Usporen racunar....

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 20 Avg 2012 20:07

All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\"AppInit_DLLs"|"" /E : value set successfully!
========== FILES ==========
C:\WINDOWS\System32\drivers\str.sys moved successfully.
File move failed. C:\WINDOWS\System32\protector.dll scheduled to be moved on reboot.
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:OhfiwxeDqadb.dll deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Just me
->Temp folder emptied: 19462956 bytes
->Temporary Internet Files folder emptied: 858315 bytes
->FireFox cache emptied: 109901859 bytes
->Flash cache emptied: 5732 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: PC_
->Temp folder emptied: 1243822379 bytes
->Temporary Internet Files folder emptied: 9117176 bytes
->Java cache emptied: 2094600553 bytes
->FireFox cache emptied: 122247095 bytes
->Google Chrome cache emptied: 15434180 bytes
->Opera cache emptied: 7277974 bytes
->Flash cache emptied: 4840 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2402044 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1102649778 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 101459258 bytes

Total Files Cleaned = 4,606.00 mb


OTL by OldTimer - Version 3.2.58.0 log created on 08212012_052656

Files\Folders moved on Reboot...
File move failed. C:\WINDOWS\System32\protector.dll scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2012/05/27 16:29:38 | 000,790,520 | ---- | M] () C:\WINDOWS\System32\protector.dll : Unable to obtain MD5

Registry entries deleted on Reboot...

Dopuna: 20 Avg 2012 20:17

# AdwCleaner v1.801 - Logfile created 08/21/2012 at 05:51:38
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : PC_ - PC_
# Boot Mode : Normal
# Running from : D:\My Documents\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : bProtector
Found : IBUpdaterService

***** [Files / Folders] *****

Folder Found : C:\Documents and Settings\PC_\Local Settings\Application Data\Babylon
Folder Found : C:\Documents and Settings\PC_\Local Settings\Application Data\Ilivid Player
Folder Found : C:\Documents and Settings\PC_\Application Data\Babylon
Folder Found : C:\Documents and Settings\PC_\Application Data\Bandoo
Folder Found : C:\Documents and Settings\PC_\Application Data\eType
Folder Found : C:\Documents and Settings\PC_\Application Data\searchquband
Folder Found : C:\Documents and Settings\PC_\Application Data\Searchqutoolbar
Folder Found : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\Searchqutoolbar
Folder Found : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Folder Found : C:\Documents and Settings\Just me\Application Data\Mozilla\Firefox\Profiles\kbrihnln.default\Searchqutoolbar
Folder Found : C:\Documents and Settings\Just me\Application Data\Mozilla\Firefox\Profiles\kbrihnln.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Folder Found : C:\Documents and Settings\All Users\Application Data\Babylon
Folder Found : C:\Documents and Settings\All Users\Application Data\bProtector
Folder Found : C:\Documents and Settings\All Users\Application Data\IBUpdaterService
Folder Found : C:\Program Files\Ilivid
Folder Found : C:\Program Files\Windows iLivid Toolbar
File Found : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\searchplugins\SearchResults.xml
File Found : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Found : C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml
File Found : C:\user.js

***** [Registry] *****

Key Found : HKCU\Software\bProtector
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\DataMngr_Toolbar
Key Found : HKCU\Software\ilivid
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Babylon
Key Found : HKLM\SOFTWARE\bandoo
Key Found : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Found : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Found : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Found : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Found : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Found : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Found : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Found : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Found : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Found : HKLM\SOFTWARE\DataMngr
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Key Found : HKLM\SOFTWARE\SearchquMediabarTb
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Found : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Found : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.5730.13

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c000000000000005070b67187
[HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] = hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c000000000000005070b67187

-\\ Mozilla Firefox v14.0.1 (en-US)

Profile name : default
File : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\prefs.js

Found : user_pref("browser.babylon.hponnewtab", "search.babylon.com");
Found : user_pref("browser.search.defaultenginename", "search the web (babylon)");
Found : user_pref("browser.search.order.1", "search the web (babylon)");
Found : user_pref("browser.search.selectedengine", "search the web (babylon)");
Found : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?af=111294&babsrc=hp_ss&mntrid=2c3d[...]
Found : user_pref("extensions.babylontoolbar_i.aflt", "babsst");
Found : user_pref("extensions.babylontoolbar_i.babext", "");
Found : user_pref("extensions.babylontoolbar_i.babtrack", "affid=111294");
Found : user_pref("extensions.babylontoolbar_i.hardid", "2c3d286c000000000000005070b67187");
Found : user_pref("extensions.babylontoolbar_i.id", "2c3d286c000000000000005070b67187");
Found : user_pref("extensions.babylontoolbar_i.instlday", "15487");
Found : user_pref("extensions.babylontoolbar_i.instlref", "sst");
Found : user_pref("extensions.babylontoolbar_i.prdct", "babylontoolbar");
Found : user_pref("extensions.babylontoolbar_i.prtnrid", "babylon");
Found : user_pref("extensions.babylontoolbar_i.smplgrp", "none");
Found : user_pref("extensions.babylontoolbar_i.srcext", "ss");
Found : user_pref("extensions.babylontoolbar_i.tlbrid", "base");
Found : user_pref("extensions.babylontoolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.babylontoolbar_i.vrsnts", "1.5.3.1716:31:06");
Found : user_pref("extensions.babylontoolbar_i.vrsni", "1.5.3.17");
Found : user_pref("extensions.babylontoolbar_i.aflt", "babsst");
Found : user_pref("extensions.babylontoolbar_i.babext", "");
Found : user_pref("extensions.babylontoolbar_i.babtrack", "affid=111294");
Found : user_pref("extensions.babylontoolbar_i.hardid", "2c3d286c000000000000005070b67187");
Found : user_pref("extensions.babylontoolbar_i.id", "2c3d286c000000000000005070b67187");
Found : user_pref("extensions.babylontoolbar_i.instlday", "15487");
Found : user_pref("extensions.babylontoolbar_i.instlref", "sst");
Found : user_pref("extensions.babylontoolbar_i.newtab", true);
Found : user_pref("extensions.babylontoolbar_i.newtaburl", "hxxp://search.babylon.com/?af=111294&babsrc=nt_s[...]
Found : user_pref("extensions.babylontoolbar_i.prdct", "babylontoolbar");
Found : user_pref("extensions.babylontoolbar_i.prtnrid", "babylon");
Found : user_pref("extensions.babylontoolbar_i.smplgrp", "none");
Found : user_pref("extensions.babylontoolbar_i.srcext", "ss");
Found : user_pref("extensions.babylontoolbar_i.tlbrid", "base");
Found : user_pref("extensions.babylontoolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.babylontoolbar_i.vrsni", "1.5.3.17");
Found : user_pref("extensions.babylontoolbar_i.vrsnts", "1.5.3.1716:31:06");
Found : user_pref("keyword.url", "hxxp://search.babylon.com/?affid=110819&babsrc=kw_ss&mntrid=2c3d286c000000[...]

Profile name : default
File : C:\Documents and Settings\Just me\Application Data\Mozilla\Firefox\Profiles\kbrihnln.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v21.0.1180.79

File : C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

Found : "homepage" : "hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c0000000000000[...]
Found : "keyword" : "babylon.com",
Found : "name" : "Search the web (Babylon)",
Found : "search_url" : "hxxp://search.babylon.com/?q={searchTerms}&AF=111294&babsrc=SP_ss&mntrId=2c3[...]
Found : "hxxp://lp.imesh.com/",
Found : "hxxp://www.imesh.com/",
Found : "hxxp://isearch.babylon.com/",
Found : "hxxp://lp.imesh.com/",
Found : "hxxp://lp.imesh.com/",
Found : "hxxp://search.babylon.com/",
Found : "hxxp://isearch.babylon.com/",
Found : "hxxp://ak.toolbar.mywebsearch.com/",
Found : "description" : "The fastest way to search the web.",
Found : "default_icon" : "browser_icon_babylon48.png",
Found : "default_title" : "Babylon Toolbar"
Found : "description" : "Babylon ToolBar",
Found : "128" : "babylon48.png",
Found : "48" : "babylon48.png"
Found : "name" : "Babylon Toolbar",
Found : "path" : "BabylonChromeToolBar.dll",
Found : "update_url" : "hxxp://img.babylon.com/ext/chrome/update/update1.xml",
Found : "homepage" : "hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c00000000000000507[...]

-\\ Opera v11.61.1250.0

File : C:\Documents and Settings\PC_\Application Data\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [13270 octets] - [21/08/2012 05:51:38]

########## EOF - C:\AdwCleaner[R1].txt - [13399 octets] ##########

Upload-ovao sam OTL file

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Korak 1

Ponovo pokreni program OTL dvoklikom na ikonu.

U bijeli okvir prozora gdje piše Custom Scans/Fixes iskopirati sljedeći tekst:

:files
C:\WINDOWS\System32\protector.dll



Klikni taster Run Fix;

Izvještaj koji dobiješ iskopiraj ovde u poruci.



Korak 2

Opet zapakuj folder C:\_OTL i pošalji ga preko sljedećeg linka:
http://www.mycity.rs/ambulanta-upload.php



Korak 3

Ponovo pokreni AdwCleaner.
Klikni na dugme Delete i pričekaj da program završi.
Program će zatvoriti sve aktivne programe i izbaciti prozor sa tim upozorenjem. Klikni na Ok kao potvrdu.
Na sledeća dva prozora koja se otvore (Informations i Restart required ) klikni Ok.
Računar će se restartovati.
Otvoriće se Notepad sa izvještajem.
Kopiraj sadržaj tog izvještaja u temu.

Napomena: Izvještaj ce takođe biti sačuvan na C:\AdwCleaner[S1].txt





Ima li ikakvih poboljšanja?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Napisano: 20 Avg 2012 21:48

========== FILES ==========
File move failed. C:\WINDOWS\System32\protector.dll scheduled to be moved on reboot.

OTL by OldTimer - Version 3.2.58.0 log created on 08212012_072324

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\System32\protector.dll not found!

PendingFileRenameOperations files...
File C:\WINDOWS\System32\protector.dll not found!

Registry entries deleted on Reboot...

Dopuna: 20 Avg 2012 21:59

# AdwCleaner v1.801 - Logfile created 08/21/2012 at 07:34:13
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : PC_ - PC_
# Boot Mode : Normal
# Running from : D:\My Documents\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : bProtector
Stopped & Deleted : IBUpdaterService

***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\PC_\Local Settings\Application Data\Babylon
Folder Deleted : C:\Documents and Settings\PC_\Local Settings\Application Data\Ilivid Player
Folder Deleted : C:\Documents and Settings\PC_\Application Data\Babylon
Folder Deleted : C:\Documents and Settings\PC_\Application Data\Bandoo
Folder Deleted : C:\Documents and Settings\PC_\Application Data\eType
Folder Deleted : C:\Documents and Settings\PC_\Application Data\searchquband
Folder Deleted : C:\Documents and Settings\PC_\Application Data\Searchqutoolbar
Folder Deleted : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\Searchqutoolbar
Folder Deleted : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Folder Deleted : C:\Documents and Settings\Just me\Application Data\Mozilla\Firefox\Profiles\kbrihnln.default\Searchqutoolbar
Folder Deleted : C:\Documents and Settings\Just me\Application Data\Mozilla\Firefox\Profiles\kbrihnln.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Folder Deleted : C:\Documents and Settings\All Users\Application Data\Babylon
Deleted on reboot : C:\Documents and Settings\All Users\Application Data\bProtector
Folder Deleted : C:\Documents and Settings\All Users\Application Data\IBUpdaterService
Folder Deleted : C:\Program Files\Ilivid
Deleted on reboot : C:\Program Files\Windows iLivid Toolbar
File Deleted : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\searchplugins\SearchResults.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml
File Deleted : C:\WINDOWS\Tasks\bProtector.job
File Deleted : C:\user.js

***** [Registry] *****

Key Deleted : HKCU\Software\bProtector
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\bandoo
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr
Key Deleted : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\DataMngr
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu 406 MediaBar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Key Deleted : HKLM\SOFTWARE\SearchquMediabarTb
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}
Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]

***** [Internet Browsers] *****

-\\ Internet Explorer v7.0.5730.13

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=2c3d286c000000000000005070b67187 --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] = hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c000000000000005070b67187 --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (en-US)

Profile name : default
File : C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\prefs.js

C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\user.js ... Deleted !

Deleted : user_pref("browser.babylon.hponnewtab", "search.babylon.com");
Deleted : user_pref("browser.search.defaultenginename", "search the web (babylon)");
Deleted : user_pref("browser.search.order.1", "search the web (babylon)");
Deleted : user_pref("browser.search.selectedengine", "search the web (babylon)");
Deleted : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?af=111294&babsrc=hp_ss&mntrid=2c3d[...]
Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");
Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111294");
Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "2c3d286c000000000000005070b67187");
Deleted : user_pref("extensions.BabylonToolbar_i.id", "2c3d286c000000000000005070b67187");
Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15487");
Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1716:31:06");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Deleted : user_pref("extensions.babylontoolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.babylontoolbar_i.babext", "");
Deleted : user_pref("extensions.babylontoolbar_i.babtrack", "affid=111294");
Deleted : user_pref("extensions.babylontoolbar_i.hardid", "2c3d286c000000000000005070b67187");
Deleted : user_pref("extensions.babylontoolbar_i.id", "2c3d286c000000000000005070b67187");
Deleted : user_pref("extensions.babylontoolbar_i.instlday", "15487");
Deleted : user_pref("extensions.babylontoolbar_i.instlref", "sst");
Deleted : user_pref("extensions.babylontoolbar_i.newtab", true);
Deleted : user_pref("extensions.babylontoolbar_i.newtaburl", "hxxp://search.babylon.com/?af=111294&babsrc=nt_s[...]
Deleted : user_pref("extensions.babylontoolbar_i.prdct", "babylontoolbar");
Deleted : user_pref("extensions.babylontoolbar_i.prtnrid", "babylon");
Deleted : user_pref("extensions.babylontoolbar_i.smplgrp", "none");
Deleted : user_pref("extensions.babylontoolbar_i.srcext", "ss");
Deleted : user_pref("extensions.babylontoolbar_i.tlbrid", "base");
Deleted : user_pref("extensions.babylontoolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.babylontoolbar_i.vrsni", "1.5.3.17");
Deleted : user_pref("extensions.babylontoolbar_i.vrsnts", "1.5.3.1716:31:06");
Deleted : user_pref("keyword.url", "hxxp://search.babylon.com/?affid=110819&babsrc=kw_ss&mntrid=2c3d286c000000[...]

Profile name : default
File : C:\Documents and Settings\Just me\Application Data\Mozilla\Firefox\Profiles\kbrihnln.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v21.0.1180.79

File : C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

Deleted : "homepage" : "hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c0000000000000[...]
Deleted : "keyword" : "babylon.com",
Deleted : "name" : "Search the web (Babylon)",
Deleted : "search_url" : "hxxp://search.babylon.com/?q={searchTerms}&AF=111294&babsrc=SP_ss&mntrId=2c3[...]
Deleted : "hxxp://lp.imesh.com/",
Deleted : "hxxp://www.imesh.com/",
Deleted : "hxxp://isearch.babylon.com/",
Deleted : "hxxp://lp.imesh.com/",
Deleted : "hxxp://lp.imesh.com/",
Deleted : "hxxp://search.babylon.com/",
Deleted : "hxxp://isearch.babylon.com/",
Deleted : "hxxp://ak.toolbar.mywebsearch.com/",
Deleted : "description" : "The fastest way to search the web.",
Deleted : "default_icon" : "browser_icon_babylon48.png",
Deleted : "default_title" : "Babylon Toolbar"
Deleted : "description" : "Babylon ToolBar",
Deleted : "128" : "babylon48.png",
Deleted : "48" : "babylon48.png"
Deleted : "name" : "Babylon Toolbar",
Deleted : "path" : "BabylonChromeToolBar.dll",
Deleted : "update_url" : "hxxp://img.babylon.com/ext/chrome/update/update1.xml",
Deleted : "homepage" : "hxxp://search.babylon.com/?AF=111294&babsrc=HP_ss&mntrId=2c3d286c00000000000000507[...]

-\\ Opera v11.61.1250.0

File : C:\Documents and Settings\PC_\Application Data\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [13401 octets] - [21/08/2012 05:51:38]
AdwCleaner[S1].txt - [13896 octets] - [21/08/2012 07:34:13]

########## EOF - C:\AdwCleaner[S1].txt - [14025 octets] ##########

Dopuna: 20 Avg 2012 22:00

Poslao sam OTL file...opet mi pravi problem sa podizanjem sistema koje traje puno duze nego obicno......

Dopuna: 20 Avg 2012 22:04

Primjetno je poboljsane u brzini pretrage, skype dosta brzi......Hvala puno na strpljenju...)

Dopuna: 20 Avg 2012 22:07

Da li Combofix zahtijeva posebno brisanje..??

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

CF s obzirom da se nije uspio pokrenuti neće biti potrebno posebno brisati. No, moramo jednu stvar obaviti.


Korak 1

Koristiš zastarjelu, a vjerovatno i piratsku verziju ESET NOD32 AV programa te je stoga potrebno da istu deinstaliraš. Ukoliko imaš legalnu licencu, sačuvaj username i password na parče papira.

Idi u Control Panel -> Programs and Features nađi ESET NOD32 Antivirus i deinstaliraj ga.

Nakon toga isprati ovo uputstvo za uklanjanje njegovih ostataka:

http://kb.eset.com/esetkb/index?page=content&id=SOLN2289#Win_7

Ukoliko imaš legalnu licencu za ESET NOD32, preuzmi i instaliraj najnoviju verziju istog:

ESET NOD32 5

Ukoliko nemaš novaca ili ne želiš da ga izdvojiš za neki komercijalni AV program, na raspolaganju ti se nalaze kvalitetni besplatni AV programi poput Avast Free, AVG Free, Avira Free, Microsoft Security Essentials, Panda Cloud AV, itd.
Nemoj koristiti piratske verzije AV programa!!!




Korak 2

Kada budeš imao ažuriran i legalan AV na sistemu, postavi mi svjež OTL izvještaj.
Uputstvo imaš ovdje:
http://www.mycity.rs/Ambulanta/Usporen-racunar-11.html#1389526

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

OTL logfile created on: 8/21/2012 10:49:17 AM - Run 2
OTL by OldTimer - Version 3.2.58.0 Folder = C:\Documents and Settings\PC_\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.48 Mb Total Physical Memory | 441.82 Mb Available Physical Memory | 43.17% Memory free
2.40 Gb Paging File | 1.94 Gb Available in Paging File | 80.70% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19.54 Gb Total Space | 8.39 Gb Free Space | 42.93% Space Free | Partition Type: NTFS
Drive D: | 56.79 Gb Total Space | 23.40 Gb Free Space | 41.21% Space Free | Partition Type: NTFS

Computer Name: PC_ | User Name: PC_ | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/08/19 13:41:24 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/08/19 06:30:14 | 000,598,016 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC_\Desktop\OTL.exe
PRC - [2012/07/22 17:17:31 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012/07/05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/07/03 18:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/07/03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/02/25 12:22:50 | 000,172,664 | ---- | M] (http://www.express-files.com/) -- C:\Program Files\ExpressFiles\EFupdater.exe
PRC - [2012/02/25 12:22:48 | 000,443,000 | ---- | M] (http://www.express-files.com/) -- C:\Program Files\ExpressFiles\ExpressFiles.exe
PRC - [2008/07/03 14:38:24 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 15:00:00 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\sndvol32.exe
PRC - [2008/04/14 06:42:36 | 000,073,796 | ---- | M] (Smart Link) -- C:\WINDOWS\system32\slserv.exe


========== Modules (No Company Name) ==========

MOD - [2012/08/20 21:05:03 | 001,802,240 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12082001\algo.dll
MOD - [2012/08/17 23:32:41 | 009,465,032 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll
MOD - [2012/07/22 17:17:29 | 002,003,424 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2012/07/03 09:22:15 | 001,780,224 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12070300\algo.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012/08/19 13:41:24 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012/08/17 23:32:41 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/22 17:17:30 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/07/13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/07/05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/07/03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2008/04/14 06:42:36 | 000,073,796 | ---- | M] (Smart Link) [Auto | Running] -- C:\WINDOWS\System32\slserv.exe -- (SLService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\wudfrd.sys -- (WudfRd)
DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\system32\WudfPf.sys -- (WudfPf)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/07/03 18:21:54 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/07/03 18:21:53 | 000,721,000 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/07/03 18:21:53 | 000,353,688 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/07/03 18:21:53 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/07/03 18:21:53 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012/07/03 18:21:53 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/07/03 18:21:52 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009/12/30 11:20:56 | 000,027,064 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\revoflt.sys -- (Revoflt)
DRV - [2009/09/30 06:18:22 | 003,565,056 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/10/07 21:31:38 | 000,061,424 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD8\000.fcl -- ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054})
DRV - [2008/07/28 13:35:42 | 000,225,856 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2008/04/14 15:00:00 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/14 15:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2008/04/14 15:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2008/04/14 01:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/04/14 00:53:48 | 000,095,424 | ---- | M] (Smart Link) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)
DRV - [2008/04/14 00:53:48 | 000,013,240 | ---- | M] (Smart Link) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)
DRV - [2008/04/14 00:53:46 | 000,404,990 | ---- | M] (Smart Link) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slntamr.sys -- (Slntamr)
DRV - [2008/04/14 00:53:44 | 000,013,776 | ---- | M] (Smart Link) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\RecAgent.sys -- (RecAgent)
DRV - [2008/04/14 00:53:42 | 000,180,360 | ---- | M] (Smart Link) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)
DRV - [2008/04/14 00:53:42 | 000,126,686 | ---- | M] (Smart Link) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2008/04/14 00:53:40 | 001,309,184 | ---- | M] (Smart Link) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)
DRV - [2007/09/20 04:54:42 | 000,207,488 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vinyl97.sys -- (VIAudio)
DRV - [2006/02/26 17:22:48 | 000,010,240 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvmpu401.sys -- (nvmpu401)
DRV - [2003/07/02 04:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2003/04/09 12:17:14 | 000,227,200 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\cccp106.sys -- (CCCP106)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = google.com
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {cafeefac-0016-0000-0026-abcdeffedcba}:6.0.26
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {82af8dca-6de9-405d-bd5e-43525bdad38a}:5.6.0.8442
FF - prefs.js..extensions.enabledItems: {1fd91a9c-410c-4090-bbcc-55d3450ef433}:1.0
FF - prefs.js..extensions.enabledItems: ffox@bandoo.com:5.1
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\npctrl.1.0.30716.0.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\PC_\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/08/21 10:09:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/07/22 17:17:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/07/14 17:58:42 | 000,000,000 | ---D | M]

[2011/09/19 15:10:00 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\PC_\Application Data\Mozilla\Extensions
[2012/08/21 07:34:33 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\PC_\Application Data\Mozilla\Firefox\Profiles\o6tfxiqg.default\extensions
[2012/08/21 07:40:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/08/15 20:22:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/07/22 17:17:31 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/09/29 02:26:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2005/01/05 21:17:52 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: (Enabled)
CHR - default_search_provider: search_url =
CHR - default_search_provider: suggest_url =
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.79\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.79\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.79\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Bandoo (Enabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dloejdefkancmfajekobpfoacecnhpgp\1.0.0.0_0\ChromePlugin.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\npctrl.1.0.30716.0.dll
CHR - Extension: YouTube = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Facebook Abstract Pink = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lgmgjegiphfomcgpknkicbkobpeadodf\1.0_0\
CHR - Extension: Gmail = C:\Documents and Settings\PC_\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2008/04/14 15:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ExpressFiles] C:\Program Files\ExpressFiles\ExpressFiles.exe (http://www.express-files.com/)
O4 - HKCU..\Run: [Facebook Update] C:\Documents and Settings\PC_\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FF7E1CD3-DB0D-401A-9DFE-F9842F56D030}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 () - profile.ak.fbcdn.net/hprofile-ak-snc4/50413_375325957111_2579458_n.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/03/05 11:29:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/08/21 10:12:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/08/21 10:12:37 | 000,353,688 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/08/21 10:12:37 | 000,021,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/08/21 10:12:32 | 000,035,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/08/21 10:12:31 | 000,054,232 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/08/21 10:12:28 | 000,721,000 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/08/21 10:12:26 | 000,097,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/08/21 10:12:26 | 000,089,624 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/08/21 10:12:25 | 000,025,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/08/21 10:08:17 | 000,041,224 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/08/21 10:08:09 | 000,227,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/08/21 10:05:29 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/08/21 10:05:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/08/21 10:00:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Opera
[2012/08/21 10:00:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Opera
[2012/08/21 09:14:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2012/08/21 09:04:24 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012/08/21 08:46:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2012/08/21 08:46:09 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2012/08/21 08:46:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2012/08/21 08:18:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Desktop\MyCity_files
[2012/08/21 05:26:56 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/08/19 13:42:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012/08/19 13:41:54 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012/08/19 13:41:54 | 000,143,872 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2012/08/19 13:41:42 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012/08/19 13:41:42 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012/08/19 13:41:42 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/08/19 09:31:17 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/08/19 08:20:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012/08/19 08:20:36 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012/08/19 06:29:52 | 000,598,016 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\PC_\Desktop\OTL.exe
[2012/08/19 02:26:04 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2012/08/19 02:26:03 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2012/08/19 02:26:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Favorites
[2012/08/18 00:20:17 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012/08/17 22:30:05 | 000,000,000 | R--D | C] -- C:\Documents and Settings\PC_\Start Menu\Programs\Administrative Tools
[2012/08/16 22:54:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Local Settings\Application Data\Sun
[2012/08/15 23:32:31 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/08/15 23:32:31 | 000,070,344 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/08/15 20:19:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012/08/15 20:19:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Skype
[2012/08/15 20:19:35 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012/08/15 20:06:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Local Settings\Application Data\VS Revo Group
[2012/08/15 20:06:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Revo Uninstaller Pro
[2012/08/15 20:06:07 | 000,027,064 | ---- | C] (VS Revo Group) -- C:\WINDOWS\System32\drivers\revoflt.sys
[2012/08/15 20:06:00 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/08/15 19:04:02 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\PC_\Recent
[2012/08/11 23:21:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Desktop\New Folder (3)
[2012/08/11 23:21:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Desktop\New Folder (2)
[2012/08/05 17:52:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Desktop\New Folder
[2012/08/05 03:33:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\PC_\Desktop\Pzzp
[2011/03/05 11:44:41 | 000,149,504 | ---- | C] (Comodo Inc.) -- C:\Documents and Settings\PC_\MonitorCtl.dll

========== Files - Modified Within 30 Days ==========

[2012/08/21 11:04:30 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/21 10:52:09 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-813497703-1606980848-1003UA.job
[2012/08/21 10:31:28 | 000,000,602 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012/08/21 10:12:38 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/08/21 10:12:28 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/08/21 10:12:28 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/08/21 09:57:39 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\Express Files Updater.job
[2012/08/21 09:57:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/08/21 09:38:04 | 000,000,990 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1078081533-813497703-1606980848-1003UA.job
[2012/08/21 09:06:46 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2012/08/21 08:46:40 | 000,000,951 | ---- | M] () -- C:\Documents and Settings\PC_\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/08/21 08:46:40 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\PC_\Desktop\Spybot - Search & Destroy.lnk
[2012/08/21 08:19:00 | 000,104,193 | ---- | M] () -- C:\Documents and Settings\PC_\Desktop\MyCity.htm
[2012/08/21 07:43:51 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\PC_\Desktop\Microsoft Office Word 2007.lnk
[2012/08/21 07:31:40 | 000,474,416 | ---- | M] () -- C:\_OTL.rar
[2012/08/21 05:38:18 | 000,395,200 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/08/21 05:38:18 | 000,059,440 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/08/21 05:31:40 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/08/19 13:41:25 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/08/19 13:41:23 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012/08/19 13:41:23 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll
[2012/08/19 13:41:23 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe
[2012/08/19 13:41:23 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe
[2012/08/19 13:41:23 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe
[2012/08/19 13:41:23 | 000,143,872 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl
[2012/08/19 12:38:15 | 000,000,968 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1078081533-813497703-1606980848-1003Core.job
[2012/08/19 06:45:31 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012/08/19 06:30:14 | 000,598,016 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\PC_\Desktop\OTL.exe
[2012/08/17 23:32:41 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/08/17 23:32:41 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/08/16 16:51:58 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1078081533-813497703-1606980848-1003Core.job
[2012/08/15 22:11:14 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\PC_\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/15 21:24:38 | 000,002,268 | ---- | M] () -- C:\Documents and Settings\PC_\Desktop\Google Chrome.lnk
[2012/08/15 20:06:08 | 000,000,925 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/08/05 19:20:32 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2012/07/23 17:19:41 | 000,139,758 | ---- | M] () -- C:\Documents and Settings\PC_\Desktop\pizap.com13430566668591.jpg
[2012/07/23 16:31:42 | 005,367,391 | ---- | M] () -- C:\Documents and Settings\PC_\Desktop\DSC00605.JPG

========== Files Created - No Company Name ==========

[2012/08/21 10:12:38 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/08/21 10:12:28 | 000,000,310 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/08/21 09:05:18 | 000,000,602 | RHS- | C] () -- C:\Documents and Settings\All Users\ntuser.pol
[2012/08/21 08:46:40 | 000,000,951 | ---- | C] () -- C:\Documents and Settings\PC_\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012/08/21 08:46:40 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\PC_\Desktop\Spybot - Search & Destroy.lnk
[2012/08/21 08:18:57 | 000,104,193 | ---- | C] () -- C:\Documents and Settings\PC_\Desktop\MyCity.htm
[2012/08/21 05:40:48 | 000,474,416 | ---- | C] () -- C:\_OTL.rar
[2012/08/15 23:32:47 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/15 20:19:37 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012/08/15 20:06:08 | 000,000,925 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Revo Uninstaller Pro.lnk
[2012/08/05 06:15:47 | 000,029,608 | ---- | C] () -- C:\Documents and Settings\PC_\Desktop\303674_260977060600139_100000635404253_849240_2123799124_n.jpg
[2012/08/05 06:14:48 | 005,367,391 | ---- | C] () -- C:\Documents and Settings\PC_\Desktop\DSC00605.JPG
[2012/07/23 17:19:39 | 000,139,758 | ---- | C] () -- C:\Documents and Settings\PC_\Desktop\pizap.com13430566668591.jpg
[2011/04/08 14:14:18 | 000,022,528 | ---- | C] () -- C:\Documents and Settings\PC_\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/03 18:30:18 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011/03/21 00:06:30 | 000,000,657 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2011/03/21 00:06:23 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2011/03/21 00:06:14 | 000,000,021 | ---- | C] () -- C:\WINDOWS\VI_setup.ini
[2011/03/21 00:04:43 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini
[2011/03/21 00:03:15 | 000,227,200 | ---- | C] () -- C:\WINDOWS\System32\drivers\cccp106.sys
[2011/03/21 00:03:14 | 000,127,038 | ---- | C] () -- C:\WINDOWS\Clement.exe
[2011/03/21 00:03:14 | 000,036,864 | ---- | C] () -- C:\WINDOWS\JPGL.DLL
[2011/03/21 00:03:14 | 000,032,768 | ---- | C] () -- C:\WINDOWS\DIV_IYUV.DLL
[2011/03/21 00:03:13 | 002,093,106 | ---- | C] () -- C:\WINDOWS\select.exe
[2011/03/21 00:03:13 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\vcccp106.dll
[2011/03/21 00:03:12 | 000,192,512 | ---- | C] () -- C:\WINDOWS\select2.exe
[2011/03/21 00:03:12 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\dcccp106.dll
[2011/03/21 00:03:12 | 000,036,864 | ---- | C] () -- C:\WINDOWS\CleanDev.exe
[2011/03/21 00:03:12 | 000,015,542 | ---- | C] () -- C:\WINDOWS\cccp106.ini
[2011/03/21 00:03:12 | 000,000,321 | ---- | C] () -- C:\WINDOWS\DC2110a.ini
[2011/03/05 12:58:46 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/03/05 12:19:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011/03/05 12:16:46 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2011/03/05 12:00:20 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/05 11:56:35 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/03/05 11:56:30 | 001,559,040 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011/03/05 11:56:30 | 000,282,624 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2011/03/05 11:56:29 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2011/03/05 11:56:28 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011/03/05 11:45:07 | 000,020,449 | R--- | C] () -- C:\WINDOWS\System32\ADeck.ini
[2011/03/05 11:45:07 | 000,003,912 | R--- | C] () -- C:\WINDOWS\System32\String.ini
[2011/03/05 11:45:07 | 000,003,911 | R--- | C] () -- C:\WINDOWS\System32\String1.ini
[2011/03/05 11:45:07 | 000,000,399 | R--- | C] () -- C:\WINDOWS\System32\vpatch.ini
[2011/03/05 11:45:07 | 000,000,356 | R--- | C] () -- C:\WINDOWS\System32\OemBmpCp.ini
[2011/03/05 11:44:41 | 000,003,384 | ---- | C] () -- C:\Documents and Settings\PC_\Script.ini
[2011/03/05 11:30:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/03/05 11:24:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/03/05 06:37:22 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

========== Custom Scans ==========

========== Drive Information ==========

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed\thard disk media
Interface type: IDE
Media Type: Fixed\thard disk media
Model: Maxtor 6Y080L0
Partitions: 2
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 20.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Extended w/Extended Int 13
Bootable: False
BootPartition: False
PrimaryPartition: False
Size: 57.00GB
Starting Offset: 20982689280
Hidden sectors: 0


< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008/07/03 14:38:24 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=2BB75B7F548D82A099125D0C5971DE7D -- C:\WINDOWS\explorer.exe

< MD5 for: SERVICES >
[2008/04/14 15:00:00 | 000,007,116 | ---- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A -- C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES.EXE >
[2008/04/14 15:00:00 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\system32\services.exe

< MD5 for: SERVICES.LNK >
[2011/03/05 11:29:27 | 000,001,602 | ---- | M] () MD5=02144CF36FE29088B9DEFE4189347B46 -- C:\found.000\dir0000.chk\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MSC >
[2008/04/14 15:00:00 | 000,033,464 | ---- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 -- C:\WINDOWS\system32\services.msc

< MD5 for: SERVICES.SBS >
[2011/03/01 09:58:46 | 000,034,818 | ---- | M] () MD5=62AFD4B2025CE6D4706B36F4C4808F9B -- C:\Program Files\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: SVCHOST.EXE >
[2008/04/14 15:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/24 16:33:54 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=D1BAC55BC35A0CA735AEA19F609F2B22 -- C:\WINDOWS\system32\winlogon.exe

========== Files - Unicode (All) ==========
[2012/08/21 07:36:22 | 000,000,000 | ---D | M](C:\WINDOWS\System32\????????????????????????????????????????icat7779777777797777777777777777777777) -- C:\WINDOWS\System32\靳Ѱ鞪Ѱ韡Ѱ領Ѱ顏Ѱ领Ѱ颽Ѱ骰Ѱ髧Ѱ鲟Ѱ鳖Ѱ鴍ѰꅝѰꂸѰꂁѰꁊѰꀓѰ龥Ѱ齮Ѱ鼷Ѱicat7779777777797777777777777777777777
[2012/08/21 07:36:22 | 000,000,000 | ---D | C](C:\WINDOWS\System32\????????????????????????????????????????icat7779777777797777777777777777777777) -- C:\WINDOWS\System32\靳Ѱ鞪Ѱ韡Ѱ領Ѱ顏Ѱ领Ѱ颽Ѱ骰Ѱ髧Ѱ鲟Ѱ鳖Ѱ鴍ѰꅝѰꂸѰꂁѰꁊѰꀓѰ龥Ѱ齮Ѱ鼷Ѱicat7779777777797777777777777777777777

< End of report >

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Sada si čist.



Ponovo pokreni AdwCleaner
Klikni na dugme Uninstall i pričekaj da se postupak deinstalacije završi.






Ponovo pokreni OTL i klikni na dugme CleanUp.





Posjeti temu Testirajte da li vam je pretraživač ranjiv, pročitaj i isprati link koji stoji u njoj.





Preporučujem da za zaštitu USB memorijskih uređaja koristiš MCShield.
Nema nikakve veze sa antivirus-om tj. neće ometati njegov rad, a pokazao se kao jedan od najboljih vida zaštite od malware-a koji se prenosi putem USB mem. uređaja.


Home Page MCShield-a: http://amf.mycity.rs/mcshield/

Više o MCShield-u možeš saznati u ovoj temi: http://www.mycity.rs/MyCity-Laboratorija/MCShield-v2.html

Facebook stranica MCShield-a: http://www.facebook.com/MCShield





Ukoliko i dalje imaš problema sa sporim podizanjem ssitema, otvori temu u Windows forumu i tamo iznesi svoj problem.
http://www.mycity.rs/Windows/


Pozdrav.

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Ok....hvala...pozdrav