MyCity » Ambulanta -> Arhiva Ambulante » Virus ili Malware

Virus ili Malware

Napisano na dan: 24.10.2015

Virus ili Malware
Sledeća strana Pagination

Idi na vrh

Poslao: 24 Okt 2015 18:31
Idi na vrh
offline
  • Pridružio: 24 Okt 2015
  • Poruke: 5

Drugar me uputio na Vas uz jako dobru preporuku i misljenje da mi mozete pomoci oko virusa ili malware na mom lap topu. Unapred hvala.

Poslao: 24 Okt 2015 18:34
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Dobrodosao na MC,

http://www.mycity.rs/Ambulanta/Kako-otvoriti-temu-u-Ambulanti.html

Poslao: 24 Okt 2015 21:00
Idi na vrh
offline
  • Pridružio: 24 Okt 2015
  • Poruke: 5

Hvala, bolje vas nasao!

Poslao: 24 Okt 2015 21:05
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Isprati uputstvo za postavljanje FRST logova sa mog prethodnog posta.

Poslao: 24 Okt 2015 21:24
Idi na vrh
offline
  • Pridružio: 24 Okt 2015
  • Poruke: 5

Napisano: 24 Okt 2015 21:20

mycity.rs/must-login.png

mycity.rs/must-login.png

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:24-10-2015
Ran by Korisnik (administrator) on KORISNIK-PC (24-10-2015 21:05:45)
Running from C:\Users\Korisnik\Desktop
Loaded Profiles: Korisnik (Available Profiles: Korisnik)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) Language: engleski (SAD)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: geekstogo.com/forum/topic/335081-frst-t.....scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files\Vip mobilni internet\AssistantServices.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
() C:\Program Files\Vip mobilni internet\CancelAutoPlay.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
() C:\Program Files\Vip mobilni internet\UIExec.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
() C:\Program Files\Vip mobilni internet\UIMain.exe
() C:\Program Files\Vip mobilni internet\CMUpdater.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [CancelAutoPlay] => C:\Program Files\Vip mobilni internet\CancelAutoPlay.exe [414544 2012-03-12] ()
HKLM\...\Run: [UIExec] => C:\Program Files\Vip mobilni internet\UIExec.exe [156448 2012-05-11] ()
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6134544 2015-09-26] (AVAST Software)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596528 2015-10-06] (Oracle Corporation)
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6819232 2015-10-23] (SUPERAntiSpyware)
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\MountPoints2: {5ec0e0e8-c7e7-11e4-8cfd-001c23933762} - F:\Autorun.exe
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\MountPoints2: {5ec0e7e6-c7e7-11e4-8cfd-001c23933762} - F:\Autorun.exe
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [293888 2010-11-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-09-26] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.85.64.173 10.85.64.174
Tcpip\..\Interfaces\{02B23615-3DBC-41AF-935E-6FB0DFBED44E}: [DhcpNameServer] 10.85.64.173 10.85.64.174
Tcpip\..\Interfaces\{4626E197-C091-4482-9619-156E9F6E22F4}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-10-22] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-21] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-10-22] (Oracle Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2006-10-27] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Korisnik\AppData\Roaming\Mozilla\Firefox\Profiles\x317si3d.default
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1219160.dll [2015-07-23] (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-10-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-10-22] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Korisnik\AppData\Roaming\Mozilla\Firefox\Profiles\x317si3d.default\user.js [2015-03-12]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-09-26] [not signed]

Chrome:
=======
CHR Profile: C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google презентације) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-10]
CHR Extension: (Google документи) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-10]
CHR Extension: (Google диск) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-01]
CHR Extension: (Google Search) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-24]
CHR Extension: (Google табеле) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-10]
CHR Extension: (Google документи офлајн) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-04]
CHR Extension: (Pumpon) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\haolbibbaablcehodkafnelndogifafa [2015-10-20]
CHR Extension: (Плаћања у Chrome веб-продавници) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-25]
CHR Extension: (Gmail) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-05-10]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-05-10]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [142648 2014-07-23] (SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-09-26] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3219136 2015-09-26] (Avast Software)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 UI Assistant Service; C:\Program Files\Vip mobilni internet\AssistantServices.exe [274760 2012-08-02] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24016 2015-09-26] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [76000 2015-09-26] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-09-26] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49776 2015-09-26] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [789296 2015-09-26] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [434184 2015-09-26] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [115640 2015-09-26] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208664 2015-09-26] (AVAST Software)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2015-10-24] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
R0 ngvss; C:\Windows\system32\Drivers\ngvss.sys [107984 2015-09-26] (AVAST Software)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2015-06-10] (Apple, Inc.) [File not signed]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220752 2015-09-26] (Avast Software)
R3 ZTEusbnet; C:\Windows\System32\DRIVERS\ZTEusbnet.sys [116736 2012-02-06] (ZTE Corporation)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-24 21:05 - 2015-10-24 21:06 - 00011851 _____ C:\Users\Korisnik\Desktop\FRST.txt
2015-10-24 21:05 - 2015-10-24 21:05 - 00000000 ____D C:\FRST
2015-10-24 21:04 - 2015-10-24 21:05 - 01700352 _____ (Farbar) C:\Users\Korisnik\Desktop\FRST.exe
2015-10-24 18:56 - 2015-10-24 18:56 - 00146464 _____ C:\Windows\Minidump\102415-37143-01.dmp
2015-10-24 18:56 - 2015-10-24 18:56 - 00000000 ____D C:\Windows\Minidump
2015-10-24 18:47 - 2015-10-24 18:56 - 00000516 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task ea306007-8ca4-4a79-84c4-14122e6400bd.job
2015-10-24 18:47 - 2015-10-24 18:56 - 00000516 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 0adb0049-9a64-497b-a7db-81d4729bdafa.job
2015-10-24 18:47 - 2015-10-24 18:47 - 00000000 ____D C:\Users\Korisnik\AppData\Roaming\SUPERAntiSpyware.com
2015-10-24 18:46 - 2015-10-24 18:47 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2015-10-24 18:46 - 2015-10-24 18:46 - 00001965 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2015-10-24 18:46 - 2015-10-24 18:46 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com
2015-10-24 18:46 - 2015-10-24 18:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-10-22 10:13 - 2015-10-22 10:13 - 00000000 ____D C:\Program Files\Common Files\Java
2015-10-20 21:04 - 2015-10-23 22:18 - 00000000 ____D C:\Users\Korisnik\Desktop\Za skidanje
2015-10-20 21:04 - 2015-10-23 21:45 - 00000000 ____D C:\Users\Korisnik\Desktop\Skinuto
2015-10-08 10:35 - 2015-10-08 10:35 - 00000000 ___RD C:\Program Files\Skype
2015-10-08 10:35 - 2015-10-08 10:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-10-08 10:35 - 2015-10-08 10:35 - 00000000 ____D C:\Program Files\Common Files\Skype
2015-09-26 12:22 - 2015-09-26 12:22 - 00313472 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-09-26 12:22 - 2015-09-26 12:22 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-24 21:03 - 2015-03-11 21:16 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-10-24 20:38 - 2015-03-11 04:23 - 02030649 _____ C:\Windows\WindowsUpdate.log
2015-10-24 20:33 - 2015-08-15 10:09 - 00006440 _____ C:\Windows\setupact.log
2015-10-24 20:33 - 2015-03-10 20:49 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-24 20:33 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-24 20:26 - 2015-03-10 20:49 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-24 20:10 - 2015-03-10 20:54 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-24 19:59 - 2015-03-11 14:16 - 00000000 ____D C:\Program Files\Vip mobilni internet
2015-10-23 22:28 - 2015-05-22 21:25 - 00000000 ____D C:\KMPlayer
2015-10-22 10:14 - 2015-03-10 20:54 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-10-22 10:14 - 2015-03-10 20:54 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-10-22 10:12 - 2015-08-24 10:02 - 00000000 ____D C:\Users\Korisnik\.oracle_jre_usage
2015-10-22 10:12 - 2015-03-10 20:51 - 00095840 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-10-22 10:12 - 2015-03-10 20:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-10-22 10:11 - 2015-03-10 20:50 - 00000000 ____D C:\Program Files\Java
2015-10-22 10:01 - 2015-03-10 20:51 - 00000000 ____D C:\ProgramData\Oracle
2015-10-21 13:35 - 2015-03-10 20:50 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2015-10-21 10:32 - 2010-11-20 23:01 - 00713888 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-19 12:03 - 2015-03-11 21:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-10-19 12:03 - 2015-03-11 21:15 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-10-19 10:19 - 2015-05-22 21:29 - 00001139 _____ C:\Users\Korisnik\AppData\Roaming\Microsoft\Windows\Start Menu\GOM Player.lnk
2015-10-15 11:21 - 2015-03-10 21:36 - 00000000 ____D C:\Users\Korisnik\AppData\Roaming\Skype
2015-10-15 10:10 - 2015-03-10 20:58 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-10-14 12:34 - 2015-03-11 21:04 - 00000000 ____D C:\Users\Korisnik\AppData\LocalLow\KMPlayer
2015-10-08 14:10 - 2010-11-20 23:48 - 01086376 _____ C:\Windows\PFRO.log
2015-10-08 10:51 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Registration
2015-10-08 10:35 - 2015-03-10 20:52 - 00000000 ____D C:\ProgramData\Skype
2015-10-05 09:50 - 2015-03-11 21:15 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-10-05 09:50 - 2015-03-11 21:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-10-05 09:50 - 2015-03-11 21:15 - 00023256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-10-01 14:03 - 2009-07-14 06:34 - 00020640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-01 14:03 - 2009-07-14 06:34 - 00020640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-26 12:22 - 2015-05-10 13:21 - 00434184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-09-26 12:22 - 2015-05-10 13:21 - 00208664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-09-26 12:22 - 2015-05-10 13:21 - 00115640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-09-26 12:22 - 2015-05-10 13:21 - 00081728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-09-26 12:22 - 2015-05-10 13:21 - 00076000 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-09-26 12:22 - 2015-05-10 13:21 - 00049776 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-09-26 12:22 - 2015-05-10 13:21 - 00024016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-09-26 12:21 - 2015-08-21 11:12 - 00107984 _____ (AVAST Software) C:\Windows\system32\Drivers\ngvss.sys
2015-09-26 12:21 - 2015-05-10 13:21 - 00789296 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

==================== Files in the root of some directories =======

2015-05-22 12:51 - 2015-05-22 12:51 - 0008292 _____ () C:\Users\Korisnik\AppData\Roaming\UserTile.png

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-21 18:13

==================== End of FRST.txt ============================

Dopuna: 24 Okt 2015 21:24

Nesto sam uradio, a sta i kako...? Ne znam!

Poslao: 25 Okt 2015 00:09
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Arrow Deinstaliraj SUPERAntiSpyware.

1. Otvori Notepad (Text Document) i iskopiraj sledeći tekst unutar kod polja ispod:

CreateRestorePoint:
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\MountPoints2: {5ec0e0e8-c7e7-11e4-8cfd-001c23933762} - F:\Autorun.exe
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\MountPoints2: {5ec0e7e6-c7e7-11e4-8cfd-001c23933762} - F:\Autorun.exe
FF user.js: detected! => C:\Users\Korisnik\AppData\Roaming\Mozilla\Firefox\Profiles\x317si3d.default\user.js [2015-03-12]
CHR Extension: (Pumpon) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\haolbibbaablcehodkafnelndogifafa [2015-10-20]
EmptyTemp:



2. Sačuvaj notepad na Desktop pod nazivom fixlist.txt
To možes uraditi i iz notepad-a => klik na File potom na Save As i u novom prozoru, dole pod File Name: staviš za naziv fixlist.txt
Napomena: Važno je da se oba fajla, FRST i fixlist nalaze na istoj lokaciji jer u suprotnom fix nece raditi.

3. Ponovo pokreni FRST/FRST64, klikni jednom na dugme Fix i sačekaj.
Ukoliko alat zatraži restart sistema, dozvoli mu i postaraj se da alat kompletira fix nakon restarta sistema.



Alat će formirati log (Fixlog.txt) na Desktop-u. Potrebno je sadržaj tog loga iskopirati u poruku.
Napomena: Ukoliko te alat upozori da postoji novija verzija, postaraj se da preuzmes i koristiš ažuriranu kopiju FRST-a.

---------

Preuzmi "Xplode"-ov AdwCleaner i sačuvaj ga na Desktop
Dvoklikom pokreni program.
U EULA prozoru klikni na I agree.
U Options isključi Reset Winsock settings ako je uključen.
Klikni na dugme Scan i sačekaj da se završi skeniranje.
Klikni na dugme Cleaning i pričekaj da program završi.
Program će zatvoriti sve aktivne programe i izbaciti prozor sa tim upozorenjem. Klikni OK kao potvrdu.
Na sljedeća dva prozora koja se otvore (Informations i Restart required ) klikni OK
Računar će se restartovati, a potom otvoriti Notepad (C:\Adwcleaner\AdwCleaner[C1].txt) sa izvještajem.
Sačuvaj taj izvještaj na Desktop i okači ga uz poruku koristeći opciju "Prikači fajl"

---------

Preuzmi Junkware Removal Tool ( JRT ) i sacuvaj ga na desktop.

zatvori browser i ostale pokrenute programe;

Privremeno deaktiviraj zastitni softver (Uputstvo);

dvoklikom na ikonicu ( )pokreni program JRT;

Kod obavestenja "press any key" pritisnuti bilo koji taster i alat ce zapoceti skeniranje.
Napomena: u zavisnosti od sistemske specifikacije vreme skeniranja u nekim slucajevima moze da potraje.

Kada zavrsi otvorice se log sa izvestajem koji ce biti sacuvan na desktopu pod nazivom JRT.txt

Arrow Kopiraj sadrzaj tog loga u temu.

Poslao: 25 Okt 2015 13:27
Idi na vrh
offline
  • Pridružio: 24 Okt 2015
  • Poruke: 5

Napisano: 25 Okt 2015 12:35

Fix result of Farbar Recovery Scan Tool (x86) Version:25-10-2015
Ran by Korisnik (2015-10-25 12:16:25) Run:1
Running from C:\Users\Korisnik\Desktop
Loaded Profiles: Korisnik (Available Profiles: Korisnik)
Boot Mode: Normal

==============================================

fixlist content:
*****************
CreateRestorePoint:
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\MountPoints2: {5ec0e0e8-c7e7-11e4-8cfd-001c23933762} - F:\Autorun.exe
HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\...\MountPoints2: {5ec0e7e6-c7e7-11e4-8cfd-001c23933762} - F:\Autorun.exe
FF user.js: detected! => C:\Users\Korisnik\AppData\Roaming\Mozilla\Firefox\Profiles\x317si3d.default\user.js [2015-03-12]
CHR Extension: (Pumpon) - C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\haolbibbaablcehodkafnelndogifafa [2015-10-20]
EmptyTemp:
*****************

Restore point was successfully created.
"HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ec0e0e8-c7e7-11e4-8cfd-001c23933762}" => key removed successfully.
HKCR\CLSID\{5ec0e0e8-c7e7-11e4-8cfd-001c23933762} => key not found.
"HKU\S-1-5-21-3934022801-4227452235-4244654791-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ec0e7e6-c7e7-11e4-8cfd-001c23933762}" => key removed successfully.
HKCR\CLSID\{5ec0e7e6-c7e7-11e4-8cfd-001c23933762} => key not found.
C:\Users\Korisnik\AppData\Roaming\Mozilla\Firefox\Profiles\x317si3d.default\user.js => moved successfully
C:\Users\Korisnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\haolbibbaablcehodkafnelndogifafa => moved successfully
EmptyTemp: => 635.9 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 12:17:25 ====

Dopuna: 25 Okt 2015 12:46

mycity.rs/must-login.png

Dopuna: 25 Okt 2015 13:09

mycity.rs/must-login.png

Dopuna: 25 Okt 2015 13:27

Sva uputstva sam ispostovao ispravno i korektno, nadam se. Malo cu se posvetiti lap topu i proveriti kako radi, iako mi se vec cini da poboljsanje postoji, brzi je, precizniji, ne zaglupljuje. Veliko hvala na pomoci, bicemo u kontaktu.
Pozdrav,
Yoker

Poslao: 25 Okt 2015 15:38
Idi na vrh
offline
  • helen1  Male
  • Anti Malware Fighter
    Rank 2
  • Master učitelj
  • Pridružio: 27 Avg 2005
  • Poruke: 8620
  • Gde živiš: Novi Beograd

Sve si dobro odradio. Mislim i ja da je to to.

• Sledeća procedura će implementirati završno čišćenje.



Arrow Preuzmi "Xplode"-ov DelFix alat i snimi ga na Desktop.

Dvoklikom pokreni alat i štikliraj kućice ispred sledećih opcija;
Remove disinfection tools
Create registry backup
Purge System Restore

Klikni na dugme Run i pričekaj trenutak dok alat ne završi svoj rad.

Od ovog trenutka, svi korišćeni alati u ovoj temi bi trebali biti obrisani.
Ukoliko neki alat ili izveštaj nije uklonjen, slobodno ih obriši ručno.


Alat će takođe formirati izveštaj za tebe. (C:\DelFix.txt)
- Alat će snimiti i zdravo stanje registy-ja i napraviti backup koristeci integrisan program "ERUNT" u %windir%\ERUNT\DelFix
- DelFix briše stare system restore tačke i pravi novu, svežu tačku nakon čišćenja.

Poslao: 25 Okt 2015 16:43
Idi na vrh
offline
  • Pridružio: 24 Okt 2015
  • Poruke: 5

Odradio sam i poslednju operaciju na koju ste me uputili sa DelFix-om (nadam se uspesno), ali moram Vam priznati da se i pre toga stanje mog lap topa drasticno poboljsalo, znatno je brzi i precizniji. Svima se mnogo zahvaljujem na pomoci, specijalno helen 1.
Veliki pozdrav
Yoker

MyCity » Ambulanta -> Arhiva Ambulante » Virus ili Malware

Ko je trenutno na forumu
 

Ukupno su 965 korisnika na forumu :: 29 registrovanih, 3 sakrivenih i 933 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: aramis s, Areal84, Avalon015, darcaud, DENIRO, DH, Dorcolac, Georgius, Koridor, Krusarac, Marko Marković, mile23, milenko crazy north, Milos ZA, Milos1389, oldtimer, pein, robertino, rovac, royst33, ruso, Sir Budimir, SlaKoj, Smiljke, tmanda323, Vlada1389, wizzardone, zixmix, šumar bk2