MyCity » Ambulanta -> Arhiva Ambulante » Provjera da li ima virusa?

Provjera da li ima virusa?

Napisano na dan: 9.11.2015
1

Provjera da li ima virusa?
Sledeća strana Pagination

Idi na vrh

Poslao: 09 Nov 2015 12:17
Idi na vrh
offline
  • Anunnaki
  • Pridružio: 20 Apr 2012
  • Poruke: 1645

Pozdrav,
Imam problem sa pretrazivacem iskacu mi tolbari, usporen je internet, kad gledam yt.
U pitanju je Windows 8.1 64-bit
Evo izvjestaja

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-11-2015
Ran by Sandra (administrator) on SANDRA (09-11-2015 12:11:41)
Running from C:\Users\Sandra\Desktop
Loaded Profiles: Sandra (Available Profiles: Sandra & Guest)
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-t.....scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [27024 2013-01-18] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13262480 2012-12-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1256080 2012-12-03] (Realtek Semiconductor)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2012-11-23] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6134544 2015-09-21] (AVAST Software)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-29] (Piriform Ltd)
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\...\MountPoints2: {fb6d4f44-0942-11e5-bee8-60a44c6f6348} - "D:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-09-21] (AVAST Software)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{3B6DF291-AD7C-4E0A-B3DA-8651F8628FCD}: [DhcpNameServer] 13.5.0.66
Tcpip\..\Interfaces\{F1BA02C2-4ED3-43B5-9BF8-9069650020D4}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> {1051932C-989E-4104-B8B3-D9718E92681D} URL = hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq&q={searchTerms}&r=854
SearchScopes: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-01] (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-01] (AVAST Software)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK

FireFox:
========
FF ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default
FF NewTab: hxxp://searchsimple-a.akamaihd.net/?m=tab&affID=mt-dq
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: hxxps://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Yahoo! Search
FF Homepage: hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq
FF Keyword.URL: hxxp://searchsimple-a.akamaihd.net/?q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-17] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-13] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-06-26] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml [2014-12-10]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml [2015-09-22]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\google-avast.xml [2015-08-13]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml [2015-08-13]
FF Extension: Pine Tree 1.0.1 - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi [2015-10-08] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-09-21] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon => not found
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\defsearchp@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\deskCutv2@gmail.com => not found

Chrome:
=======
CHR Profile: C:\Users\Sandra\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast Online Security) - C:\Users\Sandra\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Sandra\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-15]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-09-21] (AVAST Software)
R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [31632 2013-01-18] (Intel Corporation)
R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [33168 2013-01-18] (Intel Corporation)
R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [39824 2013-01-18] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
S3 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-09-21] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-09-21] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-09-21] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-09-21] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1059656 2015-11-06] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449992 2015-11-06] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [153744 2015-09-21] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-09-21] (AVAST Software)
S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-01-16] (ASUS Corporation)
R3 DptfDevDram; C:\Windows\system32\DRIVERS\DptfDevDram.sys [107920 2013-01-18] (Intel Corporation)
R3 DptfDevFan; C:\Windows\system32\DRIVERS\DptfDevFan.sys [43408 2013-01-18] (Intel Corporation)
R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [65424 2013-01-18] (Intel Corporation)
R3 DptfDevPch; C:\Windows\system32\DRIVERS\DptfDevPch.sys [97680 2013-01-18] (Intel Corporation)
R3 DptfDevProc; C:\Windows\system32\DRIVERS\DptfDevProc.sys [229776 2013-01-18] (Intel Corporation)
R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [363920 2013-01-18] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
R1 {04f4591f-794f-4cd3-bd44-605ca9a098e2}Gw64; C:\Windows\System32\drivers\{04f4591f-794f-4cd3-bd44-605ca9a098e2}Gw64.sys [48776 2015-09-17] (StdLib)
R1 {0f8b6559-f83b-4fe1-988e-fd7ce3f6fd44}Gw64; C:\Windows\System32\drivers\{0f8b6559-f83b-4fe1-988e-fd7ce3f6fd44}Gw64.sys [48776 2015-09-11] (StdLib)
R1 {126336c7-4a78-4328-80f9-e30008142a02}Gw64; C:\Windows\System32\drivers\{126336c7-4a78-4328-80f9-e30008142a02}Gw64.sys [48776 2015-09-26] (StdLib)
R1 {27134153-7909-46db-a364-f96d5c07d5e7}Gw64; C:\Windows\System32\drivers\{27134153-7909-46db-a364-f96d5c07d5e7}Gw64.sys [48776 2015-10-14] (StdLib)
R1 {346beb56-fb1b-4f10-bd51-a3fbe4feb706}Gw64; C:\Windows\System32\drivers\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}Gw64.sys [48776 2015-10-05] (StdLib)
R1 {42bf1881-d939-41ff-84e1-479f2a1fb795}Gw64; C:\Windows\System32\drivers\{42bf1881-d939-41ff-84e1-479f2a1fb795}Gw64.sys [48776 2015-08-20] (StdLib)
R1 {47ed07d3-68fa-4ddf-ab7f-f49b3b3825a3}Gw64; C:\Windows\System32\drivers\{47ed07d3-68fa-4ddf-ab7f-f49b3b3825a3}Gw64.sys [48776 2015-08-24] (StdLib)
R1 {4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}Gw64; C:\Windows\System32\drivers\{4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}Gw64.sys [48776 2015-08-17] (StdLib)
R1 {58a5ae40-f38d-4727-8812-8b35b8e5c83f}Gw64; C:\Windows\System32\drivers\{58a5ae40-f38d-4727-8812-8b35b8e5c83f}Gw64.sys [48776 2015-08-14] (StdLib)
R1 {80e57e04-2dd7-4ce8-9ec3-2ffa9b73012c}Gw64; C:\Windows\System32\drivers\{80e57e04-2dd7-4ce8-9ec3-2ffa9b73012c}Gw64.sys [48776 2015-08-13] (StdLib)
R1 {814b70f2-89de-4982-b4fb-8ca0819c757d}Gw64; C:\Windows\System32\drivers\{814b70f2-89de-4982-b4fb-8ca0819c757d}Gw64.sys [48776 2015-10-03] (StdLib)
R1 {894ab836-f565-449b-a5e4-2c51b897cb3c}Gw64; C:\Windows\System32\drivers\{894ab836-f565-449b-a5e4-2c51b897cb3c}Gw64.sys [48776 2015-09-29] (StdLib)
R1 {9ffa1362-5a89-4483-ab53-e729971bb7cf}Gw64; C:\Windows\System32\drivers\{9ffa1362-5a89-4483-ab53-e729971bb7cf}Gw64.sys [48776 2015-08-28] (StdLib)
R1 {a5b4a5b4-74b5-494b-a6fd-2cfe081bbca9}Gw64; C:\Windows\System32\drivers\{a5b4a5b4-74b5-494b-a6fd-2cfe081bbca9}Gw64.sys [48776 2015-09-14] (StdLib)
R1 {c7908ed8-e375-4125-97a1-cce7ce60fe1a}Gw64; C:\Windows\System32\drivers\{c7908ed8-e375-4125-97a1-cce7ce60fe1a}Gw64.sys [48776 2015-09-01] (StdLib)
R1 {f9345fd3-b976-4de7-89b6-b3ba7c6aaf5b}Gw64; C:\Windows\System32\drivers\{f9345fd3-b976-4de7-89b6-b3ba7c6aaf5b}Gw64.sys [48776 2015-09-20] (StdLib)
R1 {fc639c50-6948-4825-bb5f-f873b3b3cc25}Gw64; C:\Windows\System32\drivers\{fc639c50-6948-4825-bb5f-f873b3b3cc25}Gw64.sys [48776 2015-09-23] (StdLib)
R1 {fcb340ad-66dd-4ad6-b5a6-cf198aae06ea}Gw64; C:\Windows\System32\drivers\{fcb340ad-66dd-4ad6-b5a6-cf198aae06ea}Gw64.sys [48776 2015-10-09] (StdLib)
S2 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-09 12:11 - 2015-11-09 12:12 - 00020287 _____ C:\Users\Sandra\Desktop\FRST.txt
2015-11-09 12:11 - 2015-11-09 12:11 - 00000000 ____D C:\FRST
2015-11-09 12:05 - 2015-11-09 12:05 - 02198528 _____ (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2015-11-09 12:01 - 2015-11-09 12:01 - 00000000 _____ C:\Users\Sandra\Desktop\New Text Document.txt
2015-11-01 08:05 - 2015-11-01 08:05 - 00000077 _____ C:\WINDOWS\setupact.log
2015-11-01 08:05 - 2015-11-01 08:05 - 00000000 _____ C:\WINDOWS\setuperr.log
2015-11-01 08:04 - 2015-11-01 08:04 - 00003286 _____ C:\WINDOWS\PFRO.log
2015-10-15 23:01 - 2015-11-09 11:14 - 01198179 _____ C:\WINDOWS\WindowsUpdate.log
2015-10-15 18:49 - 2015-10-15 19:02 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-10-15 18:49 - 2015-10-15 18:49 - 00000000 ____D C:\Users\Sandra\AppData\Local\Microsoft Help
2015-10-15 18:43 - 2015-10-15 18:45 - 00000000 ____D C:\Users\Sandra\AppData\Roaming\BSplayer PRO
2015-10-15 18:43 - 2015-10-15 18:43 - 00001272 _____ C:\Users\Public\Desktop\Virtual CloneDrive.lnk
2015-10-15 18:43 - 2015-10-15 18:43 - 00001171 _____ C:\ProgramData\Microsoft\Windows\Start Menu\BS.Player PRO.lnk
2015-10-15 18:43 - 2015-10-15 18:43 - 00001165 _____ C:\Users\Public\Desktop\BS.Player PRO.lnk
2015-10-15 18:43 - 2015-10-15 18:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webteh
2015-10-15 18:43 - 2015-10-15 18:43 - 00000000 ____D C:\Program Files (x86)\Webteh
2015-10-15 18:41 - 2015-10-15 18:41 - 00000000 ____D C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-10-15 18:41 - 2015-10-15 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-10-15 18:41 - 2015-10-15 18:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
2015-10-15 18:41 - 2015-10-15 18:41 - 00000000 ____D C:\Program Files (x86)\Elaborate Bytes
2015-10-15 18:40 - 2015-10-15 18:42 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-10-15 18:40 - 2015-10-15 18:41 - 00000000 ____D C:\Program Files\WinRAR
2015-10-15 18:40 - 2015-10-15 18:40 - 00001061 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-10-15 18:40 - 2015-10-15 18:40 - 00001049 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-10-15 18:10 - 2015-10-15 19:01 - 00000000 ____D C:\Users\Sandra\Desktop\Microsoft Toolkit 2.5.2 Official Torrent
2015-10-15 18:08 - 2015-10-15 19:01 - 00000000 ____D C:\Users\Sandra\Desktop\MICROSOFT OFFICE WORD 2010
2015-10-15 17:55 - 2015-10-15 17:55 - 00001095 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-10-15 17:55 - 2015-10-15 17:55 - 00000000 ____D C:\Users\Sandra\AppData\Local\VS Revo Group
2015-10-15 17:55 - 2015-10-15 17:55 - 00000000 ____D C:\ProgramData\VS Revo Group
2015-10-15 17:55 - 2015-10-15 17:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-10-15 17:55 - 2015-10-15 17:55 - 00000000 ____D C:\Program Files\VS Revo Group
2015-10-15 17:55 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\WINDOWS\system32\Drivers\revoflt.sys
2015-10-15 16:43 - 2015-10-15 16:43 - 00000000 ____D C:\Users\Sandra\AppData\Local\Intel_Corporation
2015-10-15 07:18 - 2015-10-14 18:54 - 00048776 _____ (StdLib) C:\WINDOWS\system32\Drivers\{27134153-7909-46db-a364-f96d5c07d5e7}Gw64.sys
2015-10-14 19:44 - 2015-09-19 04:18 - 00035384 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-10-14 19:44 - 2015-09-18 14:42 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-10-14 19:44 - 2015-09-18 14:42 - 01163776 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-10-14 19:44 - 2015-09-18 14:42 - 00766464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-10-14 19:44 - 2015-09-18 14:42 - 00699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-10-14 19:44 - 2015-09-18 14:42 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-10-14 19:44 - 2015-09-18 14:42 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-10-14 08:10 - 2015-09-29 13:31 - 07457624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-10-14 08:10 - 2015-09-29 13:31 - 01658536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-10-14 08:10 - 2015-09-29 13:31 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-10-14 08:10 - 2015-09-29 13:31 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-10-14 08:10 - 2015-09-29 13:31 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-10-14 08:10 - 2015-09-29 13:29 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-10-14 08:10 - 2015-09-28 19:45 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-10-14 08:10 - 2015-09-28 19:26 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-10-14 08:10 - 2015-09-28 19:25 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-10-14 08:10 - 2015-09-28 19:25 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-10-14 08:10 - 2015-09-28 19:25 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-10-14 08:10 - 2015-09-28 19:22 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-10-14 08:10 - 2015-09-28 19:22 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-10-14 08:10 - 2015-09-28 19:22 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-10-14 08:10 - 2015-09-28 19:15 - 02243072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-10-14 08:10 - 2015-09-28 19:13 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-10-14 08:10 - 2015-09-28 19:12 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-10-14 08:10 - 2015-09-24 17:42 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2015-10-14 08:10 - 2015-09-24 17:40 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-10-14 08:10 - 2015-09-10 19:02 - 25851392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-10-14 08:10 - 2015-09-10 18:14 - 05990400 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-10-14 08:10 - 2015-09-10 18:09 - 20358144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-10-14 08:10 - 2015-09-10 17:24 - 14456832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-10-14 08:10 - 2015-09-10 17:02 - 04527616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-10-14 08:10 - 2015-09-10 17:00 - 12853760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-10-14 08:10 - 2015-08-27 03:43 - 22372152 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-10-14 08:10 - 2015-08-27 03:42 - 19795904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-10-14 08:10 - 2015-08-07 22:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-10-14 08:10 - 2015-08-07 22:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-10-14 08:10 - 2015-08-07 22:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2015-10-14 08:10 - 2015-08-07 22:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2015-10-14 08:10 - 2015-08-07 22:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2015-10-14 08:10 - 2015-08-07 15:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2015-10-14 08:10 - 2015-08-06 18:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2015-10-14 08:10 - 2015-08-06 17:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2015-10-14 08:10 - 2015-08-06 17:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
2015-10-14 08:10 - 2015-08-06 17:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2015-10-14 08:10 - 2015-07-16 19:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll
2015-10-14 08:09 - 2015-09-10 18:19 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-10-14 08:09 - 2015-09-10 18:18 - 02886656 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-10-14 08:09 - 2015-09-10 18:18 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-10-14 08:09 - 2015-09-10 18:06 - 00616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-10-14 08:09 - 2015-09-10 18:04 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-10-14 08:09 - 2015-09-10 17:51 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2015-10-14 08:09 - 2015-09-10 17:39 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-10-14 08:09 - 2015-09-10 17:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-10-14 08:09 - 2015-09-10 17:37 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-10-14 08:09 - 2015-09-10 17:35 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-10-14 08:09 - 2015-09-10 17:33 - 02279936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-10-14 08:09 - 2015-09-10 17:28 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-10-14 08:09 - 2015-09-10 17:28 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-10-14 08:09 - 2015-09-10 17:27 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-10-14 08:09 - 2015-09-10 17:21 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-10-14 08:09 - 2015-09-10 17:19 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-10-14 08:09 - 2015-09-10 17:19 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-10-14 08:09 - 2015-09-10 17:19 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-10-14 08:09 - 2015-09-10 17:17 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-10-14 08:09 - 2015-09-10 17:17 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2015-10-14 08:09 - 2015-09-10 17:07 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-10-14 08:09 - 2015-09-10 17:05 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-10-14 08:09 - 2015-09-10 17:01 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-10-14 08:09 - 2015-09-10 16:57 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-10-14 08:09 - 2015-09-10 16:57 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-10-14 08:09 - 2015-09-10 16:55 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-10-14 08:09 - 2015-09-10 16:55 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-10-14 08:09 - 2015-09-10 16:55 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-10-14 08:09 - 2015-09-10 16:45 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-10-14 08:09 - 2015-09-10 16:34 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-10-14 08:09 - 2015-09-10 16:31 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-10-14 08:09 - 2015-09-10 16:27 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-10-14 08:09 - 2015-09-10 16:26 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll
2015-10-14 08:09 - 2015-08-22 14:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-09 12:10 - 2014-12-07 16:43 - 03736064 ___SH C:\Users\Sandra\Downloads\Thumbs.db
2015-11-09 12:00 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-11-09 11:28 - 2014-04-09 22:10 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-11-09 09:11 - 2014-12-01 08:28 - 00000000 ___RD C:\Users\Sandra\OneDrive
2015-11-09 09:10 - 2013-07-29 19:25 - 00000916 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-09 08:20 - 2015-05-26 14:59 - 00003922 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{608CC930-56B0-456A-977D-F2FE1705973E}
2015-11-06 15:59 - 2013-07-29 18:56 - 01059656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys
2015-11-06 15:59 - 2013-07-29 18:56 - 00449992 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys
2015-11-06 07:59 - 2013-07-29 18:56 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-11-05 16:43 - 2014-12-01 17:59 - 00816128 ___SH C:\Users\Sandra\Desktop\Thumbs.db
2015-11-05 16:12 - 2013-07-19 13:19 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1439707929-2427184225-1161348364-1001
2015-11-05 13:40 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-02 23:40 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\tracing
2015-11-02 17:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-11-01 09:41 - 2014-09-24 08:15 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-01 08:05 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-01 08:05 - 2013-08-22 15:44 - 00389680 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-01 08:04 - 2014-10-06 08:29 - 00000000 ____D C:\Program Files\Google
2015-11-01 08:04 - 2013-07-29 19:25 - 00000000 ____D C:\Program Files (x86)\Google
2015-11-01 08:04 - 2013-07-29 18:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-01 01:21 - 2013-08-22 14:25 - 01048576 ___SH C:\WINDOWS\system32\config\BBI
2015-10-20 21:01 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-17 09:28 - 2014-04-09 22:10 - 00003718 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-10-16 20:32 - 2015-04-25 06:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-16 05:51 - 2015-07-17 11:20 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-10-16 05:51 - 2015-07-17 11:20 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-15 19:02 - 2014-09-24 07:53 - 00000000 ____D C:\WINDOWS\ShellNew
2015-10-15 19:01 - 2013-08-22 14:25 - 00000178 _____ C:\WINDOWS\win.ini
2015-10-15 18:24 - 2014-12-01 08:06 - 00000000 ____D C:\Users\Sandra
2015-10-15 18:24 - 2013-07-29 19:25 - 00000000 ____D C:\Users\Sandra\AppData\Local\Google
2015-10-15 18:22 - 2012-11-23 16:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS
2015-10-15 18:22 - 2012-11-23 16:08 - 00000000 ____D C:\Program Files (x86)\ASUS
2015-10-15 17:39 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2015-10-15 14:26 - 2014-12-10 07:33 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-10-15 14:26 - 2014-09-24 10:50 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-10-15 14:26 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-10-14 09:07 - 2013-09-10 21:10 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-10-14 09:01 - 2013-07-30 21:34 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2012-11-23 16:07 - 2012-09-07 12:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2012-11-23 16:07 - 2009-07-22 11:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2012-11-23 16:07 - 2012-09-07 12:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS

Some files in TEMP:
====================
C:\Users\Sandra\AppData\Local\Temp\ose00000.exe
C:\Users\Sandra\AppData\Local\Temp\ose00001.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-11-06 08:54

==================== End of FRST.txt ============================

https://www.mycity.rs/must-login.png

Unaprijed Hvala Ziveli

Poslao: 09 Nov 2015 13:23
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6104

1. Otvori Notepad (Text Document) i iskopiraj sledeći tekst unutar kod polja ispod:

Start
File: C:\ProgramData\SetStretch.exe
VerifySignature: C:\Windows\System32\drivers\{0f8b6559-f83b-4fe1-988e-fd7ce3f6fd44}Gw64.sys
VerifySignature: C:\Windows\System32\drivers\{fc639c50-6948-4825-bb5f-f873b3b3cc25}Gw64.sys

CreateRestorePoint:
Folder: C:\ProgramData\Avg_Update_0215pit

Hosts:
C:\WINDOWS\Tasks\0215pitUpdateInfo.job
C:\ProgramData\Avg_Update_0215pit\0215pit_AVG-Secure-Search-Update.exe

RemoveProxy:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

CloseProcesses:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> {1051932C-989E-4104-B8B3-D9718E92681D} URL = hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq&q={searchTerms}&r=854
SearchScopes: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
FF NewTab: hxxp://searchsimple-a.akamaihd.net/?m=tab&affID=mt-dq
FF Homepage: hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq
FF Keyword.URL: hxxp://searchsimple-a.akamaihd.net/?q=
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml [2014-12-10]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml [2015-09-22]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml [2015-08-13]
FF Extension: Pine Tree 1.0.1 - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi [2015-10-08] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\defsearchp@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\deskCutv2@gmail.com => not found
Task: C:\WINDOWS\Tasks\0215pitUpdateInfo.job => C:\ProgramData\Avg_Update_0215pit\0215pit_AVG-Secure-Search-Update.exe

EmptyTemp:
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\defsearchp@gmail.com
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\deskCutv2@gmail.com
End

2. Sačuvaj notepad na Desktop pod nazivom fixlist.txt
To možes uraditi i iz notepad-a => klik na File potom na Save As i u novom prozoru, dole pod File Name: staviš za naziv fixlist.txt
Napomena: Važno je da se oba fajla, FRST i fixlist nalaze na istoj lokaciji jer u suprotnom fix nece raditi.

3. Ponovo pokreni FRST/FRST64, klikni jednom na dugme Fix i sačekaj.
Ukoliko alat zatraži restart sistema, dozvoli mu i postaraj se da alat kompletira fix nakon restarta sistema.



Alat će formirati log (Fixlog.txt) na Desktop-u. Potrebno je sadržaj tog loga iskopirati u poruku.
Napomena: Ukoliko te alat upozori da postoji novija verzija, postaraj se da preuzmes i koristiš ažuriranu kopiju FRST-a.

Poslao: 09 Nov 2015 14:16
Idi na vrh
offline
  • Anunnaki
  • Pridružio: 20 Apr 2012
  • Poruke: 1645

Fix result of Farbar Recovery Scan Tool (x64) Version:07-11-2015
Ran by Sandra (2015-11-09 13:57:08) Run:1
Running from C:\Users\Sandra\Desktop
Loaded Profiles: Sandra (Available Profiles: Sandra & Guest)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
File: C:\ProgramData\SetStretch.exe
VerifySignature: C:\Windows\System32\drivers\{0f8b6559-f83b-4fe1-988e-fd7ce3f6fd44}Gw64.sys
VerifySignature: C:\Windows\System32\drivers\{fc639c50-6948-4825-bb5f-f873b3b3cc25}Gw64.sys

CreateRestorePoint:
Folder: C:\ProgramData\Avg_Update_0215pit

Hosts:
C:\WINDOWS\Tasks\0215pitUpdateInfo.job
C:\ProgramData\Avg_Update_0215pit\0215pit_AVG-Secure-Search-Update.exe

RemoveProxy:
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

CloseProcesses:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> {1051932C-989E-4104-B8B3-D9718E92681D} URL = hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq&q={searchTerms}&r=854
SearchScopes: HKU\S-1-5-21-1439707929-2427184225-1161348364-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=tugs&uid=ST500LT012-9WS142_S0V4S2RKXXXXS0V4S2RK
FF NewTab: hxxp://searchsimple-a.akamaihd.net/?m=tab&affID=mt-dq
FF Homepage: hxxp://searchsimple-a.akamaihd.net/?affID=mt-dq
FF Keyword.URL: hxxp://searchsimple-a.akamaihd.net/?q=
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml [2014-12-10]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml [2015-09-22]
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml [2015-08-13]
FF Extension: Pine Tree 1.0.1 - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi [2015-10-08] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\defsearchp@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\deskCutv2@gmail.com => not found
Task: C:\WINDOWS\Tasks\0215pitUpdateInfo.job => C:\ProgramData\Avg_Update_0215pit\0215pit_AVG-Secure-Search-Update.exe

EmptyTemp:
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\defsearchp@gmail.com
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\deskCutv2@gmail.com
End
*****************


========================= File: C:\ProgramData\SetStretch.exe ========================

File not signed
MD5: 4A93070098539B54FDA391D4D551C880
Creation and modification date: 2012-11-23 16:07 - 2009-07-22 11:04
Size: 0024576
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
File Version:
Product Version:
Copyright:

====== End of File: ======

"C:\Windows\System32\drivers\{0f8b6559-f83b-4fe1-988e-fd7ce3f6fd44}Gw64.sys" => File is digitally signed
"C:\Windows\System32\drivers\{fc639c50-6948-4825-bb5f-f873b3b3cc25}Gw64.sys" => File is digitally signed
Restore point was successfully created.

========================= Folder: C:\ProgramData\Avg_Update_0215pit ========================

2015-05-16 21:05 - 2015-02-17 14:31 - 2794520 _____ () C:\ProgramData\Avg_Update_0215pit\0215pit_AVG-Secure-Search-Update.exe

====== End of Folder: ======

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
C:\WINDOWS\Tasks\0215pitUpdateInfo.job => moved successfully
C:\ProgramData\Avg_Update_0215pit\0215pit_AVG-Secure-Search-Update.exe => moved successfully

========= RemoveProxy: =========

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========

C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key not found.
Processes closed successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => key removed successfully
HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => key removed successfully
HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found.
"HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1051932C-989E-4104-B8B3-D9718E92681D}" => key removed successfully
HKCR\CLSID\{1051932C-989E-4104-B8B3-D9718E92681D} => key not found.
"HKU\S-1-5-21-1439707929-2427184225-1161348364-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}" => key removed successfully
HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => key not found.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => value restored successfully
Firefox "newtab" removed successfully
Firefox "homepage" removed successfully
Firefox "Keyword.URL" removed successfully
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml => moved successfully
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml => moved successfully
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml => moved successfully
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi => moved successfully
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi => path removed successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\defsearchp@gmail.com => value removed successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\deskCutv2@gmail.com => value removed successfully
C:\WINDOWS\Tasks\0215pitUpdateInfo.job => not found.
"C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\ask-web-search.xml" => not found.
"C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\dsrlte1.xml" => not found.
"C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml" => not found.
"C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\Extensions\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}.xpi" => not found.
"C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\defsearchp@gmail.com" => not found.
"C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\extensions\deskCutv2@gmail.com" => not found.
EmptyTemp: => 891.7 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 13:57:58 ====

Poslao: 09 Nov 2015 17:15
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6104

U redu, sada idemo na dodatnu proveru;

Zoek-ov izvestaj prikaci uz poruku jer rezultat moze biti poduzi.





Preuzmi smeenk-ov zoek.zip ili zoek.rar () sa ovog ili ovog linka i sačuvaj ga na Desktop.

Raspakuj arhivu u neki folder (uputstvo), a zatim:

zatvori browser i ostale pokrenute programe;
privremeno deaktiviraj zaštitni softver ( ukoliko je to potrebno ) Uputstvo ;
dvoklikom pokreni zoek na ikonicu programa ;
pričekaj da se alat startuje ...


U beli okvir prozora iskopiraj sledeći tekst:

Uninstall-List;
searchsimple-a.akamaihd;z
istartsurf;z
searchsimple-a.akamaihd;a
istartsurf;a
AutoClean;

Klikni na dugme i pričekaj da se skeniranje završi.


zoek ce po potrebi, restartovati Windows a na kraju rada, otvoriti Notepad sa izveštajem o skeniranju.

Napomena:Izveštaj će biti sačuvan pod nazivom zoek-results.log na sistemskoj particiji (tipična lokacija: C:\zoek-results.log)


Arrow Sadrzaj tog loga prikaci u poruku koristeci Prikači fajl opciju.

Poslao: 09 Nov 2015 20:04
Idi na vrh
offline
  • Anunnaki
  • Pridružio: 20 Apr 2012
  • Poruke: 1645

https://www.mycity.rs/must-login.png





Zoek.exe v5.0.0.1 Updated 09-November-2015
Tool run by Sandra on Mon 11/09/2015 at 19:31:08.68.
Microsoft Windows 8.1 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Sandra\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-11-09-182347.log 394 bytes

==== Empty Folders Check ======================

C:\Program Files\Google deleted successfully
C:\PROGRA~3\Avg_Update_0215pit deleted successfully
C:\Users\Guest\AppData\Local\VirtualStore deleted successfully
C:\Users\Sandra\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\Sandra\AppData\Local\EmieSiteList deleted successfully
C:\Users\Sandra\AppData\Local\EmieUserList deleted successfully
C:\Users\Sandra\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default

user.js not found
---- Lines yahoo removed from prefs.js ----
user_pref("browser.search.selectedEngine", "Yahoo Search");
---- Lines mindspark removed from prefs.js ----
user_pref("extensions.toolbar.mindspark._4zMembers_.browser.version.last", "39.0");
user_pref("extensions.toolbar.mindspark._4zMembers_.BUTTON_STRUCTURE", "[{\"b\":221584481,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":221584482,
user_pref("extensions.toolbar.mindspark._4zMembers_.competitorDNS", "{\"comment\":\"refresh every 1 week (7*24*60*60*1000)\",\"refreshPeriod\":6048000
user_pref("extensions.toolbar.mindspark._4zMembers_.firstKnownVersion", "6.83.5.42204");
user_pref("extensions.toolbar.mindspark._4zMembers_.homepage", "http://home.tb.ask.com/index.jhtml?n=780d0d02&p2=^HJ^xpi000^YYA^");
user_pref("extensions.toolbar.mindspark._4zMembers_.initialized", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.installDate", "2014121218");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerId", "^HJ^xpi000^YYA^");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.partnerSubId", "");
user_pref("extensions.toolbar.mindspark._4zMembers_.installation.success", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.isCompliantUninstallImplementation", true);
user_pref("extensions.toolbar.mindspark._4zMembers_.lastKnownVersion", "6.83.5.42204");
user_pref("extensions.toolbar.mindspark._4zMembers_.options.defaultSearch", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.homePageEnabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.keywordEnabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.options.tabEnabled", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.partnerPixelFired", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.searchHistory", "radmila vojvodic||jovan ivovic vitez iz topole||prolaz kroz ~i\ranu ogradu||~i\ra
user_pref("extensions.toolbar.mindspark._4zMembers_.successUrl", "http://videodownloadconverter.dl.tb.ask.com/installComplete.jhtml");
user_pref("extensions.toolbar.mindspark._4zMembers_.toolbar.versionChanged", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.toolbarCollapsed", false);
user_pref("extensions.toolbar.mindspark._4zMembers_.weather.location", "10001");
user_pref("extensions.toolbar.mindspark.lastInstalled", "videodownloadconverter@mindspark.com");
---- Lines quick_start removed from prefs.js ----
user_pref("extensions.quick_start.enable_search1", false);
user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
---- Lines istart removed from prefs.js ----
user_pref("browser.search.searchengine.alias", "istartsurf");
user_pref("browser.search.searchengine.iconURL", "http://www.istartsurf.com/favicon.ico");
user_pref("browser.search.searchengine.name", "istartsurf");
user_pref("browser.search.searchengine.url", "http://www.istartsurf.com/web/?type=ds&ts=1439481176&z=468bb72d3026d8a7fd318f9g4zcc2tfz7bag2ecb2t&from=t
---- FireFox user.js and prefs.js backups ----

prefs_20151109_0748_.backup

==== Deleting Files \ Folders ======================

C:\windows\SysNative\Tasks\ASUS Patch for Touch Panel deleted
C:\Users\Sandra\AppData\Roaming\istartsurf deleted
C:\PROGRA~3\SetStretch.VBS deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\windows\SysNative\Tasks\Yahoo! Search Updater deleted
C:\windows\SysNative\drivers\{04f4591f-794f-4cd3-bd44-605ca9a098e2}Gw64.sys deleted
C:\windows\SysNative\drivers\{0f8b6559-f83b-4fe1-988e-fd7ce3f6fd44}Gw64.sys deleted
C:\windows\SysNative\drivers\{126336c7-4a78-4328-80f9-e30008142a02}Gw64.sys deleted
C:\windows\SysNative\drivers\{27134153-7909-46db-a364-f96d5c07d5e7}Gw64.sys deleted
C:\windows\SysNative\drivers\{346beb56-fb1b-4f10-bd51-a3fbe4feb706}Gw64.sys deleted
C:\windows\SysNative\drivers\{42bf1881-d939-41ff-84e1-479f2a1fb795}Gw64.sys deleted
C:\windows\SysNative\drivers\{47ed07d3-68fa-4ddf-ab7f-f49b3b3825a3}Gw64.sys deleted
C:\windows\SysNative\drivers\{4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}Gw64.sys deleted
C:\windows\SysNative\drivers\{58a5ae40-f38d-4727-8812-8b35b8e5c83f}Gw64.sys deleted
C:\windows\SysNative\drivers\{80e57e04-2dd7-4ce8-9ec3-2ffa9b73012c}Gw64.sys deleted
C:\windows\SysNative\drivers\{814b70f2-89de-4982-b4fb-8ca0819c757d}Gw64.sys deleted
C:\windows\SysNative\drivers\{894ab836-f565-449b-a5e4-2c51b897cb3c}Gw64.sys deleted
C:\windows\SysNative\drivers\{9ffa1362-5a89-4483-ab53-e729971bb7cf}Gw64.sys deleted
C:\windows\SysNative\drivers\{a5b4a5b4-74b5-494b-a6fd-2cfe081bbca9}Gw64.sys deleted
C:\windows\SysNative\drivers\{c7908ed8-e375-4125-97a1-cce7ce60fe1a}Gw64.sys deleted
C:\windows\SysNative\drivers\{f9345fd3-b976-4de7-89b6-b3ba7c6aaf5b}Gw64.sys deleted
C:\windows\SysNative\drivers\{fc639c50-6948-4825-bb5f-f873b3b3cc25}Gw64.sys deleted
C:\windows\SysNative\drivers\{fcb340ad-66dd-4ad6-b5a6-cf198aae06ea}Gw64.sys deleted
C:\WINDOWS\SysNative\config\systemprofile\Searches deleted
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\google-avast.xml deleted
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\VideoDownloadConverter_4z deleted

==== Folders Found ======================

2015-10-15 17:25:51 2015-10-15 17:25:51 -------- d-----w- C:\Users\Sandra\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\istartsurf uninstall-15102015-192551
2015-11-09 18:48:12 2015-11-09 18:48:12 -------- d---a-w- C:\zoek_backup\C_Users_Sandra_AppData_Roaming_istartsurf

==== Files Found ======================


--- C:\FRST\Quarantine\C\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default\searchplugins\istartsurf.xml.xBAD ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 2225
Created time: 2015-08-13 15:53:19
Modified time: 2015-08-13 16:14:09
MD5: 0387B3C889F5994588E0C637F1B396B9
SHA1: 0501653AAFD4683E0B21283C79470148333AFBB1


==== Registry Search Results for "searchsimple-a.akamaihd" ======================

No instances of string "searchsimple-a.akamaihd" found.

==== Registry Search Results for "istartsurf" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\istartsurfSoftware]

[HKEY_LOCAL_MACHINE\SOFTWARE\istartsurfSoftware\istartsurfhp]

[HKEY_USERS\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\istartsurf.com]

[HKEY_USERS\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.istartsurf.com]

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default
user_pref("browser.search.defaulturl", "https://www.google.com/search/?trackid=sp-006");
user_pref("browser.search.defaultengine", "Google (avast)");
user_pref("browser.search.defaultenginename", "Google (avast)");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"ff-bmboc@bytemobile.com"="C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon" []

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\xx64iwxk.default
863AF0003392FEBC2667A8A790DED955 - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll - Shockwave Flash


==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted

==== Chromium Look ======================

Google Chrome Version: 46.0.2490.80

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[03/17/2015 04:06 PM]

Avast Online Security - Sandra\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
HKLM\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
HKLM\Wow6432Node\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&amp;form=IE10TR&amp;src=IE10TR&amp;pc=ASU2JS
HKCU\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} - http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ff-bmboc@bytemobile.com deleted successfully

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Avast Free Antivirus.lnk - C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Users\Public\Desktop\BS.Player PRO.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\bsplayer.exe
C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Users\Public\Desktop\TeamViewer 10.lnk - C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Users\Public\Desktop\Virtual CloneDrive.lnk - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDPrefs.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\avast antivirus.lnk -
C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=14394811.....XXS0V4S2RK
C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk - C:\Program Files (x86)\WinRAR\Rar.txt
C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk - C:\Program Files (x86)\WinRAR\WhatsNew.txt
C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk - C:\Program Files (x86)\WinRAR\WinRAR.chm
C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\BS.Player PRO.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\bsplayer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk - C:\WINDOWS\Installer\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\SC_Reader.ico
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk - C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Manual.lnk - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\HelpLauncher.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Uninstall.lnk - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\vcd-uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Virtual CloneDrive Revision History.lnk - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\changes_vcd.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes\VirtualCloneDrive\Virtual CloneDrive.lnk - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDPrefs.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller Pro\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webteh\BS.Player PRO\BS.Player PRO capture.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\bsplayer.exe -capture
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webteh\BS.Player PRO\BS.Player PRO subtitle editor.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\bsplayer.exe -subedit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webteh\BS.Player PRO\BS.Player PRO.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\bsplayer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webteh\BS.Player PRO\Uninstall BS.Player PRO.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\uninstall.EXE
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk - C:\Program Files (x86)\WinRAR\Rar.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk - C:\Program Files (x86)\WinRAR\WhatsNew.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk - C:\Program Files (x86)\WinRAR\WinRAR.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe

==== shortcuts in Quick Launch ======================

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ASUS Install.lnk - C:\eSupport\eDriver\AsInsWiz.exe
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk - C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Libraries
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\BS.Player PRO.lnk - C:\Program Files (x86)\Webteh\BSplayerPro\bsplayer.exe
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=14394811.....XXS0V4S2RK
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==== shortcuts After Repair ======================

C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Sandra\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe

==== Uninstall List x64 ======================

Adobe Flash Player 19 NPAPI [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player NPAPI]
Adobe Reader X (10.1.15) MUI [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}]
Adobe Refresh Manager [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-0804-1033-1959-001824147215}]
Alcor Micro USB Card Reader [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F9D72742-0351-447C-B160-F0A5AC9D87BF}]
Alcor Micro USB Card Reader [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AmUStor]
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{3108C217-BE83-42E4-AE9E-A56A2A92E549}]
ATK Package [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}]
Avast Free Antivirus [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\avast]
BS.Player PRO [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BSPlayerp]
CCleaner [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\CCleaner]
D3DX10 [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E09C4DB7-630C-4F06-A631-8EA7239923AF}]
Google Chrome [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
Google Update Helper [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}]
Google Update Helper [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}]
Intel(R) Dynamic Platform and Thermal Framework [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C]
Intel(R) Management Engine Components [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}]
Intel(R) Processor Graphics [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}]
Intel(R) SDK for OpenCL - CPU Only Runtime Package [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}]
Intelr Trusted Connect Service Client [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}]
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E9F0BCD8-6BD5-1ED7-EDA3-9FCF2A478AA1}]
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F}]
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}]
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}]
Movie Maker [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5BABDA39-61CF-41EE-992D-4054B6649A9B}]
Movie Maker [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ED6C77F9-4D7E-447C-9EC0-9A212D075535}]
Mozilla Firefox 41.0.2 (x86 en-US) [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 41.0.2 (x86 en-US)]
Mozilla Maintenance Service [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService]
MSVCRT [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}]
MSVCRT110 [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}]
MSVCRT110_amd64 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E9FA781F-3E80-4399-825A-AD3E11C28C77}]
Photo Common [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D888F114-7537-4D48-AF03-5DA9C82D7540}]
Photo Gallery [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{30F99474-EBE3-4134-A02B-F6CD38CFE243}]
Photo Gallery [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FC6C7107-7D72-41A1-A031-3CE751159BAB}]
Qualcomm Atheros Client Installation Program [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{28006915-2739-4EBE-B5E8-49B25D32EB33}]
Realtek High Definition Audio Driver [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}]
Revo Uninstaller Pro 3.1.4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1]
TeamViewer 10 [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\TeamViewer]
VirtualCloneDrive [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\VirtualCloneDrive]
Visual Studio 2012 x64 Redistributables [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}]
Visual Studio 2012 x86 Redistributables [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}]
Windows Live Communications Platform [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0454BB9A-2A7A-4214-BDFF-937F7A711A44}]
Windows Live Essentials [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C034A6F9-6569-491B-B3BF-F5D15221A708}]
Windows Live Essentials [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinLiveSuite]
Windows Live Installer [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}]
Windows Live Photo Common [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}]
Windows Live PIMT Platform [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}]
Windows Live SOXE [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FE7C0B3D-50B9-4951-BE78-A321CBF86552}]
Windows Live SOXE Definitions [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}]
Windows Live UX Platform [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4CCBD1F4-CEEC-452A-9CB8-46564B501315}]
Windows Live UX Platform Language Pack [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{18272881-CFC0-434D-A975-E5BE44206AA0}]
WinFlash [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8F21291E-0444-4B1D-B9F9-4370A73E346D}]
WinRAR 5.21 (64-bit) [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver]

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Sandra\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Sandra\AppData\Local\Microsoft\Windows\INetCache\IE\BAWA9JVA will be deleted at reboot
C:\Users\Sandra\AppData\Local\Microsoft\Windows\INetCache\IE\Y4RWHWGG will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Sandra\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=28 folders=3 1101661 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Guest\AppData\Local\Temp emptied successfully
C:\Users\Sandra\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\Sandra\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Sandra\AppData\Local\Microsoft\Windows\INetCache\IE\BAWA9JVA" not found
"C:\Users\Sandra\AppData\Local\Microsoft\Windows\INetCache\IE\Y4RWHWGG" not found

==== EOF on Mon 11/09/2015 at 19:59:09.82 ======================

Poslao: 10 Nov 2015 14:23
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6104

Pozdrav,

Arrow Sada izvrsi ovaj zoek script, znaci na isti nacin kao sto si to malopre uradio;
Restore;|C:\windows\SysNative\Tasks\ASUS Patch for Touch Panel
[-HKEY_LOCAL_MACHINE\SOFTWARE\istartsurfSoftware];r
[-HKEY_LOCAL_MACHINE\SOFTWARE\istartsurfSoftware\istartsurfhp];r
[-HKEY_USERS\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\istartsurf.com];r
[-HKEY_USERS\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.istartsurf.com];r
Reboot;
Iskopiraj sveze postavljen Zoek izvestaj.




Arrow Postavi Firefox na default podesavanja;
https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings




Arrow Sada zapakuj (zip-uj/rar-uj) i uploaduj mi oba foldera na analizu;

C:\FRST\Quarantine
C:\zoek_backup

Koristi ovu formu za upload;
http://www.mycity.rs/ambulanta-upload.php

Poslao: 10 Nov 2015 15:39
Idi na vrh
offline
  • Anunnaki
  • Pridružio: 20 Apr 2012
  • Poruke: 1645

Zoek.exe v5.0.0.1 Updated 09-November-2015
Tool run by Sandra on Tue 11/10/2015 at 14:59:31.80.
Microsoft Windows 8.1 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Sandra\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-11-09-182347.log 394 bytes
C:\zoek-results2015-11-09-185909.log 29405 bytes

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\istartsurfSoftware]
[-HKEY_LOCAL_MACHINE\SOFTWARE\istartsurfSoftware\istartsurfhp]
[-HKEY_USERS\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\istartsurf.com]
[-HKEY_USERS\S-1-5-21-1439707929-2427184225-1161348364-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.istartsurf.com]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=28 folders=3 1101661 bytes)

==== After Reboot ======================

==== EOF on Tue 11/10/2015 at 15:04:15.24 ======================

Morao sam da stavim u dva rara FRST zato sto je bio 14mb

Poslao: 11 Nov 2015 14:32
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6104

Stanje?

Poslao: 11 Nov 2015 23:13
Idi na vrh
offline
  • Anunnaki
  • Pridružio: 20 Apr 2012
  • Poruke: 1645

Stanje je sada mnogo bolje.
Hvala puno Ziveli

Poslao: 12 Nov 2015 18:13
Idi na vrh
offline
  • magna86  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 21 Jun 2008
  • Poruke: 6104

• Sledeća procedura će implementirati završno čišćenje.



Arrow Preuzmi "Xplode"-ov DelFix alat i snimi ga na Desktop.

Dvoklikom pokreni alat i štikliraj kućice ispred sledećih opcija;
Remove disinfection tools
Create registry backup
Purge System Restore

Klikni na dugme Run i pričekaj trenutak dok alat ne završi svoj rad.

Od ovog trenutka, svi korišćeni alati u ovoj temi bi trebali biti obrisani.
Ukoliko neki alat ili izveštaj nije uklonjen, slobodno ih obriši ručno.


Alat će takođe formirati izveštaj za tebe. (C:\DelFix.txt)
- Alat će snimiti i zdravo stanje registy-ja i napraviti backup koristeci integrisan program "ERUNT" u %windir%\ERUNT\DelFix
- DelFix briše stare system restore tačke i pravi novu, svežu tačku nakon čišćenja.

MyCity » Ambulanta -> Arhiva Ambulante » Provjera da li ima virusa?

Ko je trenutno na forumu
 

Ukupno su 1131 korisnika na forumu :: 35 registrovanih, 4 sakrivenih i 1092 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: Andrija357, babaroga, Bluper, Bubimir, comi_pfc, DonRumataEstorski, dragoljub11987, drimer, FOX, JimmyNapoli, kalens021, karevski, Koridor, ljiljak, Marko Marković, mercedesamg, Milometer, Nemanja.M, nemkea71, oldtimer, operniki, pedja.st, S-lash, SlaKoj, solic, sovanova95, stegonosa, Stija zmija, Toper, Vlada1389, Vlada78, voja64, zbazin, zdrebac, 1107