmp
2012-08-15 23:51:15 6008320 ----a-w- c:\windows\system32\SET2A0.tmp
2012-08-15 19:33:54 909312 ----a-w- c:\windows\system32\SETD7.tmp
2012-08-15 19:33:54 634880 ----a-w- c:\windows\system32\SET10B.tmp
2012-08-15 19:33:54 5335616 ----a-w- c:\windows\system32\SETDC.tmp
2012-08-15 19:33:54 53248 ----a-w- c:\windows\system32\drivers\SETD3.tmp
2012-08-15 19:33:54 3586816 ----a-w- c:\windows\system32\SETDE.tmp
2012-08-15 19:33:54 306176 ----a-w- c:\windows\system32\SETD5.tmp
2012-08-15 19:33:54 233472 ----a-w- c:\windows\system32\SETEA.tmp
2012-08-15 19:33:54 192512 ----a-w- c:\windows\system32\SETFD.tmp
2012-08-15 19:33:53 835584 ----a-w- c:\windows\system32\SET105.tmp
2012-08-15 18:59:14 0 ----a-w- c:\windows\ativpsrm.bin
2012-08-15 18:57:11 -------- d-----w- C:\ATI
2012-08-14 23:10:38 -------- d-----w- c:\program files\common files\EasyInfo
2012-08-14 21:34:23 -------- d-----w- c:\documents and settings\tracer\local settings\application data\PunkBuster
2012-08-14 21:03:00 794408 ----a-w- c:\windows\system32\pbsvc.exe
2012-08-13 00:13:54 -------- d-----w- c:\documents and settings\tracer\application data\Malwarebytes
2012-08-13 00:13:48 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2012-08-12 20:36:13 -------- d-----w- c:\documents and settings\tracer\application data\IconChanger
2012-08-12 02:52:32 -------- d-----w- c:\documents and settings\tracer\application data\IObit
.
==================== Find3M ====================
.
2012-09-03 06:47:29 281152 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-09-03 05:45:12 281152 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-08-28 17:51:57 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-28 17:51:57 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-21 09:13:15 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13:14 202928 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-08-21 09:13:14 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-08-21 09:13:13 113776 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-08-21 09:12:33 41224 ----a-w- c:\windows\avastSS.scr
2012-08-11 23:36:16 2332288 ----a-w- c:\windows\system32\TUKernel.exe
2012-07-13 22:22:49 65536 ----a-w- c:\windows\IFinst27.exe
2012-07-06 13:58:52 337920 ----a-w- c:\windows\system32\SET3DB.tmp
2012-07-06 13:58:51 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-04 04:22:56 938368 ----a-w- c:\windows\system32\ativvamv.dll
2012-07-04 04:05:52 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2012-07-03 13:40:15 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-03 06:19:34 11111424 ----a-w- c:\windows\system32\SET2A8.tmp
2012-07-02 17:49:33 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 ------w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 ----a-w- c:\windows\system32\html.iec
2012-06-26 21:06:24 360264 ----a-w- c:\windows\system32\EasyRedirect.dll
2012-06-25 15:56:05 212 ----a-w- c:\windows\ildasmfnt.bin
2012-06-19 23:54:20 6141584 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2012-06-13 13:19:59 1866112 ------w- c:\windows\system32\_000013_.tmp.dll
2012-06-06 21:00:32 20065936 ----a-w- c:\windows\RTHDCPL.EXE
.
============= FINISH: 9:14:43.42 ===============

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]



Dopuna: 03 Sep 2012 9:51

i jos nesto gmer1 kad skeniram stane sa pisanjem i samo skenira bzvz tako da sam ga samo sacuvao onoliko dokle je doslo ako je to problem ponovo cu skenirati gmer1



Poslao: 03 Sep 2012 10:57
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Pozdrav.

Kako si skenirao Avastom, boot scan?
Posalji mi izvestaj, lokacija izvestaja se nalazi:

C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\aswBoot.txt



Poslao: 03 Sep 2012 11:36
Idi na vrh
offline
  • Pridružio: 07 Nov 2011
  • Poruke: 78

nisam imao vremena to sam bio preskocio

Poslao: 03 Sep 2012 14:37
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Preuzmi sUBs-ov ComboFix sa sledeće adrese na Desktop:


Bleeping Computer
Klikni desnim tasterom na link i odaberi opciju Save Target As... (Save Link As..., Save Linked Content As... ili sličnu);
Kada se otvori dijalog za izbor lokacije na kojoj treba sačuvati file, odaberi Desktop i klikni Save.



Kada preuzimanje programa bude završeno:
deaktiviraj zaštitni softver (uputstvo);
zatvori pokrenute programe;
dvoklikom pokreni program ComboFix;
u prozoru koji se otvori klikni "I Agree".
U toku rada, ComboFix će:proveriti postoji li novija verzija programa:
klikni Yes ako bude ponuđeno preuzimanje iste.ako Recovery Console nije instalirana, ponuditi instalaciju:
obavezno prihvati klikom na Yes i isprati postupak.postaviti/dati određeni broj upita/obaveštenja:
prihvati klikom na Yes ili OK.po potrebi, restartovati Windows (više puta);
na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Iskopiraj izveštaj koji je ComboFix napravio u temu na forumu:
klikni desnim tasterom miša u prozor Notepad-a i izaberi Select All;
klikni desnim tasterom miša na obeleženi tekst i izaberi Copy;
klikni desnim tasterom miša u polje za pisanje poruke i izaberi Paste.

Napomena:Izveštaj će biti sačuvan pod nazivom ComboFix.txt na sistemskoj particiji (tipična lokacija: C:\ComboFix.txt);
Ukoliko nakon slanja poruke primetiš da izveštaj nije kompletan, iskoristi opciju Prikači fajl za prilaganje file-a C:\ComboFix.txt uz poruku.

Poslao: 04 Sep 2012 12:22
Idi na vrh
offline
  • Pridružio: 07 Nov 2011
  • Poruke: 78

ComboFix 12-09-03.07 - tracer 09/04/2012 12:11:07.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1459 [GMT -7:00]
Running from: c:\documents and settings\tracer\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\3b4cf133881d406d1d80f8e599c98398_c
c:\documents and settings\tracer\Application Data\DCUQKH.dll
c:\documents and settings\tracer\Application Data\InstallDir
c:\documents and settings\tracer\Application Data\Microsoft\Windows\ox#7cCp.cfg
c:\documents and settings\tracer\Application Data\Microsoft\Windows\ox#7cCp.dat
c:\documents and settings\tracer\Local Settings\Application Data\assembly\tmp
c:\documents and settings\tracer\Local Settings\Application Data\datos.txt
c:\documents and settings\tracer\Local Settings\Application Data\save_en.bmp
c:\documents and settings\tracer\Local Settings\Application Data\save_es.bmp
c:\documents and settings\tracer\Recent\Half-Life 2 Deathmatch.url
C:\Thumbs.db
c:\windows\notepad.tmp
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\_000008_.tmp.dll
c:\windows\system32\_000009_.tmp.dll
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000011_.tmp.dll
c:\windows\system32\_000012_.tmp.dll
c:\windows\system32\_000013_.tmp.dll
c:\windows\system32\_000017_.tmp.dll
c:\windows\system32\_000019_.tmp.dll
c:\windows\system32\_000020_.tmp.dll
c:\windows\system32\_000021_.tmp.dll
c:\windows\system32\_000022_.tmp.dll
c:\windows\system32\DEBUG.log
c:\windows\system32\dllcache\dlimport.exe
c:\windows\system32\dllcache\wmpvis.dll
c:\windows\system32\LGUICOM.DLL
c:\windows\system32\notepad.tmp
c:\windows\system32\SET105.tmp
c:\windows\system32\SET10B.tmp
c:\windows\system32\SET110.tmp
c:\windows\system32\SET111.tmp
c:\windows\system32\SET112.tmp
c:\windows\system32\SET116.tmp
c:\windows\system32\SET117.tmp
c:\windows\system32\SET118.tmp
c:\windows\system32\SET11C.tmp
c:\windows\system32\SET11E.tmp
c:\windows\system32\SET13E.tmp
c:\windows\system32\SET142.tmp
c:\windows\system32\SET15A.tmp
c:\windows\system32\SET15E.tmp
c:\windows\system32\SET168.tmp
c:\windows\system32\SET170.tmp
c:\windows\system32\SET18D.tmp
c:\windows\system32\SET1B6.tmp
c:\windows\system32\SET1C9.tmp
c:\windows\system32\SET1DC.tmp
c:\windows\system32\SET1E6.tmp
c:\windows\system32\SET205.tmp
c:\windows\system32\SET215.tmp
c:\windows\system32\SET216.tmp
c:\windows\system32\SET218.tmp
c:\windows\system32\SET237.tmp
c:\windows\system32\SET238.tmp
c:\windows\system32\SET23E.tmp
c:\windows\system32\SET271.tmp
c:\windows\system32\SET284.tmp
c:\windows\system32\SET29A.tmp
c:\windows\system32\SET29B.tmp
c:\windows\system32\SET29C.tmp
c:\windows\system32\SET2A0.tmp
c:\windows\system32\SET2A1.tmp
c:\windows\system32\SET2A2.tmp
c:\windows\system32\SET2A6.tmp
c:\windows\system32\SET2A8.tmp
c:\windows\system32\SET2B2.tmp
c:\windows\system32\SET2BE.tmp
c:\windows\system32\SET2E2.tmp
c:\windows\system32\SET2E6.tmp
c:\windows\system32\SET312.tmp
c:\windows\system32\SET319.tmp
c:\windows\system32\SET32B.tmp
c:\windows\system32\SET34C.tmp
c:\windows\system32\SET351.tmp
c:\windows\system32\SET36E.tmp
c:\windows\system32\SET387.tmp
c:\windows\system32\SET38D.tmp
c:\windows\system32\SET397.tmp
c:\windows\system32\SET398.tmp
c:\windows\system32\SET3A1.tmp
c:\windows\system32\SET3A2.tmp
c:\windows\system32\SET3A3.tmp
c:\windows\system32\SET3C5.tmp
c:\windows\system32\SET3DB.tmp
c:\windows\system32\SET3E2.tmp
c:\windows\system32\SET3E3.tmp
c:\windows\system32\SET3E4.tmp
c:\windows\system32\SET3EC.tmp
c:\windows\system32\SET3F0.tmp
c:\windows\system32\SET411.tmp
c:\windows\system32\SET412.tmp
c:\windows\system32\SET413.tmp
c:\windows\system32\SET415.tmp
c:\windows\system32\SET417.tmp
c:\windows\system32\SET418.tmp
c:\windows\system32\SET419.tmp
c:\windows\system32\SET41A.tmp
c:\windows\system32\SET43A.tmp
c:\windows\system32\SET447.tmp
c:\windows\system32\SET44E.tmp
c:\windows\system32\SETD5.tmp
c:\windows\system32\SETD7.tmp
c:\windows\system32\SETDB.tmp
c:\windows\system32\SETDC.tmp
c:\windows\system32\SETDE.tmp
c:\windows\system32\SETEA.tmp
c:\windows\system32\SETFA.tmp
c:\windows\system32\SETFD.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\w32dasm8.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-08-04 to 2012-09-04 )))))))))))))))))))))))))))))))
.
.
2012-09-04 03:43 . 2012-09-04 03:43 -------- d-----w- c:\program files\MyScrapNook_12 Chrome Extension
2012-09-03 05:12 . 2012-09-03 05:12 -------- d-----w- c:\program files\Ray Adams
2012-09-01 22:10 . 2012-09-04 15:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-08-30 21:42 . 2012-09-03 17:41 138992 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-08-30 21:42 . 2012-09-03 17:40 281152 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-08-30 21:42 . 2012-08-30 21:42 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-08-30 21:42 . 2012-08-30 21:41 840264 ----a-w- c:\windows\system32\pbsvc (1).exe
2012-08-30 21:35 . 2012-08-30 21:40 -------- d-----w- C:\BF2
2012-08-29 22:58 . 2012-08-29 22:58 -------- d-----w- c:\program files\uTorrent
2012-08-29 22:42 . 2012-08-29 22:42 -------- d-----w- c:\documents and settings\tracer\Application Data\atitray
2012-08-29 22:38 . 2012-08-29 22:38 -------- d-----w- c:\program files\MultiRes
2012-08-29 22:37 . 2012-08-29 22:37 472576 ----a-w- c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe
2012-08-29 22:37 . 2012-08-29 22:37 -------- d-----w- c:\program files\Radeon Omega Drivers
2012-08-28 17:50 . 2012-08-28 17:50 -------- d-----w- c:\documents and settings\tracer\Application Data\Qualys
2012-08-27 23:13 . 2012-08-27 23:13 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\PassMark
2012-08-27 23:13 . 2012-08-27 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PassMark
2012-08-27 06:52 . 2012-08-27 06:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Premium
2012-08-27 06:52 . 2012-08-27 23:08 -------- d-----w- c:\documents and settings\All Users\Application Data\OptimizerPro1
2012-08-27 06:51 . 2012-08-27 06:51 454 ----a-w- C:\user.js
2012-08-27 06:49 . 2012-08-27 06:53 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2012-08-26 01:10 . 2012-08-26 01:10 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Darkpedia_Network
2012-08-26 01:07 . 2012-09-01 17:00 -------- d-----w- c:\program files\DarkSteam
2012-08-23 23:42 . 2012-02-09 21:13 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2012-08-23 23:41 . 2012-08-23 23:42 -------- d-----w- c:\program files\TuneUp Utilities 2012
2012-08-23 15:43 . 2012-08-23 15:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2012-08-23 15:34 . 2012-08-23 15:34 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2012-08-20 06:05 . 2012-08-23 21:45 -------- d-----w- c:\documents and settings\tracer\Application Data\Skype
2012-08-20 06:04 . 2012-08-23 21:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2012-08-19 07:36 . 2012-08-19 07:45 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Facebook
2012-08-17 05:14 . 2012-08-17 17:53 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\VMware
2012-08-17 05:14 . 2012-08-20 04:46 -------- d-----w- c:\documents and settings\tracer\Application Data\VMware
2012-08-17 03:18 . 2012-08-17 03:18 -------- d-----w- c:\documents and settings\tracer\Application Data\Apple Computer
2012-08-17 03:18 . 2012-08-17 03:18 -------- d-----w- c:\documents and settings\tracer\AppData
2012-08-17 03:11 . 2012-08-17 03:18 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2012-08-17 03:11 . 2012-08-17 03:18 -------- d-----w- c:\program files\IObit
2012-08-17 02:39 . 2012-08-26 00:36 -------- d-----w- c:\program files\(zabranjeno)ed Steam
2012-08-17 01:58 . 2012-08-17 01:58 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-17 01:48 . 2012-08-28 01:25 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2012-08-17 01:48 . 2012-08-17 01:48 -------- d-----w- c:\program files\Microsoft SDKs
2012-08-16 23:35 . 2012-08-20 05:57 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware
2012-08-16 23:34 . 2012-08-17 03:26 -------- d-----w- c:\documents and settings\tracer\Application Data\Free Download Manager
2012-08-16 23:27 . 2012-08-17 02:26 -------- d-----w- c:\documents and settings\tracer\Application Data\DAEMON Tools Lite
2012-08-16 23:26 . 2012-08-17 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2012-08-16 18:46 . 2012-08-16 18:46 -------- d-----w- c:\documents and settings\tracer\Application Data\ElevatedDiagnostics
2012-08-16 18:20 . 2002-12-19 15:00 73728 ----a-w- c:\windows\system32\waitwnd.exe
2012-08-16 18:20 . 2002-12-19 15:00 6584 ----a-w- c:\windows\system32\InstFunc.dll
2012-08-16 18:20 . 2002-12-19 15:00 180224 ----a-w- c:\windows\system32\setuplib.dll
2012-08-16 18:19 . 2006-06-19 06:37 36864 ----a-w- c:\windows\system32\amdk8.sys
2012-08-16 18:11 . 2003-10-03 23:28 45056 ----a-w- c:\windows\system32\vusetup.dll
2012-08-16 18:11 . 2003-08-04 22:29 6912 ----a-w- c:\windows\system32\drivers\vulfnth.sys
2012-08-16 18:11 . 2003-08-04 22:29 11392 ----a-w- c:\windows\system32\drivers\vulfntr.sys
2012-08-16 18:08 . 2012-08-16 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2012-08-16 07:46 . 2012-08-25 03:11 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\WMTools Downloaded Files
2012-08-16 07:36 . 2012-08-16 07:36 -------- d-----w- c:\documents and settings\tracer\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-08-16 04:44 . 2012-08-16 04:44 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\PC_Drivers_Headquarters
2012-08-16 04:14 . 2012-08-16 04:14 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Innovative Solutions
2012-08-16 03:56 . 2012-08-16 03:56 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Downloaded Installations
2012-08-16 03:54 . 2012-09-04 19:02 -------- d-----w- c:\documents and settings\tracer\Application Data\uTorrent
2012-08-16 03:52 . 2012-08-16 03:53 -------- d-----w- c:\documents and settings\tracer\Application Data\GetRightToGo
2012-08-16 03:29 . 2012-08-16 03:29 -------- d-----w- c:\documents and settings\tracer\Application Data\Easeware
2012-08-16 02:57 . 2012-08-16 18:51 -------- d-----w- c:\program files\Common Files\ATI Technologies
2012-08-16 02:56 . 2009-07-15 04:05 593920 ------w- c:\windows\system32\ati2sgag.exe
2012-08-15 19:33 . 2012-07-04 03:47 53248 ----a-w- c:\windows\system32\drivers\SETD3.tmp
2012-08-15 18:59 . 2012-08-15 18:59 0 ----a-w- c:\windows\ativpsrm.bin
2012-08-15 18:57 . 2012-08-15 18:57 -------- d-----w- C:\ATI
2012-08-14 23:10 . 2012-08-14 23:10 -------- d-----w- c:\program files\Common Files\EasyInfo
2012-08-14 21:34 . 2012-08-14 21:34 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\PunkBuster
2012-08-14 21:03 . 2012-08-14 21:03 794408 ----a-w- c:\windows\system32\pbsvc.exe
2012-08-13 00:13 . 2012-08-13 00:13 -------- d-----w- c:\documents and settings\tracer\Application Data\Malwarebytes
2012-08-13 00:13 . 2012-08-13 00:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-08-12 20:36 . 2012-08-16 00:41 -------- d-----w- c:\documents and settings\tracer\Application Data\IconChanger
2012-08-12 02:52 . 2012-08-17 17:43 -------- d-----w- c:\documents and settings\tracer\Application Data\IObit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-03 17:40 . 2012-03-03 16:12 281152 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-09-03 06:47 . 2012-03-03 15:55 281152 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-08-28 17:51 . 2012-06-20 07:20 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-28 17:51 . 2012-01-28 19:36 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-28 01:14 . 2012-05-23 21:40 1651104 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll
2012-08-21 09:13 . 2012-01-28 19:18 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2012-01-28 19:18 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2012-01-28 19:18 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2012-02-25 18:57 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-08-21 09:13 . 2012-01-28 19:18 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2012-01-28 19:18 202928 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-08-21 09:13 . 2012-01-28 19:18 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-08-21 09:13 . 2012-01-28 19:18 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-08-21 09:13 . 2012-01-28 19:18 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:13 . 2012-01-28 19:18 113776 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-08-21 09:13 . 2012-01-28 19:18 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-08-21 09:12 . 2012-01-28 19:17 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2012-01-28 19:17 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-08-17 22:50 . 2012-05-23 21:40 18368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll
2012-08-17 01:47 . 2012-05-18 19:08 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2012-08-11 23:36 . 2012-07-06 18:08 2332288 ----a-w- c:\windows\system32\TUKernel.exe
2012-07-13 22:22 . 2012-07-13 22:22 65536 ----a-w- c:\windows\IFinst27.exe
2012-07-06 13:58 . 2002-08-30 14:00 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-06 01:34 . 2012-07-02 06:14 2237088 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2012-07-04 14:05 . 2012-01-29 00:52 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2002-08-30 14:00 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2002-08-30 14:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2002-08-30 14:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2002-08-30 14:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2012-01-28 17:01 385024 ----a-w- c:\windows\system32\html.iec
2012-06-26 21:06 . 2012-06-20 13:14 360264 ----a-w- c:\windows\system32\EasyRedirect.dll
2012-06-19 23:54 . 2012-01-28 16:07 6141584 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2012-06-06 21:00 . 2012-01-28 16:07 20065936 ----a-w- c:\windows\RTHDCPL.EXE
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-14 08:10 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-08-29 897424]
"AtiTrayTools"="c:\program files\Ray Adams\ATI Tray Tools\atitray.exe" [2011-10-29 929792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-08-21 4282728]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"EM_EXEC"="c:\progra~1\mousew~1\system\em_exec.exe" [2002-05-01 28672]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5.5ServiceManager
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\(zabranjeno)ed Steam Service
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMMON
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCShield
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCShield Monitor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCShieldTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Super Hide IP
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TransBar
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowFX
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-07-15 04:25 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-08-29 22:58 897424 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WindowFX"=2 (0x2)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" /MINIMIZED
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"RTHDCPL"=rthdcpl.exe
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"
"AntiSpyWareDisableNotify"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"59018:TCP"= 59018:TCP:Pando Media Booster
"59018:UDP"= 59018:UDP:Pando Media Booster
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [3/13/2012 7:09 AM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [3/13/2012 7:09 AM 5248]
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [1/28/2012 12:17 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [1/28/2012 12:18 PM 202928]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [3/14/2012 1:59 AM 14776]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [1/28/2012 12:18 PM 113776]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2/25/2012 11:57 AM 18544]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1/28/2012 12:18 PM 729752]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1/28/2012 12:18 PM 355632]
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [8/15/2011 4:59 AM 20512]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1/28/2012 6:00 PM 13696]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/28/2012 12:18 PM 21256]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [1/28/2012 12:17 PM 133912]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [2/9/2012 1:16 PM 10064]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [3/15/2012 6:33 AM 17792]
R4 MBAMProtector;MBAMProtector;\??\c:\windows\system32\drivers\mbam.sys --> c:\windows\system32\drivers\mbam.sys [?]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys --> c:\windows\system32\DRIVERS\vmci.sys [?]
S2 IBUpdaterService;Updater Service; [x]
S2 PfFilter;PfFilter;\??\g:\protected folder\pffilter.sys --> g:\protected folder\pffilter.sys [?]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [2/9/2012 2:13 PM 1529152]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6/20/2012 12:20 AM 250568]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6/26/2012 11:57 PM 1691480]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [1/30/2012 7:00 AM 103040]
S3 getbus;getbus; [x]
S3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\drivers\HIDUSBF.SYS [7/21/2012 12:14 PM 3616]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys --> c:\windows\system32\drivers\nvhda32.sys [?]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [8/15/2011 4:06 PM 104752]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [3/30/2009 3:09 AM 239336]
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-20 17:51]
.
2012-09-04 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-08-23 09:12]
.
2012-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1808021631-1553047175-750149628-1003Core.job
- c:\documents and settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-28 17:22]
.
2012-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448539723-152049171-839522115-1003Core.job
- c:\documents and settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-28 17:22]
.
2012-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448539723-152049171-839522115-1003UA.job
- c:\documents and settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-28 17:22]
.
.
------- Supplementary Scan -------
.
uStart Page = [Link mogu videti samo ulogovani korisnici]
IE: Download Video on This Page - c:\program files\Tomato\YouTube Video Downloader\MDIEEx.dll/211
IE: Download Video This Links To - c:\program files\Tomato\YouTube Video Downloader\MDIEEx.dll/212
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{11F19C45-9675-488A-A8E0-8E8234DC245D}
Trusted Zone: microsoft.com\www.update
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
MSConfigStartUp-RocketDock - c:\program files\custopacktools\utils\rocketdock\rocketdock.exe
MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe
MSConfigStartUp-vmnat - c:\program files\vmware\vmware player\vmnat.exe
AddRemove-2kv4.8.442 - c:\windows\Radeon Omega Drivers v4.8.442
AddRemove-{C9BED750-1211-4480-B1A5-718A3BE15525} - c:\program files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2012-09-04 12:16
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
C:\avast! sandbox
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1808021631-1553047175-750149628-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"
.
[HKEY_LOCAL_MACHINE\software\Classes\RCFile\shell\Ä*“¬*±´“"\command]
@=expand:"notepad.exe \"%1\""
.
[HKEY_LOCAL_MACHINE\software\Classes\RESFile\shell\Ä*“¬*±´“"\command]
@=expand:"notepad.exe \"%1\""
.
[HKEY_LOCAL_MACHINE\software\Classes\VCDFile\shell\Ä*“¬*±´“"\command]
@=expand:"notepad.exe \"%1\""
.
[HKEY_LOCAL_MACHINE\software\Classes\VMTFile\shell\Ä*“¬*±´“"\command]
@=expand:"Notepad.exe \"%1\""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1404)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2012-09-04 12:18:43
ComboFix-quarantined-files.txt 2012-09-04 19:18
.
Pre-Run: 130,697,748,480 bytes free
Post-Run: 131,097,067,520 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /TUTag=CGPWXL /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional (TuneUp Backup)" /fastdetect /NoExecute=OptIn /TUTag=CGPWXL-BAK
.
- - End Of File - - 1BACFF8051DAB269A93F6F3AA56DE3EB

Poslao: 04 Sep 2012 16:01
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Otvoriti Notepad i iskopirati sledeci tekst:

FCopy::
c:\windows\ServicePackFiles\i386\atapi.sys|c:\windows\system32\drivers\atapi.sys

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59018:TCP"=-
"59018:UDP"=-

DDS::
uStart Page = hxxp://mystart.incredibar.com/mb139?a=6PQHLrsrav&i=26


Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 04 Sep 2012 21:00
Idi na vrh
offline
  • Pridružio: 07 Nov 2011
  • Poruke: 78

ComboFix 12-09-04.02 - tracer 09/04/2012 20:35:22.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1573 [GMT -7:00]
Running from: c:\documents and settings\tracer\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\tracer\Desktop\CFScript.txt
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\ServicePackFiles\i386\atapi.sys --> c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2012-08-05 to 2012-09-05 )))))))))))))))))))))))))))))))
.
.
2012-09-03 05:12 . 2012-09-03 05:12 -------- d-----w- c:\program files\Ray Adams
2012-08-30 21:42 . 2012-09-04 20:08 138992 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-08-30 21:42 . 2012-09-04 20:07 281152 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-08-30 21:42 . 2012-08-30 21:42 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-08-30 21:42 . 2012-08-30 21:41 840264 ----a-w- c:\windows\system32\pbsvc (1).exe
2012-08-30 21:35 . 2012-08-30 21:40 -------- d-----w- C:\BF2
2012-08-29 22:58 . 2012-08-29 22:58 -------- d-----w- c:\program files\uTorrent
2012-08-29 22:42 . 2012-08-29 22:42 -------- d-----w- c:\documents and settings\tracer\Application Data\atitray
2012-08-29 22:38 . 2012-08-29 22:38 -------- d-----w- c:\program files\MultiRes
2012-08-29 22:37 . 2012-08-29 22:37 472576 ----a-w- c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe
2012-08-29 22:37 . 2012-08-29 22:37 -------- d-----w- c:\program files\Radeon Omega Drivers
2012-08-28 17:50 . 2012-08-28 17:50 -------- d-----w- c:\documents and settings\tracer\Application Data\Qualys
2012-08-27 23:13 . 2012-08-27 23:13 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\PassMark
2012-08-27 23:13 . 2012-08-27 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PassMark
2012-08-27 06:52 . 2012-08-27 06:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Premium
2012-08-27 06:52 . 2012-08-27 23:08 -------- d-----w- c:\documents and settings\All Users\Application Data\OptimizerPro1
2012-08-27 06:51 . 2012-08-27 06:51 454 ----a-w- C:\user.js
2012-08-27 06:49 . 2012-08-27 06:53 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2012-08-26 01:10 . 2012-08-26 01:10 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Darkpedia_Network
2012-08-26 01:07 . 2012-09-01 17:00 -------- d-----w- c:\program files\DarkSteam
2012-08-23 23:42 . 2012-02-09 21:13 31552 ----a-w- c:\windows\system32\TURegOpt.exe
2012-08-23 23:41 . 2012-08-23 23:42 -------- d-----w- c:\program files\TuneUp Utilities 2012
2012-08-23 15:43 . 2012-08-23 15:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2012-08-23 15:34 . 2012-08-23 15:34 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2012-08-20 06:05 . 2012-08-23 21:45 -------- d-----w- c:\documents and settings\tracer\Application Data\Skype
2012-08-20 06:04 . 2012-08-23 21:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2012-08-19 07:36 . 2012-08-19 07:45 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Facebook
2012-08-17 05:14 . 2012-08-17 17:53 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\VMware
2012-08-17 05:14 . 2012-08-20 04:46 -------- d-----w- c:\documents and settings\tracer\Application Data\VMware
2012-08-17 03:18 . 2012-08-17 03:18 -------- d-----w- c:\documents and settings\tracer\Application Data\Apple Computer
2012-08-17 03:18 . 2012-08-17 03:18 -------- d-----w- c:\documents and settings\tracer\AppData
2012-08-17 03:11 . 2012-08-17 03:18 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2012-08-17 03:11 . 2012-08-17 03:18 -------- d-----w- c:\program files\IObit
2012-08-17 02:39 . 2012-08-26 00:36 -------- d-----w- c:\program files\(zabranjeno)ed Steam
2012-08-17 01:58 . 2012-08-17 01:58 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-17 01:48 . 2012-08-28 01:25 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0
2012-08-17 01:48 . 2012-08-17 01:48 -------- d-----w- c:\program files\Microsoft SDKs
2012-08-16 23:35 . 2012-08-20 05:57 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware
2012-08-16 23:34 . 2012-08-17 03:26 -------- d-----w- c:\documents and settings\tracer\Application Data\Free Download Manager
2012-08-16 23:27 . 2012-08-17 02:26 -------- d-----w- c:\documents and settings\tracer\Application Data\DAEMON Tools Lite
2012-08-16 23:26 . 2012-08-17 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2012-08-16 18:46 . 2012-08-16 18:46 -------- d-----w- c:\documents and settings\tracer\Application Data\ElevatedDiagnostics
2012-08-16 18:20 . 2002-12-19 15:00 73728 ----a-w- c:\windows\system32\waitwnd.exe
2012-08-16 18:20 . 2002-12-19 15:00 6584 ----a-w- c:\windows\system32\InstFunc.dll
2012-08-16 18:20 . 2002-12-19 15:00 180224 ----a-w- c:\windows\system32\setuplib.dll
2012-08-16 18:19 . 2006-06-19 06:37 36864 ----a-w- c:\windows\system32\amdk8.sys
2012-08-16 18:11 . 2003-10-03 23:28 45056 ----a-w- c:\windows\system32\vusetup.dll
2012-08-16 18:11 . 2003-08-04 22:29 6912 ----a-w- c:\windows\system32\drivers\vulfnth.sys
2012-08-16 18:11 . 2003-08-04 22:29 11392 ----a-w- c:\windows\system32\drivers\vulfntr.sys
2012-08-16 18:08 . 2012-08-16 18:08 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2012-08-16 07:46 . 2012-08-25 03:11 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\WMTools Downloaded Files
2012-08-16 07:36 . 2012-08-16 07:36 -------- d-----w- c:\documents and settings\tracer\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant
2012-08-16 04:44 . 2012-08-16 04:44 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\PC_Drivers_Headquarters
2012-08-16 04:14 . 2012-08-16 04:14 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Innovative Solutions
2012-08-16 03:56 . 2012-08-16 03:56 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\Downloaded Installations
2012-08-16 03:54 . 2012-09-05 03:35 -------- d-----w- c:\documents and settings\tracer\Application Data\uTorrent
2012-08-16 03:52 . 2012-08-16 03:53 -------- d-----w- c:\documents and settings\tracer\Application Data\GetRightToGo
2012-08-16 03:29 . 2012-08-16 03:29 -------- d-----w- c:\documents and settings\tracer\Application Data\Easeware
2012-08-16 02:57 . 2012-08-16 18:51 -------- d-----w- c:\program files\Common Files\ATI Technologies
2012-08-16 02:56 . 2009-07-15 04:05 593920 ------w- c:\windows\system32\ati2sgag.exe
2012-08-15 19:33 . 2012-07-04 03:47 53248 ----a-w- c:\windows\system32\drivers\SETD3.tmp
2012-08-15 18:59 . 2012-08-15 18:59 0 ----a-w- c:\windows\ativpsrm.bin
2012-08-15 18:57 . 2012-08-15 18:57 -------- d-----w- C:\ATI
2012-08-14 23:10 . 2012-08-14 23:10 -------- d-----w- c:\program files\Common Files\EasyInfo
2012-08-14 21:34 . 2012-08-14 21:34 -------- d-----w- c:\documents and settings\tracer\Local Settings\Application Data\PunkBuster
2012-08-14 21:03 . 2012-08-14 21:03 794408 ----a-w- c:\windows\system32\pbsvc.exe
2012-08-13 00:13 . 2012-08-13 00:13 -------- d-----w- c:\documents and settings\tracer\Application Data\Malwarebytes
2012-08-13 00:13 . 2012-08-13 00:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-08-12 20:36 . 2012-08-16 00:41 -------- d-----w- c:\documents and settings\tracer\Application Data\IconChanger
2012-08-12 02:52 . 2012-08-17 17:43 -------- d-----w- c:\documents and settings\tracer\Application Data\IObit
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-04 20:07 . 2012-03-03 16:12 281152 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-09-04 19:24 . 2012-03-03 15:55 281152 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-08-28 17:51 . 2012-06-20 07:20 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-28 17:51 . 2012-01-28 19:36 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-28 01:14 . 2012-05-23 21:40 1651104 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll
2012-08-21 09:13 . 2012-01-28 19:18 355632 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-08-21 09:13 . 2012-01-28 19:18 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-08-21 09:13 . 2012-01-28 19:18 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-21 09:13 . 2012-02-25 18:57 18544 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-08-21 09:13 . 2012-01-28 19:18 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-08-21 09:13 . 2012-01-28 19:18 202928 ----a-w- c:\windows\system32\drivers\aswNdis2.sys
2012-08-21 09:13 . 2012-01-28 19:18 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-08-21 09:13 . 2012-01-28 19:18 89624 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-08-21 09:13 . 2012-01-28 19:18 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-08-21 09:13 . 2012-01-28 19:18 113776 ----a-w- c:\windows\system32\drivers\aswFW.sys
2012-08-21 09:13 . 2012-01-28 19:18 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-08-21 09:12 . 2012-01-28 19:17 41224 ----a-w- c:\windows\avastSS.scr
2012-08-21 09:12 . 2012-01-28 19:17 227648 ----a-w- c:\windows\system32\aswBoot.exe
2012-08-17 22:50 . 2012-05-23 21:40 18368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll
2012-08-17 01:47 . 2012-05-18 19:08 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2012-08-11 23:36 . 2012-07-06 18:08 2332288 ----a-w- c:\windows\system32\TUKernel.exe
2012-07-13 22:22 . 2012-07-13 22:22 65536 ----a-w- c:\windows\IFinst27.exe
2012-07-06 13:58 . 2002-08-30 14:00 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-06 01:34 . 2012-07-02 06:14 2237088 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2012-07-04 14:05 . 2012-01-29 00:52 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2002-08-30 14:00 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2002-08-30 14:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2002-08-30 14:00 43520 ------w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2002-08-30 14:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2012-01-28 17:01 385024 ----a-w- c:\windows\system32\html.iec
2012-06-26 21:06 . 2012-06-20 13:14 360264 ----a-w- c:\windows\system32\EasyRedirect.dll
2012-06-19 23:54 . 2012-01-28 16:07 6141584 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
.
.
((((((((((((((((((((((((((((( [Link mogu videti samo ulogovani korisnici] )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-08-30 14:00 . 2008-04-14 08:10 96512 c:\windows\system32\dllcache\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-08-21 09:12 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-08-29 897424]
"AtiTrayTools"="c:\program files\Ray Adams\ATI Tray Tools\atitray.exe" [2011-10-29 929792]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-08-21 4282728]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-30 455168]
"EM_EXEC"="c:\progra~1\mousew~1\system\em_exec.exe" [2002-05-01 28672]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-07-15 04:25 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2012-08-29 22:58 897424 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WindowFX"=2 (0x2)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" /MINIMIZED
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"RTHDCPL"=rthdcpl.exe
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"
"AntiSpyWareDisableNotify"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\WINDOWS\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [3/13/2012 7:09 AM 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [3/13/2012 7:09 AM 5248]
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [1/28/2012 12:17 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [1/28/2012 12:18 PM 202928]
R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [3/14/2012 1:59 AM 14776]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [1/28/2012 12:18 PM 113776]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2/25/2012 11:57 AM 18544]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [1/28/2012 12:18 PM 729752]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1/28/2012 12:18 PM 355632]
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [8/15/2011 4:59 AM 20512]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1/28/2012 6:00 PM 13696]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/28/2012 12:18 PM 21256]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [1/28/2012 12:17 PM 133912]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [2/9/2012 2:13 PM 1529152]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [2/9/2012 1:16 PM 10064]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [3/15/2012 6:33 AM 17792]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys --> c:\windows\system32\DRIVERS\vmci.sys [?]
S2 IBUpdaterService;Updater Service; [x]
S2 PfFilter;PfFilter;\??\g:\protected folder\pffilter.sys --> g:\protected folder\pffilter.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [6/20/2012 12:20 AM 250568]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [6/26/2012 11:57 PM 1691480]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [1/30/2012 7:00 AM 103040]
S3 getbus;getbus; [x]
S3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\drivers\HIDUSBF.SYS [7/21/2012 12:14 PM 3616]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys --> c:\windows\system32\drivers\nvhda32.sys [?]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [8/15/2011 4:06 PM 104752]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [3/30/2009 3:09 AM 239336]
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-20 17:51]
.
2012-09-05 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-08-23 09:12]
.
2012-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1808021631-1553047175-750149628-1003Core.job
- c:\documents and settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-28 17:22]
.
2012-09-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448539723-152049171-839522115-1003Core.job
- c:\documents and settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-28 17:22]
.
2012-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448539723-152049171-839522115-1003UA.job
- c:\documents and settings\tracer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-28 17:22]
.
.
------- Supplementary Scan -------
.
IE: Download Video on This Page - c:\program files\Tomato\YouTube Video Downloader\MDIEEx.dll/211
IE: Download Video This Links To - c:\program files\Tomato\YouTube Video Downloader\MDIEEx.dll/212
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{11F19C45-9675-488A-A8E0-8E8234DC245D}
Trusted Zone: microsoft.com\www.update
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - [Link mogu videti samo ulogovani korisnici]\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-MyScrapNook_12 Chrome Extension Uninstall - c:\program files\MyScrapNook_12 Chrome Extension\bar\MyScrapNookCrxSetup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [Link mogu videti samo ulogovani korisnici]
Rootkit scan 2012-09-04 20:40
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1808021631-1553047175-750149628-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"
.
[HKEY_LOCAL_MACHINE\software\Classes\RCFile\shell\Ä*“¬*±´“"\command]
@=expand:"notepad.exe \"%1\""
.
[HKEY_LOCAL_MACHINE\software\Classes\RESFile\shell\Ä*“¬*±´“"\command]
@=expand:"notepad.exe \"%1\""
.
[HKEY_LOCAL_MACHINE\software\Classes\VCDFile\shell\Ä*“¬*±´“"\command]
@=expand:"notepad.exe \"%1\""
.
[HKEY_LOCAL_MACHINE\software\Classes\VMTFile\shell\Ä*“¬*±´“"\command]
@=expand:"Notepad.exe \"%1\""
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1400)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(4068)
c:\windows\system32\WININET.dll
c:\program files\Ray Adams\ATI Tray Tools\raphook.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-09-04 20:41:36
ComboFix-quarantined-files.txt 2012-09-05 03:41
ComboFix2.txt 2012-09-04 19:18
.
Pre-Run: 131,196,956,672 bytes free
Post-Run: 131,173,502,976 bytes free
.
- - End Of File - - 35086B48AD872A04407FFC7F5BBCE4B4

Poslao: 04 Sep 2012 21:15
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Opisi stanje, ima li poboljsanja?

Poslao: 04 Sep 2012 22:05
Idi na vrh
offline
  • Pridružio: 07 Nov 2011
  • Poruke: 78

Napisano: 04 Sep 2012 21:58

mislim da je to to hvala puno

Dopuna: 04 Sep 2012 22:05

pa jos uvek vise saljem internet paketa nego da primam

Poslao: 04 Sep 2012 22:16
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Napisano: 04 Sep 2012 22:13

Ako mislis na onu sliku iz prvog posta, to je kod svakog tako. Ne znam na sta konkretno mislis kad kazes da vise saljes.

Dopuna: 04 Sep 2012 22:16

Kazi da li imas problema sa YT klipovima i sl.

Koliko vidim imas uTorrent u startupu, da li sidujes nesto?
Mozes da instaliras neki network monitor i da vidis koja aplikacikacija vuce.

Malware-a nemas, tako da ta opcija otpada.

MyCity » Ambulanta -> Arhiva Ambulante » virus opet

Ko je trenutno na forumu
 

Ukupno su 1149 korisnika na forumu :: 24 registrovanih, 4 sakrivenih i 1121 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 15694 - dana 01 Feb 2026 12:23

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: AndrejPetar, berste23, bobor, BrcakRS, BZ, davididu, dekan.m, desmeki, dok80, Draganeli, grunff2, ISOF, Jaz, kihot, Koridor, kutija11, Lazarus2, Makky, pavlo, Pero Petković, Solunac na steroidima, suton, taomaster, Tila Painen