MyCity » Ambulanta -> Arhiva Ambulante » Zašto spybot ne može da ih ukloni?

Zašto spybot ne može da ih ukloni?

Napisano na dan: 25.7.2013
1

Zašto spybot ne može da ih ukloni?
Sledeća strana Pagination

Idi na vrh

Poslao: 25 Jul 2013 17:17
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 425
  • Gde živiš: U kući

Kad sam skenirao sa spybotom pronašao mi je probleme ali ih nije uklonio. Evo slika



A evo i izveštaja
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.25.2
Run by Home at 17:14:56 on 2013-07-25
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.381.1033.18.3545.1767 [GMT 2:00]
.
AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\vssvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
C:\Windows\system32\AUDIODG.EXE
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mWinlogon: Userinit = userinit.exe
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{A2EEAB71-9E59-4F0A-A90F-D432E29D2661} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.rs
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-07-05 21:00; 57ffxtbr@MarineAquarium3Free_57.com; C:\Program Files (x86)\MarineAquarium3Free_57\bar\1.bin
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2013-2-8 71480]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2013-2-8 311096]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2013-2-8 116536]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2013-2-8 45880]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2013-3-29 246072]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2013-2-8 206136]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2013-3-21 240952]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2013-4-1 235520]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-5-14 4937264]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-4-18 283136]
R2 MarineAquarium3Free_57Service;Marine Aquarium LiteService;C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe [2013-7-5 42504]
R3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2013-4-1 110744]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-6-3 162408]
S3 3xHybr64;3xHybrid service;C:\Windows\System32\drivers\3xHybr64.sys [2007-4-20 873216]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;C:\Windows\System32\drivers\RTL2832U_IRHID.sys [2013-5-30 44320]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;C:\Windows\System32\drivers\RTL2832UBDA.sys [2013-5-30 117152]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;C:\Windows\System32\drivers\RTL2832UUSB.sys [2013-5-30 38944]
S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2010-11-21 34816]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WatAdminSvc;Usluga tehnologije aktivacije operativnog sistema Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-4-1 1255736]
SUnknown tsusbhub;tsusbhub; [x]
.
=============== Created Last 30 ================
.
2013-07-25 14:21:03 -------- d-----w- C:\Users\Home\AppData\Local\RockMelt
2013-07-25 11:51:50 -------- d-----w- C:\ProgramData\BetterSoft
2013-07-25 11:50:48 -------- d-----w- C:\ProgramData\InstallMate
2013-07-14 08:03:27 -------- d-----w- C:\Windows\SysWow64\Adobe
2013-07-11 11:18:28 -------- d-----w- C:\Users\Home\AppData\Roaming\DAEMON Tools Lite
2013-07-11 11:17:26 -------- d-----w- C:\ProgramData\DAEMON Tools Lite
2013-07-07 07:28:47 -------- d-----w- C:\ProgramData\MCShield
2013-07-07 07:28:47 -------- d-----w- C:\Program Files (x86)\MCShield
2013-07-06 17:36:16 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-07-05 19:43:03 2455886 ----a-w- C:\Windows\Sim AQUARIUM 3.scr
2013-07-05 19:42:52 1998168 ----a-w- C:\Windows\D3DX9_43.dll
2013-07-05 19:42:52 -------- d-----w- C:\ProgramData\SA3
2013-07-05 19:01:38 -------- d-----w- C:\Users\Home\AppData\Local\MarineAquarium3Free_57
2013-07-05 18:57:11 -------- d-----w- C:\Program Files (x86)\MarineAquarium3Free_57
2013-07-04 09:38:32 -------- d-----w- C:\Users\Home\Nova fascikla
2013-07-02 08:50:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-01 16:08:06 -------- d-----w- C:\Windows\pss
2013-06-29 16:51:57 -------- d-----w- C:\FRST
2013-06-29 14:16:48 -------- d-----w- C:\ProgramData\Simply Super Software
2013-06-29 13:01:16 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-06-29 11:12:10 -------- d-----w- C:\Users\Home\AppData\Local\Adobe
2013-06-29 10:57:06 -------- d-----w- C:\Users\Home\AppData\Local\Deployment
2013-06-29 10:57:06 -------- d-----w- C:\Users\Home\AppData\Local\Apps
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\StarApp
2013-06-28 14:56:03 -------- d-----w- C:\Users\Home\AppData\Roaming\Foxit Software
2013-06-27 07:41:44 -------- d-----w- C:\Users\Home\AppData\Roaming\PhotoScape
2013-06-27 07:41:20 -------- d-----w- C:\Program Files (x86)\PhotoScape
2013-06-26 17:33:42 -------- d-----w- C:\Users\Home\AppData\Roaming\AVG
2013-06-26 17:33:04 -------- d-----w- C:\ProgramData\AVG
2013-06-26 17:32:51 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-26 14:06:17 -------- d-----w- C:\Users\Home\AppData\Roaming\DownLite
2013-06-26 14:03:49 -------- d-----w- C:\Users\Home\AppData\Local\Google
.
==================== Find3M ====================
.
2013-06-29 11:14:42 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-29 11:14:42 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-21 12:45:43 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 12:45:43 867240 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-06-21 12:45:43 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll
.
============= FINISH: 17:15:10,17 ===============

https://www.mycity.rs/must-login.png

Poslao: 25 Jul 2013 18:59
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Preuzmi zoek.exe sa ovog ili ovog linka i sačuvaj ga na Desktop.


zatvori browser i ostale pokrenute programe;
deaktiviraj zaštitni softver ( po potrebi ) Uputstvo ;
dvoklikom pokreni zoek.exe;
pričekaj da se alat startuje ...


U beli okvir prozora iskopiraj sledeći tekst:


process;
filesrcm;
startupall;
skipfix-iedefaults;
firefoxlook;
chromelook;


Klikni na dugme i pričekaj da se skeniranje završi.


zoek ce po potrebi, restartovati Windows a na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Napomena:Izveštaj će biti sačuvan pod nazivom zoek-results.log na sistemskoj particiji (tipična lokacija: C:\zoek-results.log)


Arrow Kopiraj sadrzaj tog loga u poruku.

Poslao: 26 Jul 2013 10:48
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 425
  • Gde živiš: U kući

Zoek.exe Version 4.0.0.4 Updated 21-07-2013
Tool run by Home on pet 26.07.2013 at 10:44:06,20.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Home\Desktop\zoek.exe [Script inserted]

==== System Restore Info ======================

26.7.2013 10:45:26 Zoek.exe System Restore Point Created Succesfully.

==== Running Processes ======================

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Users\Home\Desktop\zoek.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2013-07-05 19:43:03 A5F1CA585B977FB04129E1B4C6374403 2455886 ----a-w- C:\Windows\Sim AQUARIUM 3.scr
2013-07-05 19:42:52 86E39E9161C3D930D93822F1563C280D 1998168 ----a-w- C:\Windows\D3DX9_43.dll
====== C:\Users\Home\AppData\Local\Temp ====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
2013-07-25 16:27:37 393138B07104721B1B4AF95D8F45893A 414656 ----a-w- C:\Windows\Sysnative\FNTCACHE.DAT
====== C:\Windows\Sysnative\drivers =====
2013-07-14 11:38:33 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
====== C:\Windows\Tasks ======
2013-07-25 11:51:51 90A58E6FD85E0B5958C5BFE0A9C5959B 2708 ----a-w- C:\Windows\Sysnative\Tasks\schedule!3036567561
2013-07-25 11:51:50 DEEE82D9517975C88FB853259328EA3C 414 ---ha-w- C:\Windows\Tasks\schedule!3036567561.job
2013-07-01 19:17:51 5666272FF1F9F5D683972D704DC4C1AE 894 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 19:17:51 46A6029C54F5C1D974DF9914A7BEC4DB 3890 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineUA
2013-07-01 19:17:50 039073D6E4C93969C54D8AB19AD41FEE 890 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-01 19:17:50 03532F0783F429E1095F3985991320B0 3638 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineCore
2013-06-29 11:14:43 1CCAD292AB20218AA3D46D33C8892BAF 830 ----a-w- C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:14:43 0E2E029782F39969FADA56D652F107FB 3768 ----a-w- C:\Windows\Sysnative\Tasks\Adobe Flash Player Updater
2013-06-29 10:57:15 D622EFB007881C595B664E2C4090DFCB 3148 ----a-w- C:\Windows\Sysnative\Tasks\{D91E0789-2B12-4F67-8B11-D7FC0A36A75F}
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-07-07 07:28:47 -------- d-----w- C:\Program Files (x86)\MCShield
2013-07-06 17:36:16 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-07-05 18:57:11 -------- d-----w- C:\Program Files (x86)\MarineAquarium3Free_57
2013-07-02 08:50:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-01 19:17:46 -------- d-----w- C:\Program Files (x86)\Google
2013-06-27 07:41:20 -------- d-----w- C:\Program Files (x86)\PhotoScape
======= C: =====
====== C:\Users\Home\AppData\Roaming ======
2013-07-25 15:09:07 3267661C28EEBE52A6991CF9207A3655 108840 ----a-w- C:\users\Home\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-25 14:21:03 -------- d-----w- C:\users\Home\AppData\Local\RockMelt
2013-07-15 19:19:43 -------- d-----w- C:\users\Home\AppData\Locallow\Adobe
2013-07-11 11:18:28 -------- d-----w- C:\users\Home\AppData\Roaming\DAEMON Tools Lite
2013-07-05 19:01:38 -------- d-----w- C:\users\Home\AppData\Local\MarineAquarium3Free_57
2013-07-05 18:57:15 -------- d-----w- C:\users\Home\AppData\Locallow\MarineAquarium3Free_57
2013-07-04 09:39:20 -------- d-----w- C:\users\Home\AppData\Roaming\GRETECH
2013-07-02 08:50:10 -------- d-----w- C:\users\Home\AppData\Roaming\Mozilla
2013-06-29 11:12:10 -------- d-----w- C:\users\Home\AppData\Local\Adobe
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Deployment
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Apps
2013-06-28 14:56:03 -------- d-----w- C:\users\Home\AppData\Roaming\Foxit Software
2013-06-27 07:41:44 -------- d-----w- C:\users\Home\AppData\Roaming\PhotoScape
2013-06-26 17:33:42 -------- d-----w- C:\users\Home\AppData\Roaming\AVG
2013-06-26 14:06:17 -------- d-----w- C:\users\Home\AppData\Roaming\DownLite
2013-06-26 14:03:49 -------- d-----w- C:\users\Home\AppData\Local\Google
====== C:\Users\Home ======
2013-07-25 11:51:50 -------- d-----w- C:\ProgramData\BetterSoft
2013-07-25 11:50:48 -------- d-----w- C:\ProgramData\InstallMate
2013-07-11 11:17:26 -------- d-----w- C:\ProgramData\DAEMON Tools Lite
2013-07-09 08:17:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2013-07-07 07:28:49 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
2013-07-07 07:28:47 -------- d-----w- C:\ProgramData\MCShield
2013-07-06 17:36:20 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2013-07-05 19:42:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sim AQUARIUM 3
2013-07-05 19:42:52 -------- d-----w- C:\ProgramData\SA3
2013-07-04 13:28:27 6FC234AD3752E1267B34FB12BCD6718B 20 --sh--w- C:\Users\Home\ntuser.ini
2013-07-04 09:38:32 -------- d-----w- C:\Users\Home\Nova fascikla
2013-07-01 19:21:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-06-29 14:16:48 -------- d-----w- C:\ProgramData\Simply Super Software
2013-06-29 13:01:16 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\StarApp
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSearchh-NeWWTab
2013-06-28 19:07:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSafe savvee
2013-06-27 07:41:28 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
2013-06-26 19:08:15 -------- d-----w- C:\ProgramData\TEMP
2013-06-26 18:58:25 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SearchNewTab
2013-06-26 18:57:26 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ssaFe! save
2013-06-26 17:33:04 -------- d-----w- C:\ProgramData\AVG
2013-06-26 17:32:51 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-26 14:09:25 -------- d-----w- C:\ProgramData\Real

====== C: exe-files ==
2013-07-25 11:52:07 E717F6CE3A7429BFA6D7F3CF66737A4B 15968 --s-a-r- C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe
2013-07-25 11:51:50 98B03BEF5A2808C5EFA2A0D2430144DE 15968 --s-a-r- C:\ProgramData\InstallMate\OptimizerPro\Setup.exe
2013-07-25 11:51:50 2960400094498DAE47B36173286D76A0 348160 ------w- C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
=== C: other files ==
2013-07-25 15:07:12 25B26E1D9D179E4F0F9762B911463595 634 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave26.zip
2013-07-25 15:07:11 D91B6CFDA90E0375B0E5CF2132D679C3 348691 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave23.zip
2013-07-25 15:07:11 1D33E88320A669EBC989698383CD422D 16413 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave25.zip
2013-07-25 15:07:11 09BB28518A1A14EE66D182FBAC3041DD 348682 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave24.zip
2013-07-25 15:07:09 6EB3A1B1A86F3DD52DB19A9A7C961A57 348616 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave22.zip
2013-07-25 14:52:56 4075459DD814B6269EDC70158CC8B733 652867 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\94da88d1-2b48-47d3-89de-e1ccefac356f.zip
2013-07-25 14:29:21 6A2BD3B434BCED0A8C7CCD3927A75C05 1171317 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\45e76c82-2b25-47d3-8a24-e1ccefac356f.zip
2013-07-19 14:06:56 6F3AAC92A4F83948B47CECB8DC1E744F 3960 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\ef21813c-268e-47d3-867e-e1ccefac356f.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="C:\Program Files (x86)\AVG\AVG2013\avgui.exe /TRAYONLY"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]
"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""


==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BCSSync]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BCSSync"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MCShield Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MCShield Monitor"
"hkey"="HKCU"
"command"="C:\\Program Files (x86)\\MCShield\\MCShieldRTM.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WinampAgent"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Winamp\\winampa.exe\""


==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undetermined Task]
C:\Windows\tasks\schedule\Undetermined Task.exe []

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default
3D76B5C0E02ECC19C1F5756E8FD97F72 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director
2EE9DCAE1D70ABF4D058688DE35F8221 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.16
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dhfcbmlocifngpbjdpgnkbjmgkadkjpp - C:\Program Files (x86)\Industriya\privitize\1.8.21.6\privitize.crx[]
nbmafkdmkkckhggblphicnnhlgljnoje - C:\Program Files (x86)\TornTV.com\torn2_10.crx[]

Google Docs - Home - default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Home - default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Home - default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Home - default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Slagalica fer igra - Ludara.com - Home - default\Extensions\ejpifakoabdhigpeebhalfkjkoidenba
Gmail - Home - default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{18401191-9920-4692-8096-1EA7F09EA828} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}"

==== EOF on pet 26.07.2013 at 10:47:22,29 ======================

Poslao: 26 Jul 2013 13:01
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje


zatvori browser i ostale pokrenute programe;
deaktiviraj zaštitni softver ( po potrebi ) Uputstvo ;
dvoklikom pokreni zoek.exe;
pričekaj da se alat startuje ...


U beli okvir prozora iskopiraj sledeći tekst:


emptyclsid;
C:\WINDOWS\Tasks\At*.job;f 
C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe;f
C:\ProgramData\InstallMate\OptimizerPro\Setup.exe;f
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe;f
FFdefaults;
chrdefaults;
iedefaults; 
C:\Program Files (x86)\TornTV.com;fs
C:\Program Files (x86)\Industriya;fs
nbmafkdmkkckhggblphicnnhlgljnoje;chr
dhfcbmlocifngpbjdpgnkbjmgkadkjpp;chr
emptyalltemp;
autoclean;


Klikni na dugme i pričekaj da se skeniranje završi.


zoek ce po potrebi, restartovati Windows a na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Napomena:Izveštaj će biti sačuvan pod nazivom zoek-results.log na sistemskoj particiji (tipična lokacija: C:\zoek-results.log)


Arrow Kopiraj sadrzaj tog loga u poruku.

Poslao: 26 Jul 2013 14:19
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 425
  • Gde živiš: U kući

Napisano: 26 Jul 2013 14:04

Zoek.exe Version 4.0.0.4 Updated 21-07-2013
Tool run by Home on pet 26.07.2013 at 10:44:06,20.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Home\Desktop\zoek.exe [Script inserted]

==== System Restore Info ======================

26.7.2013 10:45:26 Zoek.exe System Restore Point Created Succesfully.

==== Running Processes ======================

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\PROGRA~2\MARINE~2\bar\1.bin\57barsvc.exe
C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Users\Home\Desktop\zoek.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2013-07-05 19:43:03 A5F1CA585B977FB04129E1B4C6374403 2455886 ----a-w- C:\Windows\Sim AQUARIUM 3.scr
2013-07-05 19:42:52 86E39E9161C3D930D93822F1563C280D 1998168 ----a-w- C:\Windows\D3DX9_43.dll
====== C:\Users\Home\AppData\Local\Temp ====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
2013-07-25 16:27:37 393138B07104721B1B4AF95D8F45893A 414656 ----a-w- C:\Windows\Sysnative\FNTCACHE.DAT
====== C:\Windows\Sysnative\drivers =====
2013-07-14 11:38:33 D41D8CD98F00B204E9800998ECF8427E 0 ---ha-w- C:\Windows\Sysnative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
====== C:\Windows\Tasks ======
2013-07-25 11:51:51 90A58E6FD85E0B5958C5BFE0A9C5959B 2708 ----a-w- C:\Windows\Sysnative\Tasks\schedule!3036567561
2013-07-25 11:51:50 DEEE82D9517975C88FB853259328EA3C 414 ---ha-w- C:\Windows\Tasks\schedule!3036567561.job
2013-07-01 19:17:51 5666272FF1F9F5D683972D704DC4C1AE 894 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 19:17:51 46A6029C54F5C1D974DF9914A7BEC4DB 3890 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineUA
2013-07-01 19:17:50 039073D6E4C93969C54D8AB19AD41FEE 890 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-01 19:17:50 03532F0783F429E1095F3985991320B0 3638 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineCore
2013-06-29 11:14:43 1CCAD292AB20218AA3D46D33C8892BAF 830 ----a-w- C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-29 11:14:43 0E2E029782F39969FADA56D652F107FB 3768 ----a-w- C:\Windows\Sysnative\Tasks\Adobe Flash Player Updater
2013-06-29 10:57:15 D622EFB007881C595B664E2C4090DFCB 3148 ----a-w- C:\Windows\Sysnative\Tasks\{D91E0789-2B12-4F67-8B11-D7FC0A36A75F}
====== C:\Windows\Temp ======
======= C:\Program Files =====
======= C:\Program Files (x86) =====
2013-07-07 07:28:47 -------- d-----w- C:\Program Files (x86)\MCShield
2013-07-06 17:36:16 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-07-05 18:57:11 -------- d-----w- C:\Program Files (x86)\MarineAquarium3Free_57
2013-07-02 08:50:00 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-01 19:17:46 -------- d-----w- C:\Program Files (x86)\Google
2013-06-27 07:41:20 -------- d-----w- C:\Program Files (x86)\PhotoScape
======= C: =====
====== C:\Users\Home\AppData\Roaming ======
2013-07-25 15:09:07 3267661C28EEBE52A6991CF9207A3655 108840 ----a-w- C:\users\Home\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-25 14:21:03 -------- d-----w- C:\users\Home\AppData\Local\RockMelt
2013-07-15 19:19:43 -------- d-----w- C:\users\Home\AppData\Locallow\Adobe
2013-07-11 11:18:28 -------- d-----w- C:\users\Home\AppData\Roaming\DAEMON Tools Lite
2013-07-05 19:01:38 -------- d-----w- C:\users\Home\AppData\Local\MarineAquarium3Free_57
2013-07-05 18:57:15 -------- d-----w- C:\users\Home\AppData\Locallow\MarineAquarium3Free_57
2013-07-04 09:39:20 -------- d-----w- C:\users\Home\AppData\Roaming\GRETECH
2013-07-02 08:50:10 -------- d-----w- C:\users\Home\AppData\Roaming\Mozilla
2013-06-29 11:12:10 -------- d-----w- C:\users\Home\AppData\Local\Adobe
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Deployment
2013-06-29 10:57:06 -------- d-----w- C:\users\Home\AppData\Local\Apps
2013-06-28 14:56:03 -------- d-----w- C:\users\Home\AppData\Roaming\Foxit Software
2013-06-27 07:41:44 -------- d-----w- C:\users\Home\AppData\Roaming\PhotoScape
2013-06-26 17:33:42 -------- d-----w- C:\users\Home\AppData\Roaming\AVG
2013-06-26 14:06:17 -------- d-----w- C:\users\Home\AppData\Roaming\DownLite
2013-06-26 14:03:49 -------- d-----w- C:\users\Home\AppData\Local\Google
====== C:\Users\Home ======
2013-07-25 11:51:50 -------- d-----w- C:\ProgramData\BetterSoft
2013-07-25 11:50:48 -------- d-----w- C:\ProgramData\InstallMate
2013-07-11 11:17:26 -------- d-----w- C:\ProgramData\DAEMON Tools Lite
2013-07-09 08:17:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2013-07-07 07:28:49 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
2013-07-07 07:28:47 -------- d-----w- C:\ProgramData\MCShield
2013-07-06 17:36:20 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
2013-07-05 19:42:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sim AQUARIUM 3
2013-07-05 19:42:52 -------- d-----w- C:\ProgramData\SA3
2013-07-04 13:28:27 6FC234AD3752E1267B34FB12BCD6718B 20 --sh--w- C:\Users\Home\ntuser.ini
2013-07-04 09:38:32 -------- d-----w- C:\Users\Home\Nova fascikla
2013-07-01 19:21:44 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-06-29 14:16:48 -------- d-----w- C:\ProgramData\Simply Super Software
2013-06-29 13:01:16 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\StarApp
2013-06-28 19:09:00 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSearchh-NeWWTab
2013-06-28 19:07:54 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSafe savvee
2013-06-27 07:41:28 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
2013-06-26 19:08:15 -------- d-----w- C:\ProgramData\TEMP
2013-06-26 18:58:25 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SearchNewTab
2013-06-26 18:57:26 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ssaFe! save
2013-06-26 17:33:04 -------- d-----w- C:\ProgramData\AVG
2013-06-26 17:32:51 -------- d-sh--w- C:\ProgramData\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
2013-06-26 14:09:25 -------- d-----w- C:\ProgramData\Real

====== C: exe-files ==
2013-07-25 11:52:07 E717F6CE3A7429BFA6D7F3CF66737A4B 15968 --s-a-r- C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe
2013-07-25 11:51:50 98B03BEF5A2808C5EFA2A0D2430144DE 15968 --s-a-r- C:\ProgramData\InstallMate\OptimizerPro\Setup.exe
2013-07-25 11:51:50 2960400094498DAE47B36173286D76A0 348160 ------w- C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe
=== C: other files ==
2013-07-25 15:07:12 25B26E1D9D179E4F0F9762B911463595 634 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave26.zip
2013-07-25 15:07:11 D91B6CFDA90E0375B0E5CF2132D679C3 348691 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave23.zip
2013-07-25 15:07:11 1D33E88320A669EBC989698383CD422D 16413 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave25.zip
2013-07-25 15:07:11 09BB28518A1A14EE66D182FBAC3041DD 348682 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave24.zip
2013-07-25 15:07:09 6EB3A1B1A86F3DD52DB19A9A7C961A57 348616 ----a-w- C:\ProgramData\Spybot - Search & Destroy\Recovery\BarowwsoeSave22.zip
2013-07-25 14:52:56 4075459DD814B6269EDC70158CC8B733 652867 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\94da88d1-2b48-47d3-89de-e1ccefac356f.zip
2013-07-25 14:29:21 6A2BD3B434BCED0A8C7CCD3927A75C05 1171317 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\45e76c82-2b25-47d3-8a24-e1ccefac356f.zip
2013-07-19 14:06:56 6F3AAC92A4F83948B47CECB8DC1E744F 3960 ----a-w- C:\ProgramData\AVG2013\IDS\quarantine\ef21813c-268e-47d3-867e-e1ccefac356f.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_UI"="C:\Program Files (x86)\AVG\AVG2013\avgui.exe /TRAYONLY"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s"

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]
"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""


==== Startup Registry Disabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BCSSync]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="BCSSync"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MCShield Monitor]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MCShield Monitor"
"hkey"="HKCU"
"command"="C:\\Program Files (x86)\\MCShield\\MCShieldRTM.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WinampAgent"
"hkey"="HKLM"
"command"="\"C:\\Program Files (x86)\\Winamp\\winampa.exe\""


==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ [Undetermined Task]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ [Undetermined Task]
C:\Windows\tasks\schedule\Undetermined Task.exe []

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default
3D76B5C0E02ECC19C1F5756E8FD97F72 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director
2EE9DCAE1D70ABF4D058688DE35F8221 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.16
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dhfcbmlocifngpbjdpgnkbjmgkadkjpp - C:\Program Files (x86)\Industriya\privitize\1.8.21.6\privitize.crx[]
nbmafkdmkkckhggblphicnnhlgljnoje - C:\Program Files (x86)\TornTV.com\torn2_10.crx[]

Google Docs - Home - default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Home - default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Home - default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Home - default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Slagalica fer igra - Ludara.com - Home - default\Extensions\ejpifakoabdhigpeebhalfkjkoidenba
Gmail - Home - default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{18401191-9920-4692-8096-1EA7F09EA828} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}"

==== EOF on pet 26.07.2013 at 10:47:22,29 ======================

Dopuna: 26 Jul 2013 14:07

Greška ovo je isti sadržaj sad ću vam dati pravi.

Dopuna: 26 Jul 2013 14:19

Kad mi se restartovao kompjuter dobio sam dve datoteke pod imenom folders i files. Evo sadržaja
https://www.mycity.rs/must-login.png

https://www.mycity.rs/must-login.png

Poslao: 26 Jul 2013 14:21
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Pogledaj na C:\zoek-results.log

Poslao: 26 Jul 2013 14:42
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 425
  • Gde živiš: U kući

Napisano: 26 Jul 2013 14:41

Zoek.exe Version 4.0.0.4 Updated 21-07-2013
Tool run by Home on pet 26.07.2013 at 14:06:21,05.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Home\Desktop\zoek.exe [Script inserted]

==== System Restore Info ======================

26.7.2013 14:08:05 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\prefs.js:
user_pref("browser.startup.homepage", "www.google.rs");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.useDBForOrder", "false");

Added to C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\prefs.js:

ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default

user.js not found
---- Lines toolbar removed from prefs.js ----


---- Lines toolbar modified from prefs.js ----


---- FireFox user.js and prefs.js backups ----

prefs_26.07.2013_1410_.backup

==== Deleting Files \ Folders ======================

"C:\WINDOWS\Tasks\At*.job" not found
"C:\Program Files (x86)\TornTV.com" not found
"C:\Program Files (x86)\Industriya" not found
"C:\ProgramData\InstallMate\{A18F91AE-C21D-4A38-A8D3-8A3F7A6CB358}\Setup.exe" deleted
"C:\ProgramData\InstallMate\OptimizerPro\Setup.exe" deleted
"C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe" deleted
"C:\windows\SysNative\Tasks\EPUpdater" deleted
"C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\searchplugins\ask-web-search.xml" deleted
"C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default\searchplugins\ask-web-search.xml" deleted
"C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe" deleted
"C:\Users\Home\AppData\Roaming\DRPSu" deleted
"C:\Program Files (x86)\Vittalia" deleted
"C:\Users\Home\AppData\Roaming\DRPSu" deleted
"C:\ProgramData\StarApp" deleted
"C:\ProgramData\BetterSoft" not deleted
"C:\ProgramData\InstallMate" deleted
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SearchNewTab" deleted
"C:\ProgramData\BetterSoft\OptimizerPro" not deleted

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\94yugiu7.default
3D76B5C0E02ECC19C1F5756E8FD97F72 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll - Shockwave Flash
AE7B288233C212C62CD544BF768C45E6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll - Shockwave for Director / Shockwave for Director
2EE9DCAE1D70ABF4D058688DE35F8221 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.16
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dhfcbmlocifngpbjdpgnkbjmgkadkjpp - C:\Program Files (x86)\Industriya\privitize\1.8.21.6\privitize.crx[]
nbmafkdmkkckhggblphicnnhlgljnoje - C:\Program Files (x86)\TornTV.com\torn2_10.crx[]

Google Docs - Home - default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Home - default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Home - default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Home - default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Slagalica fer igra - Ludara.com - Home - default\Extensions\ejpifakoabdhigpeebhalfkjkoidenba
Gmail - Home - default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{18401191-9920-4692-8096-1EA7F09EA828} Yahoo//search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=512435&p={searchTerms}"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\users\Home\AppData\Local\Google\Chrome\User Data\default\Preferences was reset successfully
C:\users\Home\AppData\Local\Google\Chrome\User Data\default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\nbmafkdmkkckhggblphicnnhlgljnoje deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\dhfcbmlocifngpbjdpgnkbjmgkadkjpp deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\users\Home\AppData\Local\Mozilla\Firefox\Profiles\94yugiu7.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\users\Home\AppData\Local\Google\Chrome\User Data\default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

Dopuna: 26 Jul 2013 14:42

Našao sam samo ovo.

Poslao: 26 Jul 2013 14:45
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Ima li detekcije sada?

Poslao: 26 Jul 2013 15:06
Idi na vrh
offline
  • Marko
  • Pridružio: 30 Maj 2013
  • Poruke: 425
  • Gde živiš: U kući

Sad je ovako

Poslao: 26 Jul 2013 15:33
Idi na vrh
rip
  • argus  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 27 Apr 2008
  • Poruke: 9160
  • Gde živiš: Prokuplje

Uradi update SpyBot-a, pokreni ga desni klik Run as Administrator, trebalo bi da obrise taj reg unos.

MyCity » Ambulanta -> Arhiva Ambulante » Zašto spybot ne može da ih ukloni?

Ko je trenutno na forumu
 

Ukupno su 1067 korisnika na forumu :: 33 registrovanih, 7 sakrivenih i 1027 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, airsuba, amaterSRB, aramis s, bobomicek, bojank, bokisha253, Bubimir, dankisha, Dogma21, DPera, goxin, ILGromovnik, Krusarac, LUDI, Marko Marković, mikrimaus, Milos ZA, moldway, Motocar, Niko Bitan, NoOneEver Dreams, operniki, Panter, pein, Ripanjac, Steeeefan, tomigun, vathra, VJ, xoxxvelja, zdrebac, Žrnov