MyCity » Ambulanta -> Arhiva Ambulante » system guard 2009

system guard 2009

Napisano na dan: 15.2.2009
1

system guard 2009
Sledeća strana Pagination

Idi na vrh

Poslao: 15 Feb 2009 17:52
Idi na vrh
offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

Moj drug trenutno nema net pa me je zamolio da postavim log umesto njega


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:42:32 PM, on 2/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svcnost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\System Guard 2009\systemguard.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\winscenter.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.rs/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: DeviceVM Url Search Hook - {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {3cd53324-393a-46c3-bc63-bfa26937d35a} - C:\WINDOWS\system32\fefiyiri.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\uisaj387dd.dll - {D5BF4552-94F1-42BD-F434-3604812C807D} - C:\WINDOWS\system32\uisaj387dd.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [jotikemeti] Rundll32.exe "C:\WINDOWS\system32\honunuzu.dll",s
O4 - HKLM\..\Run: [systemguard] C:\Program Files\System Guard 2009\systemguard.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V.....1857523875
O20 - AppInit_DLLs: c:\windows\system32\volosejo.dll c:\windows\system32\nugebini.dll
O20 - Winlogon Notify: decfeaaebffbf - C:\WINDOWS\system32\decfeaaebffbf.dll
O21 - SSODL: ieModule - {AD2D52FA-CF82-442D-B0FE-349CED309D3D} - C:\Documents and Settings\All Users\Application Data\Microsoft\Network\DLLs\ieModule.dll
O21 - SSODL: InternetConnection - {E02A11E8-7A5F-49C0-805B-DC1811376732} - C:\Documents and Settings\All Users\Application Data\Microsoft\Network\DLLs\zksfqsgtlu.dll
O21 - SSODL: CrlfUsViow - {54520706-216E-4913-AB62-83C835BC7C5D} - fkmybckvbrp.dll (file missing)
O22 - SharedTaskScheduler: erajhsf8743kjrngjnf - {D5BF4552-94F1-42BD-F434-3604812C807D} - C:\WINDOWS\system32\uisaj387dd.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 6063 bytes

Poslao: 15 Feb 2009 18:06
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Ti ces uraditi sledece skinuces Combofix :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe


Promenices naziv combofixa u pr. CF i prebacices isti na usb i pokrenuti na njegovom kompu....

Startuj ga i ne diraj prozor programa dok skenira.
Sledi uputstva na ekranu. Kada zavrsi pojavice se log (C:\ComboFix.txt) koji ces nam ovde iskopirati.

Poslao: 15 Feb 2009 18:50
Idi na vrh
offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

ComboFix 09-02-14.01 - user 2009-02-15 18:40:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2885 [GMT 1:00]
Running from: c:\documents and settings\user\Desktop\cf.exe
AV: avast! antivirus 4.8.1296 [VPS 090127-0] *On-access scanning enabled* (Outdated)
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Outdated)
FW: ESET Personal firewall *enabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\bits.dll
c:\documents and settings\All Users\Application Data\Microsoft\ipdll.dll
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\runit
c:\program files\runit\config.txt
c:\program files\runit\runit_32.exe
c:\program files\runit\runitu_32.exe
c:\windows\reged.exe
c:\windows\spoolsystem.exe
c:\windows\sys.com
c:\windows\syscert.exe
c:\windows\sysexplorer.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\decfeaaebffbf.dll
c:\windows\system32\drivers\UACdyondlha.sys
c:\windows\system32\Dvbpws.dll
c:\windows\system32\honunuzu.dll
c:\windows\system32\lxuuwpla.ini
c:\windows\system32\mosoraza.dll
c:\windows\system32\olosupor.ini
c:\windows\system32\parodupa.dll
c:\windows\system32\pipibuju.dll
c:\windows\system32\QsuvGfii.ini
c:\windows\system32\QsuvGfii.ini2
c:\windows\system32\ssqPfdAt.dll
c:\windows\system32\svcnost.exe
c:\windows\system32\TDSSkkai.log
c:\windows\system32\TDSSmtve.dat
c:\windows\system32\UACbebiyeib.dll
c:\windows\system32\UACliqftari.log
c:\windows\system32\UACnmchxrse.log
c:\windows\system32\UACnpexnoyv.dat
c:\windows\system32\UACpfakjyxx.dll
c:\windows\system32\UACpskcpanb.dll
c:\windows\system32\UACpxtmavib.log
c:\windows\system32\UACtlrruevo.dll
c:\windows\system32\ujubipip.ini
c:\windows\system32\volosejo.dll
c:\windows\system32\winscenter.exe
c:\windows\system32\YaHOoUvw.ini
c:\windows\system32\YaHOoUvw.ini2
c:\windows\Tasks\akksmgrt.job
c:\windows\vmreg.dll

----- BITS: Possible infected sites -----

hxxp://speedytorrents.net
hxxp://77.74.48.105
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-01-15 to 2009-02-15 )))))))))))))))))))))))))))))))
.

2009-02-15 18:09 . 2009-02-15 18:09 200,208 --a------ c:\windows\system32\vumer.dll
2009-02-15 17:41 . 2009-02-15 17:41 <DIR> d-------- c:\program files\Trend Micro
2009-02-15 17:22 . 2009-02-15 17:22 <DIR> d-------- c:\program files\Spyware Doctor
2009-02-15 17:22 . 2009-02-15 17:22 <DIR> d-------- c:\documents and settings\user\Application Data\PC Tools
2009-02-15 17:22 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-15 17:22 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-15 17:22 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-15 17:22 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-15 17:16 . 2009-02-15 17:16 <DIR> d-------- c:\program files\System Guard 2009
2009-02-15 17:11 . 2009-02-15 17:23 51,355 --a------ c:\windows\system32\muzika.xm
2009-02-15 16:42 . 2009-02-15 18:03 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-15 14:01 . 2009-02-15 14:01 <DIR> d-------- c:\documents and settings\user\DoctorWeb
2009-02-15 13:04 . 2009-02-15 13:04 133,632 --a------ c:\windows\system32\fkmybckvbrp.dll
2009-02-14 19:58 . 2009-02-14 19:58 <DIR> d-------- c:\documents and settings\user\Application Data\Unity
2009-02-14 19:17 . 2009-02-14 19:17 <DIR> d-------- c:\program files\Unity
2009-02-14 12:23 . 2009-02-14 12:23 42,496 --a------ C:\ybdwodw.exe
2009-02-14 12:23 . 2009-02-15 18:43 0 --a------ c:\windows\system32\drivers\252f02f.sys
2009-02-14 12:21 . 2009-02-14 12:21 <DIR> d-------- c:\program files\Nobilis
2009-02-11 19:05 . 2009-02-11 19:15 <DIR> d-------- c:\program files\MagicISO
2009-02-10 19:49 . 2009-02-10 19:49 <DIR> d-------- c:\documents and settings\user\Application Data\OpenOffice.org
2009-02-10 19:48 . 2009-02-10 19:48 <DIR> d-------- c:\program files\OpenOffice.org 3
2009-02-10 19:48 . 2009-02-10 19:48 <DIR> d-------- c:\program files\JRE
2009-02-10 19:48 . 2009-02-10 19:48 <DIR> d-------- c:\program files\Common Files\Java
2009-02-10 14:47 . 2009-02-10 14:47 6,657,688 --a------ c:\windows\system32\xa700343.exe
2009-02-10 14:47 . 2009-02-10 14:47 6,657,688 --a------ c:\windows\system32\xa700093.exe
2009-02-09 20:27 . 2009-02-09 20:27 6,657,688 --a------ c:\windows\system32\xa46323859.exe
2009-02-09 20:27 . 2009-02-09 20:27 6,657,688 --a------ c:\windows\system32\xa46323562.exe
2009-02-09 17:38 . 2009-02-09 17:38 6,657,688 --a------ c:\windows\system32\xa36141843.exe
2009-02-09 17:38 . 2009-02-09 17:38 6,657,688 --a------ c:\windows\system32\xa36141593.exe
2009-02-09 14:50 . 2009-02-09 14:50 6,657,688 --a------ c:\windows\system32\xa26085796.exe
2009-02-09 14:50 . 2009-02-09 14:50 6,657,688 --a------ c:\windows\system32\xa26085546.exe
2009-02-09 13:31 . 2004-08-18 09:34 442,368 -ra------ c:\windows\system32\vp6vfw.dll
2009-02-08 17:39 . 2009-02-08 17:39 6,657,688 --a------ c:\windows\system32\xa11973531.exe
2009-02-08 17:39 . 2009-02-08 17:39 6,657,688 --a------ c:\windows\system32\xa11973234.exe
2009-02-07 19:37 . 2009-02-07 19:37 <DIR> d-------- c:\program files\mEliteSoftware
2009-02-07 19:36 . 2009-02-07 19:36 <DIR> d-------- c:\windows\system32\URTTEMP
2009-02-07 17:53 . 2009-02-07 17:53 6,657,688 --a------ c:\windows\system32\xa10277671.exe
2009-02-07 17:53 . 2009-02-07 17:53 6,657,688 --a------ c:\windows\system32\xa10277203.exe
2009-02-07 17:52 . 2009-02-07 17:52 6,657,688 --a------ c:\windows\system32\xa10221640.exe
2009-02-07 17:52 . 2009-02-07 17:52 6,657,688 --a------ c:\windows\system32\xa10221125.exe
2009-02-06 18:53 . 2009-02-06 18:53 <DIR> d-------- c:\documents and settings\user\Application Data\Leadertech
2009-02-05 11:03 . 2009-02-05 18:52 <DIR> d-------- c:\program files\PowerISO
2009-02-04 09:42 . 2009-02-04 09:42 279,712 --a------ c:\windows\system32\drivers\atksgt.sys
2009-02-04 09:42 . 2009-02-04 09:42 25,888 --a------ c:\windows\system32\drivers\lirsgt.sys
2009-02-03 20:44 . 2009-02-03 20:44 <DIR> d-------- c:\program files\Hewlett-Packard
2009-02-03 20:44 . 2009-02-03 20:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-02-03 20:43 . 2007-03-16 18:11 675,840 -ra------ c:\windows\system32\hpowiax3.dll
2009-02-03 20:37 . 2009-02-03 22:06 142,898 --a------ c:\windows\hpoins14.dat
2009-02-03 20:37 . 2008-04-02 09:01 2,000 --------- c:\windows\hpomdl14.dat
2009-02-01 21:23 . 2009-02-10 17:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-02-01 20:53 . 2009-02-01 20:53 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Xfire
2009-01-31 13:55 . 2009-01-31 13:55 <DIR> d-------- c:\program files\Atari
2009-01-30 23:33 . 2009-02-15 18:32 1,324 --a------ c:\windows\system32\d3d9caps.dat
2009-01-30 15:52 . 2009-02-11 07:30 <DIR> d-------- c:\documents and settings\user\Application Data\BitTorrent
2009-01-30 15:51 . 2009-02-05 18:52 <DIR> d-------- c:\program files\DNA
2009-01-30 15:51 . 2009-02-05 22:09 <DIR> d-------- c:\documents and settings\user\Application Data\DNA
2009-01-30 13:55 . 2009-01-30 13:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\Fallout3
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\program files\DAEMON Tools
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\documents and settings\user\Application Data\DAEMON Tools Pro
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\documents and settings\user\Application Data\DAEMON Tools
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-01-28 15:28 . 2009-01-31 13:54 <DIR> d-------- c:\documents and settings\user\Application Data\DAEMON Tools Lite
2009-01-27 18:24 . 2009-01-27 18:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard
2009-01-27 18:14 . 2009-01-27 18:14 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-01-26 20:13 . 2009-02-05 18:52 <DIR> d-------- c:\documents and settings\user\Application Data\Xfire
2009-01-25 18:25 . 2009-01-25 18:25 <DIR> d-------- c:\documents and settings\user\Application Data\AdobeUM
2009-01-25 18:24 . 2009-01-25 18:24 <DIR> d-------- c:\program files\Common Files\Adobe
2009-01-25 11:53 . 2009-01-25 11:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\The Learning Company
2009-01-25 11:53 . 2002-06-13 09:09 274,432 --a------ c:\windows\TLCUninstall.exe
2009-01-25 11:52 . 2009-01-25 11:52 0 --a------ c:\windows\SETUP32.INI
2009-01-24 23:21 . 2009-01-24 23:21 <DIR> d-------- c:\program files\The Learning Company
2009-01-24 22:37 . 2009-01-24 22:37 <DIR> d-------- c:\windows\system32\bits
2009-01-24 22:36 . 2009-01-24 22:38 <DIR> d-------- c:\windows\ServicePackFiles
2009-01-24 22:36 . 2008-04-14 05:42 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe
2009-01-24 22:34 . 2006-12-29 00:31 19,569 --a------ c:\windows\003450_.tmp
2009-01-24 22:21 . 2009-01-24 22:21 <DIR> d-------- C:\ASDASD
2009-01-24 19:40 . 2009-01-24 19:40 <DIR> d-------- c:\program files\Alwil Software
2009-01-24 19:29 . 2009-02-14 12:24 2,145,386,496 --a------ c:\windows\MEMORY.DMP
2009-01-24 19:14 . 2009-01-24 19:14 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-01-24 18:52 . 2008-04-14 05:39 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\WindowsShell.Manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\nwc.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 488 -rah----- c:\windows\system32\logonui.exe.manifest
2009-01-24 18:49 . 2001-08-23 11:30 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe
2009-01-24 18:48 . 2004-08-03 22:29 44,544 --a------ c:\windows\system32\tscupgrd.exe
2009-01-24 18:48 . 2004-08-03 22:29 44,544 --a--c--- c:\windows\system32\dllcache\tscupgrd.exe
2009-01-24 18:42 . 2008-04-14 05:42 28,672 --a------ c:\windows\system32\vidcap.ax
2009-01-24 07:45 . 2009-01-24 07:45 <DIR> d-------- c:\program files\Kaspersky Lab
2009-01-23 02:18 . 2009-01-23 02:18 42,320 --a------ c:\windows\system32\xfcodec.dll
2009-01-22 12:30 . 2009-01-22 12:30 <DIR> d-------- c:\program files\aquaplay
2009-01-22 12:30 . 2009-01-22 12:30 1,060,864 --a------ c:\windows\system32\mfc71.dll
2009-01-22 12:18 . 2009-02-14 12:23 2 --a------ C:\1087123376
2009-01-22 10:23 . 2009-01-22 10:23 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2009-01-21 21:55 . 2009-01-21 21:55 <DIR> d-------- c:\program files\Common Files\DirectX
2009-01-21 20:22 . 2009-02-10 20:40 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-21 20:22 . 2009-01-21 20:22 1,409 --a------ c:\windows\QTFont.for
2009-01-21 20:14 . 2009-01-21 20:14 <DIR> d-------- c:\windows\system32\drivers\umdf
2009-01-21 20:13 . 2009-01-21 20:13 <DIR> d-------- c:\windows\system32\xlive
2009-01-21 20:13 . 2009-01-22 11:17 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2009-01-21 20:13 . 2009-01-22 12:14 77,081 --a------ c:\windows\setupapi.old
2009-01-21 19:53 . 2009-01-30 13:54 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-21 19:52 . 2009-01-21 19:52 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-21 19:52 . 2006-06-29 13:07 14,048 --a------ c:\windows\system32\spmsg2.dll
2009-01-21 12:28 . 2009-01-21 12:28 <DIR> d-------- c:\program files\Testovi Srpski
2009-01-20 18:14 . 2009-01-20 18:14 <DIR> d-------- c:\documents and settings\user\Application Data\Yahoo!
2009-01-20 18:14 . 2009-01-20 18:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-20 18:14 . 2009-01-20 18:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-20 18:13 . 2009-01-20 18:14 <DIR> d-------- c:\program files\Yahoo!
2009-01-20 16:30 . 2009-02-11 19:58 <DIR> d-------- c:\program files\McDonaldsDragons
2009-01-20 11:25 . 2009-01-20 11:25 <DIR> d-------- c:\windows\Sun
2009-01-20 05:39 . 2009-01-20 05:39 23 --a------ c:\windows\BlendSettings.ini
2009-01-20 01:11 . 2009-01-20 01:11 <DIR> d-------- C:\EmergencyUtils
2009-01-20 00:51 . 2009-01-20 00:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-01-20 00:25 . 2009-01-20 00:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\TrackMania
2009-01-19 23:34 . 2009-01-19 23:34 <DIR> d-------- c:\documents and settings\user\Application Data\CyberLink
2009-01-19 09:16 . 2009-01-19 09:16 0 --a------ c:\windows\hpqEmlSz.INI
2009-01-19 09:14 . 2009-01-19 09:14 <DIR> d-------- c:\documents and settings\user\Application Data\HP
2009-01-19 03:36 . 2009-01-19 03:36 <DIR> d-------- c:\documents and settings\user\Application Data\Microsoft Games
2009-01-17 23:56 . 2009-01-17 23:56 <DIR> d--hs---- C:\$RECYCLE.BIN
2009-01-17 23:46 . 2009-01-17 23:46 <DIR> d--hs---- C:\Boot
2009-01-17 23:46 . 2006-11-02 10:53 438,840 -rahs---- C:\bootmgr
2009-01-17 23:46 . 2009-01-17 23:46 8,192 -ra-s---- C:\BOOTSECT.BAK

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-12 13:24 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-10 18:55 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-10 18:54 --------- d-----w c:\program files\MSBuild
2009-02-01 12:55 --------- d-----w c:\documents and settings\All Users\Application Data\Ulead Systems
2009-01-28 14:28 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-24 21:46 159,744 ----a-w c:\windows\system32\NEROCHECK.EXE
2009-01-24 21:44 57,344 ----a-w c:\windows\ALCMTR.EXE
2009-01-24 21:44 --------- d-----w c:\program files\Opera
2009-01-24 21:30 472,576 ----a-w C:\dxsetup.exe
2009-01-24 18:07 16,608 ----a-w c:\windows\gdrv.sys
2009-01-22 10:32 413,696 ----a-w c:\windows\system32\wrap_oal.dll
2009-01-22 10:32 110,592 ----a-w c:\windows\system32\OpenAL32.dll
2009-01-20 22:10 --------- d-----w c:\program files\Ubisoft
2009-01-20 22:10 --------- d-----w c:\documents and settings\All Users\Application Data\Ubisoft
2009-01-19 08:12 --------- d-----w c:\program files\ATI Technologies
2009-01-18 23:42 --------- d-----w c:\program files\QuickTime
2009-01-17 12:54 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-01-15 09:12 --------- d-----w c:\program files\Gigabyte
2009-01-14 15:27 --------- d-----w c:\documents and settings\user\Application Data\InstallShield
2009-01-14 15:27 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-01-14 15:03 --------- d-----w c:\documents and settings\user\Application Data\Ulead Systems
2009-01-14 15:00 --------- d-----w c:\program files\SmartSound Software
2009-01-14 15:00 --------- d-----w c:\documents and settings\All Users\Application Data\SmartSound Software Inc
2009-01-14 14:59 --------- d-----w c:\program files\Windows Media Components
2009-01-14 14:59 --------- d-----w c:\documents and settings\All Users\Application Data\QuickTime
2009-01-14 14:58 --------- d-----w c:\program files\Ulead Systems
2009-01-14 14:58 --------- d-----w c:\program files\Common Files\Ulead Systems
2009-01-14 14:58 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-14 14:40 --------- d-----w c:\program files\WinFast
2009-01-14 14:15 --------- d-----w c:\program files\Realtek
2009-01-13 16:17 --------- d-----w c:\program files\Foxit Software
2009-01-13 16:00 --------- d-----w c:\program files\Futuremark
2009-01-13 15:24 --------- d-----w c:\documents and settings\user\Application Data\Media Player Classic
2009-01-13 14:32 --------- d-----w c:\program files\Ahead
2009-01-13 14:32 --------- d-----w c:\documents and settings\user\Application Data\ACD Systems
2009-01-13 14:31 --------- d-----w c:\program files\Common Files\Ahead
2009-01-13 14:30 --------- d-----w c:\program files\Winamp
2009-01-13 14:30 --------- d-----w c:\documents and settings\user\Application Data\Winamp
2009-01-13 14:29 --------- d-----w c:\program files\CyberLink
2009-01-13 14:29 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-01-13 14:28 --------- d-----w c:\program files\Webteh
2009-01-13 14:28 --------- d-----w c:\program files\Common Files\ACD Systems
2009-01-13 14:28 --------- d-----w c:\program files\ACD Systems
2009-01-13 14:28 --------- d-----w c:\documents and settings\user\Application Data\BSplayer Pro
2009-01-13 14:28 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-01-13 14:27 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-13 14:15 --------- d-----w c:\program files\Common Files\ATI Technologies
2009-01-13 14:07 315,392 ----a-w c:\windows\HideWin.exe
2009-01-13 14:04 --------- d-----w c:\program files\Intel
2009-01-13 14:04 --------- d-----w c:\program files\Browser Configuration Utility
2009-01-13 13:59 --------- d-----w c:\program files\microsoft frontpage
2008-12-01 20:52 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2008-12-01 20:51 318,464 ----a-w c:\windows\system32\ati2dvag.dll
2008-12-01 20:46 11,304,960 ----a-w c:\windows\system32\atioglxx.dll
2008-12-01 20:41 188,416 ----a-w c:\windows\system32\atipdlxx.dll
2008-12-01 20:40 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2008-12-01 20:40 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2008-12-01 20:40 147,456 ----a-w c:\windows\system32\Oemdspif.dll
2008-12-01 20:40 143,360 ----a-w c:\windows\system32\ati2evxx.dll
2008-12-01 20:38 598,016 ----a-w c:\windows\system32\ati2evxx.exe
2008-12-01 20:37 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2008-12-01 20:27 4,120,384 ----a-w c:\windows\system32\ati3duag.dll
2008-12-01 20:19 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2008-12-01 20:11 2,495,360 ----a-w c:\windows\system32\ativvaxx.dll
2008-12-01 19:57 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2008-12-01 19:53 45,056 ----a-w c:\windows\system32\amdcalrt.dll
2008-12-01 19:53 45,056 ----a-w c:\windows\system32\amdcalcl.dll
2008-12-01 19:53 401,408 ----a-w c:\windows\system32\atikvmag.dll
2008-12-01 19:52 86,016 ----a-w c:\windows\system32\atiadlxx.dll
2008-12-01 19:52 17,408 ----a-w c:\windows\system32\atitvo32.dll
2008-12-01 19:50 3,252,224 ----a-w c:\windows\system32\Amdcaldd.dll
2008-12-01 19:50 286,720 ----a-w c:\windows\system32\atiok3x2.dll
2008-12-01 19:45 577,536 ----a-w c:\windows\system32\ati2cqag.dll
2008-12-01 13:35 593,920 ----a-w c:\windows\system32\ati2sgag.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0063BF63-BFFF-4B8F-9D26-4267DF7F17DD}"= "c:\windows\system32\dvmurl.dll" [2008-05-02 146528]

[HKEY_CLASSES_ROOT\clsid\{0063bf63-bfff-4b8f-9d26-4267df7f17dd}]
[HKEY_CLASSES_ROOT\dvmurl.DvmIEGoogleSearch]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2502BBD0-D73B-11DD-B4EC-CEBF56D89593}]
2009-02-15 18:09 200208 --a------ c:\windows\system32\vumer.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-01-24 2850816]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"systemguard"="c:\program files\System Guard 2009\systemguard.exe" [2009-02-15 1007104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ComPlusSetup]
2008-04-14 05:41 625664 c:\windows\system32\catsrvut.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"msacm.divxa32"= msaud32_divx.acm
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^p2pmax.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\p2pmax.lnk
backup=c:\windows\pss\p2pmax.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^runit_32.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\runit_32.lnk
backup=c:\windows\pss\runit_32.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
= [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2009-01-30 15:51 342848 c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 05:42 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2008-12-29 11:40 687560 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-12-29 11:40 687560 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a------ 2009-01-24 22:32 133104 c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2009-01-24 22:42 151552 c:\program files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2009-01-24 22:46 159744 c:\windows\system32\NEROCHECK.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2008-11-02 09:38 167936 d:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-24 22:44 98304 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
--a------ 2009-01-24 22:45 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-01-24 22:43 239000 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\systemguard]
--a------ 2009-02-15 17:16 1007104 c:\program files\System Guard 2009\systemguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
--a------ 2009-01-24 22:45 90112 c:\program files\WinFast\WFDTV\DTVSchdl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YMailAdvisor]
--a------ 2009-01-24 22:45 126976 c:\program files\Yahoo!\Common\YMailAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
--a------ 2009-01-24 22:45 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
-ra------ 2008-06-19 09:42 2808832 c:\windows\alcwzrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-ra------ 2008-06-27 04:23 16875008 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2008-06-18 11:01 77824 c:\windows\SoundMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ekrn"=2 (0x2)
"EhttpSrv"=3 (0x3)
"YahooAUService"=2 (0x2)
"UleadBurningHelper"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GEST Service"=2 (0x2)
"FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe"=2 (0x2)
"FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe"=2 (0x2)
"FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe"=2 (0x2)
"ES lite Service"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Codemasters\\Rise of the Argonauts\\Binaries\\RiseOfTheArgonauts.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"d:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
"d:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"d:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"d:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Program Files\\WinFast\\WFDTV\\DVBTAP.exe"=
"d:\\Program Files\\Garena\\Garena.exe"=
"d:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"d:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"d:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Gigabyte\\EnergySaver\\GSvr.exe"=
"c:\\Program Files\\Gigabyte\\EasySaver\\ESSVR.EXE"=
"c:\\Documents and Settings\\user\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=
"c:\\WINDOWS\\system32\\NeroCheck.exe"=
"c:\\WINDOWS\\ALCMTR.EXE"=
"c:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"=
"c:\\Program Files\\Common Files\\Ulead Systems\\DVD\\ULCDRSvr.exe"=
"c:\\Program Files\\WinFast\\WFDTV\\DTVSchdl.exe"=
"d:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\HP\\Smart Web Printing\\hpswp_clipbook.exe"=
"c:\\Program Files\\WinFast\\WFDTV\\WFWIZ.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqSTE08.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"d:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Yahoo!\\Companion\\Installs\\cpn\\ytbb.exe"=
"d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"d:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FAH.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"d:\\Program Files\\BitTorrent\\bittorrent.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"d:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"=
"d:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"=
"d:\\Program Files\\Flagship Studios\\Hellgate London\\Launcher.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe"=
"c:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe"=
"c:\\cf\\NirCmd.cfexe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-24 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-24 20560]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFDTV\WFIOCTL.sys [2009-01-14 9446]
S1 c0392aa0;c0392aa0;c:\windows\system32\drivers\c0392aa0.sys --> c:\windows\system32\drivers\c0392aa0.sys [?]
S3 garenapengine;GarenaPEngine;\??\c:\docume~1\user\LOCALS~1\Temp\OXG2.tmp --> c:\docume~1\user\LOCALS~1\Temp\OXG2.tmp [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-15 356920]
S4 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
S4 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\ESSVR.EXE [2009-01-13 73728]
S4 FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe;FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe;d:\program files\Deep Silver\Sacred 2 - Fallen Angel\FAH.exe -svcstart --> d:\program files\Deep Silver\Sacred 2 - Fallen Angel\FAH.exe -svcstart [?]
S4 FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe;FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe;d:\program files\Deep Silver\Sacred 2 - Fallen Angel\system\FAH.exe -svcstart --> d:\program files\Deep Silver\Sacred 2 - Fallen Angel\system\FAH.exe -svcstart [?]
S4 FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe;FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe;d:\program files\Ubisoft\Far Cry 2\bin\FAH.exe -svcstart --> d:\program files\Ubisoft\Far Cry 2\bin\FAH.exe -svcstart [?]
S4 GEST Service;GEST Service for program management.;c:\program files\Gigabyte\EnergySaver\GSvr.exe [2009-01-14 80392]
S4 YahooAUService;Yahoo! Updater;c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe
\Shell\install\command - F:\setup.exe
\Shell\install1\command - DirectX\DXSETUP.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\FrameworkCheck.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65c5d6b2-f125-11dd-a120-001fd09550d2}]
\ShelL\AutoPlay\command - kelbn.pif
\ShelL\AutoRun\command - kelbn.pif
\ShelL\eXpLOre\CoMmAnd - kelbn.pif
\ShelL\open\CoMMand - kelbn.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65c5d6b3-f125-11dd-a120-001fd09550d2}]
\Shell\AuTOplay\command - H:\dioomk.cmd
\Shell\AutoRun\command - H:\dioomk.cmd
\Shell\expLore\commaND - H:\dioomk.cmd
\Shell\open\CommaNd - H:\dioomk.cmd
.
Contents of the 'Scheduled Tasks' folder

2009-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-1801674531-1003.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-24 22:32]
.
- - - - ORPHANS REMOVED - - - -

BHO-{3cd53324-393a-46c3-bc63-bfa26937d35a} - c:\windows\system32\fefiyiri.dll
BHO-{D5BF4552-94F1-42BD-F434-3604812C807D} - c:\windows\system32\uisaj387dd.dll
SharedTaskScheduler-{D5BF4552-94F1-42BD-F434-3604812C807D} - c:\windows\system32\uisaj387dd.dll
SSODL-CrlfUsViow-{54520706-216E-4913-AB62-83C835BC7C5D} - fkmybckvbrp.dll
MSConfigStartUp-40cc2f1f - c:\windows\system32\pipibuju.dll
MSConfigStartUp-cpm43ff1c83 - c:\windows\system32\nugebini.dll
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
MSConfigStartUp-jotikemeti - c:\windows\system32\honunuzu.dll
MSConfigStartUp-lrijh8s73jhbfgfd - c:\docume~1\user\LOCALS~1\Temp\winlognn.exe
MSConfigStartUp-svchost - c:\windows\system32\svcnost.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.rs/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-15 18:42:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\de519eedcadabdc57adab544994d0f00.sys 39936 bytes executable
c:\windows\system32\_de519eedcadabdc57adab544994d0f00.sys_.vir 39936 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe]
"ImagePath"="d:\program files\Deep Silver\Sacred 2 - Fallen Angel\FAH.exe -svcstart"

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe]
"ImagePath"="d:\program files\Deep Silver\Sacred 2 - Fallen Angel\system\FAH.exe -svcstart"

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe]

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\de519eedcadabdc57adab544994d0f00]
"ImagePath"="system32\de519eedcadabdc57adab544994d0f00.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\garenapengine]
"ImagePath"="\??\c:\docume~1\user\LOCALS~1\Temp\OXG2.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet007\Services\252f02f]
"ImagePath"="\SystemRoot\System32\drivers\252f02f.sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\s-1-5-21-484763869-1343024091-1801674531-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:dd,0a,15,9a,2e,75,6d,6a,55,60,f6,e5,85,cf,3f,f9,11,f6,d1,91,87,af,2c,
2d,41,ca,90,45,b6,23,39,e0,c5,3b,7c,9b,0f,42,ed,e8,5d,39,0c,48,90,f7,34,6e,\
"??"=hex:77,4f,82,e5,3a,6e,27,31,e7,f6,21,c9,c7,9b,a8,1a

[HKEY_USERS\s-1-5-21-484763869-1343024091-1801674531-1003\Software\SecuROM\License information*]
"datasecu"=hex:e6,ee,3b,5c,4d,8e,ab,04,51,e1,62,61,81,06,cf,62,e7,cd,32,4a,dd,
c0,41,d5,7f,00,68,11,cc,81,a8,fd,01,6a,a3,47,f5,68,eb,3b,09,f1,ce,9c,96,60,\
"rkeysecu"=hex:7c,75,f1,77,63,d6,c5,55,fe,a2,c8,50,3e,96,16,28
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1068-)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2009-02-15 18:44:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-15 17:44:35
ComboFix2.txt 2009-01-24 18:09:27

Pre-Run: 21,973,716,992 bytes free
Post-Run: 22,328,406,016 bytes free

Current=7 Default=7 Failed=6 LastKnownGood=5 Sets=1,2,3,4,5,6,7
534

Poslao: 15 Feb 2009 18:57
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Pre nego sto nastavimo neka obrise Eset ili Avast, kako pri pustanju skripte ne bi nastao haos....

Poslao: 15 Feb 2009 19:18
Idi na vrh
offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

Izbrisao je nod

Poslao: 15 Feb 2009 21:19
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Neka obavezno iskljuci Avast....

Otvoriti Notepad i iskopirati sledeci tekst:

File::
c:\windows\system32\vumer.dll
c:\windows\system32\fkmybckvbrp.dll
C:\ybdwodw.exe
c:\windows\system32\drivers\c0392aa0.sys
c:\windows\system32\drivers\252f02f.sys

Folder::
c:\program files\System Guard 2009
c:\program files\aquaplay

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2502BBD0-D73B-11DD-B4EC-CEBF56D89593}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"systemguard"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\systemguard]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65c5d6b2-f125-11dd-a120-001fd09550d2}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65c5d6b3-f125-11dd-a120-001fd09550d2}]

Rootkit::
c:\windows\system32\de519eedcadabdc57adab544994d0f00.sys
c:\windows\system32\_de519eedcadabdc57adab544994d0f00.sys_.vir

Driver::
c0392aa0
252f02f
de519eedcadabdc57adab544994d0f00

Snimiti na Desktop fajl iz Notepada kao "CFScript"




Prevuci snimljeni skript/tekst na ComboFix ikonicu kao na slici.
Postaviti u sledecoj poruci log koji bude bio napravljen na kraju ciscenja/skeniranja.

Poslao: 15 Feb 2009 22:38
Idi na vrh
offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

ComboFix 09-02-14.01 - user 2009-02-15 22:21:45.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2800 [GMT 1:00]
Running from: c:\documents and settings\user\Desktop\cf.exe
Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090127-0] *On-access scanning enabled* (Outdated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\drivers\252f02f.sys
c:\windows\system32\drivers\c0392aa0.sys
c:\windows\system32\fkmybckvbrp.dll
c:\windows\system32\vumer.dll
C:\ybdwodw.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\aquaplay
c:\program files\aquaplay\Uninstall.exe
c:\program files\System Guard 2009
c:\program files\System Guard 2009\conf.cfg
c:\program files\System Guard 2009\mbase.vdb
c:\program files\System Guard 2009\quarantine.vdb
c:\program files\System Guard 2009\queue.vdb
c:\program files\System Guard 2009\systemguard.exe
c:\program files\System Guard 2009\uninstall.exe
c:\program files\System Guard 2009\vbase.vdb
c:\windows\system32\_de519eedcadabdc57adab544994d0f00.sys_.vir
c:\windows\system32\drivers\252f02f.sys
c:\windows\system32\fkmybckvbrp.dll
c:\windows\system32\vumer.dll
C:\ybdwodw.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DE519EEDCADABDC57ADAB544994D0F00
-------\Service_252f02f
-------\Service_c0392aa0


((((((((((((((((((((((((( Files Created from 2009-01-15 to 2009-02-15 )))))))))))))))))))))))))))))))
.

2009-02-15 19:15 . 2008-07-01 09:04 30,728 --a------ c:\windows\system32\drivers\epfwndis.sys
2009-02-15 17:41 . 2009-02-15 17:41 <DIR> d-------- c:\program files\Trend Micro
2009-02-15 17:22 . 2009-02-15 17:22 <DIR> d-------- c:\program files\Spyware Doctor
2009-02-15 17:22 . 2009-02-15 17:22 <DIR> d-------- c:\documents and settings\user\Application Data\PC Tools
2009-02-15 17:22 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-15 17:22 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-15 17:22 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-15 17:22 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-15 17:11 . 2009-02-15 17:23 51,355 --a------ c:\windows\system32\muzika.xm
2009-02-15 16:42 . 2009-02-15 18:03 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-15 14:01 . 2009-02-15 14:01 <DIR> d-------- c:\documents and settings\user\DoctorWeb
2009-02-14 19:58 . 2009-02-14 19:58 <DIR> d-------- c:\documents and settings\user\Application Data\Unity
2009-02-14 19:17 . 2009-02-14 19:17 <DIR> d-------- c:\program files\Unity
2009-02-14 12:21 . 2009-02-14 12:21 <DIR> d-------- c:\program files\Nobilis
2009-02-11 19:05 . 2009-02-11 19:15 <DIR> d-------- c:\program files\MagicISO
2009-02-10 19:49 . 2009-02-10 19:49 <DIR> d-------- c:\documents and settings\user\Application Data\OpenOffice.org
2009-02-10 19:48 . 2009-02-10 19:48 <DIR> d-------- c:\program files\OpenOffice.org 3
2009-02-10 19:48 . 2009-02-10 19:48 <DIR> d-------- c:\program files\JRE
2009-02-10 19:48 . 2009-02-10 19:48 <DIR> d-------- c:\program files\Common Files\Java
2009-02-10 14:47 . 2009-02-10 14:47 6,657,688 --a------ c:\windows\system32\xa700343.exe
2009-02-10 14:47 . 2009-02-10 14:47 6,657,688 --a------ c:\windows\system32\xa700093.exe
2009-02-09 20:27 . 2009-02-09 20:27 6,657,688 --a------ c:\windows\system32\xa46323859.exe
2009-02-09 20:27 . 2009-02-09 20:27 6,657,688 --a------ c:\windows\system32\xa46323562.exe
2009-02-09 17:38 . 2009-02-09 17:38 6,657,688 --a------ c:\windows\system32\xa36141843.exe
2009-02-09 17:38 . 2009-02-09 17:38 6,657,688 --a------ c:\windows\system32\xa36141593.exe
2009-02-09 14:50 . 2009-02-09 14:50 6,657,688 --a------ c:\windows\system32\xa26085796.exe
2009-02-09 14:50 . 2009-02-09 14:50 6,657,688 --a------ c:\windows\system32\xa26085546.exe
2009-02-09 13:31 . 2004-08-18 09:34 442,368 -ra------ c:\windows\system32\vp6vfw.dll
2009-02-08 17:39 . 2009-02-08 17:39 6,657,688 --a------ c:\windows\system32\xa11973531.exe
2009-02-08 17:39 . 2009-02-08 17:39 6,657,688 --a------ c:\windows\system32\xa11973234.exe
2009-02-07 19:37 . 2009-02-07 19:37 <DIR> d-------- c:\program files\mEliteSoftware
2009-02-07 19:36 . 2009-02-07 19:36 <DIR> d-------- c:\windows\system32\URTTEMP
2009-02-07 17:53 . 2009-02-07 17:53 6,657,688 --a------ c:\windows\system32\xa10277671.exe
2009-02-07 17:53 . 2009-02-07 17:53 6,657,688 --a------ c:\windows\system32\xa10277203.exe
2009-02-07 17:52 . 2009-02-07 17:52 6,657,688 --a------ c:\windows\system32\xa10221640.exe
2009-02-07 17:52 . 2009-02-07 17:52 6,657,688 --a------ c:\windows\system32\xa10221125.exe
2009-02-06 18:53 . 2009-02-06 18:53 <DIR> d-------- c:\documents and settings\user\Application Data\Leadertech
2009-02-05 11:03 . 2009-02-05 18:52 <DIR> d-------- c:\program files\PowerISO
2009-02-04 09:42 . 2009-02-04 09:42 279,712 --a------ c:\windows\system32\drivers\atksgt.sys
2009-02-04 09:42 . 2009-02-04 09:42 25,888 --a------ c:\windows\system32\drivers\lirsgt.sys
2009-02-03 20:44 . 2009-02-03 20:44 <DIR> d-------- c:\program files\Hewlett-Packard
2009-02-03 20:44 . 2009-02-03 20:44 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-02-03 20:43 . 2007-03-16 18:11 675,840 -ra------ c:\windows\system32\hpowiax3.dll
2009-02-03 20:37 . 2009-02-03 22:06 142,898 --a------ c:\windows\hpoins14.dat
2009-02-03 20:37 . 2008-04-02 09:01 2,000 --------- c:\windows\hpomdl14.dat
2009-02-01 21:23 . 2009-02-10 17:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-02-01 20:53 . 2009-02-01 20:53 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Xfire
2009-01-31 13:55 . 2009-01-31 13:55 <DIR> d-------- c:\program files\Atari
2009-01-30 23:33 . 2009-02-15 18:32 1,324 --a------ c:\windows\system32\d3d9caps.dat
2009-01-30 15:52 . 2009-02-11 07:30 <DIR> d-------- c:\documents and settings\user\Application Data\BitTorrent
2009-01-30 15:51 . 2009-02-05 18:52 <DIR> d-------- c:\program files\DNA
2009-01-30 15:51 . 2009-02-05 22:09 <DIR> d-------- c:\documents and settings\user\Application Data\DNA
2009-01-30 13:55 . 2009-01-30 13:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\Fallout3
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\program files\DAEMON Tools
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\documents and settings\user\Application Data\DAEMON Tools Pro
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\documents and settings\user\Application Data\DAEMON Tools
2009-01-28 15:39 . 2009-01-28 15:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-01-28 15:28 . 2009-01-31 13:54 <DIR> d-------- c:\documents and settings\user\Application Data\DAEMON Tools Lite
2009-01-27 18:24 . 2009-01-27 18:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard
2009-01-27 18:14 . 2009-01-27 18:14 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment
2009-01-26 20:13 . 2009-02-05 18:52 <DIR> d-------- c:\documents and settings\user\Application Data\Xfire
2009-01-25 18:25 . 2009-01-25 18:25 <DIR> d-------- c:\documents and settings\user\Application Data\AdobeUM
2009-01-25 18:24 . 2009-01-25 18:24 <DIR> d-------- c:\program files\Common Files\Adobe
2009-01-25 11:53 . 2009-01-25 11:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\The Learning Company
2009-01-25 11:53 . 2002-06-13 09:09 274,432 --a------ c:\windows\TLCUninstall.exe
2009-01-25 11:52 . 2009-01-25 11:52 0 --a------ c:\windows\SETUP32.INI
2009-01-24 23:21 . 2009-01-24 23:21 <DIR> d-------- c:\program files\The Learning Company
2009-01-24 22:37 . 2009-01-24 22:37 <DIR> d-------- c:\windows\system32\bits
2009-01-24 22:36 . 2009-01-24 22:38 <DIR> d-------- c:\windows\ServicePackFiles
2009-01-24 22:36 . 2008-04-14 05:42 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe
2009-01-24 22:34 . 2006-12-29 00:31 19,569 --a------ c:\windows\003450_.tmp
2009-01-24 22:21 . 2009-01-24 22:21 <DIR> d-------- C:\ASDASD
2009-01-24 19:40 . 2009-01-24 19:40 <DIR> d-------- c:\program files\Alwil Software
2009-01-24 19:29 . 2009-02-14 12:24 2,145,386,496 --a------ c:\windows\MEMORY.DMP
2009-01-24 19:14 . 2009-01-24 19:14 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-01-24 18:52 . 2008-04-14 05:39 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\WindowsShell.Manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\nwc.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2009-01-24 18:50 . 2009-01-24 18:50 488 -rah----- c:\windows\system32\logonui.exe.manifest
2009-01-24 18:49 . 2001-08-23 11:30 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe
2009-01-24 18:48 . 2004-08-03 22:29 44,544 --a------ c:\windows\system32\tscupgrd.exe
2009-01-24 18:48 . 2004-08-03 22:29 44,544 --a--c--- c:\windows\system32\dllcache\tscupgrd.exe
2009-01-24 18:42 . 2008-04-14 05:42 28,672 --a------ c:\windows\system32\vidcap.ax
2009-01-24 07:45 . 2009-01-24 07:45 <DIR> d-------- c:\program files\Kaspersky Lab
2009-01-23 02:18 . 2009-01-23 02:18 42,320 --a------ c:\windows\system32\xfcodec.dll
2009-01-22 12:30 . 2009-01-22 12:30 1,060,864 --a------ c:\windows\system32\mfc71.dll
2009-01-22 12:18 . 2009-02-14 12:23 2 --a------ C:\1087123376
2009-01-22 10:23 . 2009-01-22 10:23 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2009-01-21 21:55 . 2009-01-21 21:55 <DIR> d-------- c:\program files\Common Files\DirectX
2009-01-21 20:22 . 2009-02-10 20:40 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-21 20:22 . 2009-01-21 20:22 1,409 --a------ c:\windows\QTFont.for
2009-01-21 20:14 . 2009-01-21 20:14 <DIR> d-------- c:\windows\system32\drivers\umdf
2009-01-21 20:13 . 2009-01-21 20:13 <DIR> d-------- c:\windows\system32\xlive
2009-01-21 20:13 . 2009-01-22 11:17 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2009-01-21 20:13 . 2009-01-22 12:14 77,081 --a------ c:\windows\setupapi.old
2009-01-21 19:53 . 2009-01-30 13:54 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-21 19:52 . 2009-01-21 19:52 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-21 19:52 . 2006-06-29 13:07 14,048 --a------ c:\windows\system32\spmsg2.dll
2009-01-21 12:28 . 2009-01-21 12:28 <DIR> d-------- c:\program files\Testovi Srpski
2009-01-20 18:14 . 2009-01-20 18:14 <DIR> d-------- c:\documents and settings\user\Application Data\Yahoo!
2009-01-20 18:14 . 2009-01-20 18:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-20 18:14 . 2009-01-20 18:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo!
2009-01-20 18:13 . 2009-01-20 18:14 <DIR> d-------- c:\program files\Yahoo!
2009-01-20 16:30 . 2009-02-11 19:58 <DIR> d-------- c:\program files\McDonaldsDragons
2009-01-20 11:25 . 2009-01-20 11:25 <DIR> d-------- c:\windows\Sun
2009-01-20 05:39 . 2009-01-20 05:39 23 --a------ c:\windows\BlendSettings.ini
2009-01-20 01:11 . 2009-01-20 01:11 <DIR> d-------- C:\EmergencyUtils
2009-01-20 00:51 . 2009-01-20 00:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Pro
2009-01-20 00:25 . 2009-01-20 00:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\TrackMania
2009-01-19 23:34 . 2009-01-19 23:34 <DIR> d-------- c:\documents and settings\user\Application Data\CyberLink
2009-01-19 09:16 . 2009-01-19 09:16 0 --a------ c:\windows\hpqEmlSz.INI
2009-01-19 09:14 . 2009-01-19 09:14 <DIR> d-------- c:\documents and settings\user\Application Data\HP
2009-01-19 03:36 . 2009-01-19 03:36 <DIR> d-------- c:\documents and settings\user\Application Data\Microsoft Games
2009-01-17 23:56 . 2009-01-17 23:56 <DIR> d--hs---- C:\$RECYCLE.BIN
2009-01-17 23:46 . 2009-01-17 23:46 <DIR> d--hs---- C:\Boot
2009-01-17 23:46 . 2006-11-02 10:53 438,840 -rahs---- C:\bootmgr
2009-01-17 23:46 . 2009-01-17 23:46 8,192 -ra-s---- C:\BOOTSECT.BAK
2009-01-17 14:42 . 2009-01-17 14:42 <DIR> d-------- c:\documents and settings\user\Application Data\ESET
2009-01-17 14:22 . 2009-01-17 14:22 1,905 --a------ c:\windows\diagwrn.xml
2009-01-17 14:22 . 2009-01-17 14:22 1,905 --a------ c:\windows\diagerr.xml
2009-01-17 14:20 . 2009-01-17 14:20 <DIR> d-------- c:\documents and settings\user\Application Data\Ubisoft
2009-01-17 13:37 . 2009-01-17 13:37 <DIR> d-------- c:\documents and settings\user\Application Data\ATI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-12 13:24 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-10 18:55 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-10 18:54 --------- d-----w c:\program files\MSBuild
2009-02-01 12:55 --------- d-----w c:\documents and settings\All Users\Application Data\Ulead Systems
2009-01-28 14:28 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-24 21:44 57,344 ----a-w c:\windows\ALCMTR.EXE
2009-01-24 21:44 --------- d-----w c:\program files\Opera
2009-01-24 21:30 472,576 ----a-w C:\dxsetup.exe
2009-01-24 18:07 16,608 ----a-w c:\windows\gdrv.sys
2009-01-20 22:10 --------- d-----w c:\program files\Ubisoft
2009-01-20 22:10 --------- d-----w c:\documents and settings\All Users\Application Data\Ubisoft
2009-01-19 08:12 --------- d-----w c:\program files\ATI Technologies
2009-01-18 23:42 --------- d-----w c:\program files\QuickTime
2009-01-17 12:54 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-01-15 09:12 --------- d-----w c:\program files\Gigabyte
2009-01-14 15:27 --------- d-----w c:\documents and settings\user\Application Data\InstallShield
2009-01-14 15:27 --------- d-----w c:\documents and settings\All Users\Application Data\InstallShield
2009-01-14 15:03 --------- d-----w c:\documents and settings\user\Application Data\Ulead Systems
2009-01-14 15:00 --------- d-----w c:\program files\SmartSound Software
2009-01-14 15:00 --------- d-----w c:\documents and settings\All Users\Application Data\SmartSound Software Inc
2009-01-14 14:59 --------- d-----w c:\program files\Windows Media Components
2009-01-14 14:59 --------- d-----w c:\documents and settings\All Users\Application Data\QuickTime
2009-01-14 14:58 --------- d-----w c:\program files\Ulead Systems
2009-01-14 14:58 --------- d-----w c:\program files\Common Files\Ulead Systems
2009-01-14 14:58 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-14 14:40 --------- d-----w c:\program files\WinFast
2009-01-14 14:15 --------- d-----w c:\program files\Realtek
2009-01-13 16:17 --------- d-----w c:\program files\Foxit Software
2009-01-13 16:00 --------- d-----w c:\program files\Futuremark
2009-01-13 15:24 --------- d-----w c:\documents and settings\user\Application Data\Media Player Classic
2009-01-13 14:32 --------- d-----w c:\program files\Ahead
2009-01-13 14:32 --------- d-----w c:\documents and settings\user\Application Data\ACD Systems
2009-01-13 14:31 --------- d-----w c:\program files\Common Files\Ahead
2009-01-13 14:30 --------- d-----w c:\program files\Winamp
2009-01-13 14:30 --------- d-----w c:\documents and settings\user\Application Data\Winamp
2009-01-13 14:29 --------- d-----w c:\program files\CyberLink
2009-01-13 14:29 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2009-01-13 14:28 --------- d-----w c:\program files\Webteh
2009-01-13 14:28 --------- d-----w c:\program files\Common Files\ACD Systems
2009-01-13 14:28 --------- d-----w c:\program files\ACD Systems
2009-01-13 14:28 --------- d-----w c:\documents and settings\user\Application Data\BSplayer Pro
2009-01-13 14:28 --------- d-----w c:\documents and settings\All Users\Application Data\ACD Systems
2009-01-13 14:27 --------- d-----w c:\program files\K-Lite Codec Pack
2009-01-13 14:15 --------- d-----w c:\program files\Common Files\ATI Technologies
2009-01-13 14:07 315,392 ----a-w c:\windows\HideWin.exe
2009-01-13 14:04 --------- d-----w c:\program files\Intel
2009-01-13 14:04 --------- d-----w c:\program files\Browser Configuration Utility
2009-01-13 13:59 --------- d-----w c:\program files\microsoft frontpage
2008-11-27 04:45 99,840 ----a-w c:\windows\pchealth\helpctr\binaries\HelpHost.exe
2008-11-27 04:45 769,024 ----a-w c:\windows\pchealth\helpctr\binaries\helpctr.exe
2008-11-27 04:45 6,656 ----a-w c:\windows\pchealth\helpctr\binaries\HCAppRes.dll
2008-11-27 04:45 39,424 ----a-w c:\windows\AppPatch\AcAdProc.dll
2008-11-27 04:45 35,328 ----a-w c:\windows\pchealth\helpctr\binaries\notiflag.exe
2008-11-27 04:45 21,504 ----a-w c:\windows\pchealth\helpctr\binaries\brpinfo.dll
2008-11-27 04:45 16,535 ----a-r c:\windows\SET8.tmp
2008-11-27 04:45 1,296,669 ----a-r c:\windows\SET3.tmp
2008-11-27 04:45 1,088,840 ----a-r c:\windows\SET4.tmp
.

((((((((((((((((((((((((((((( SnapShot@2009-02-15_18.44.11.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-15 21:24:04 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_788.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0063BF63-BFFF-4B8F-9D26-4267DF7F17DD}"= "c:\windows\system32\dvmurl.dll" [2008-05-02 146528]

[HKEY_CLASSES_ROOT\clsid\{0063bf63-bfff-4b8f-9d26-4267df7f17dd}]
[HKEY_CLASSES_ROOT\dvmurl.DvmIEGoogleSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-01-24 2850816]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ComPlusSetup]
2008-04-14 05:41 625664 c:\windows\system32\catsrvut.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll
"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"msacm.divxa32"= msaud32_divx.acm
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^p2pmax.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\p2pmax.lnk
backup=c:\windows\pss\p2pmax.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^runit_32.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\runit_32.lnk
backup=c:\windows\pss\runit_32.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\documents and settings\user\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GEST]
= [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2009-01-30 15:51 342848 c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 05:42 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2008-12-29 11:40 687560 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-12-29 11:40 687560 c:\program files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a------ 2009-01-24 22:32 133104 c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2009-01-24 22:42 151552 c:\program files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2009-01-24 22:46 159744 c:\windows\system32\NEROCHECK.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2008-11-02 09:38 167936 d:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-24 22:44 98304 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
--a------ 2009-01-24 22:45 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-01-24 22:43 239000 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFastDTV]
--a------ 2009-01-24 22:45 90112 c:\program files\WinFast\WFDTV\DTVSchdl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YMailAdvisor]
--a------ 2009-01-24 22:45 126976 c:\program files\Yahoo!\Common\YMailAdvisor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
--a------ 2009-01-24 22:45 111856 c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
-ra------ 2008-06-19 09:42 2808832 c:\windows\alcwzrd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-ra------ 2008-06-27 04:23 16875008 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2008-06-18 11:01 77824 c:\windows\SoundMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ekrn"=2 (0x2)
"EhttpSrv"=3 (0x3)
"YahooAUService"=2 (0x2)
"UleadBurningHelper"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"IDriverT"=3 (0x3)
"GEST Service"=2 (0x2)
"FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe"=2 (0x2)
"FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe"=2 (0x2)
"FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe"=2 (0x2)
"ES lite Service"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Codemasters\\Rise of the Argonauts\\Binaries\\RiseOfTheArgonauts.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"d:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
"d:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"d:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"d:\\Program Files\\Mass Effect\\Binaries\\MassEffect.exe"=
"d:\\Program Files\\Mass Effect\\MassEffectLauncher.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Program Files\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Program Files\\WinFast\\WFDTV\\DVBTAP.exe"=
"d:\\Program Files\\Garena\\Garena.exe"=
"d:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"d:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"d:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\Gigabyte\\EnergySaver\\GSvr.exe"=
"c:\\Program Files\\Gigabyte\\EasySaver\\ESSVR.EXE"=
"c:\\Documents and Settings\\user\\Local Settings\\Application Data\\Google\\Update\\GoogleUpdate.exe"=
"c:\\WINDOWS\\system32\\NeroCheck.exe"=
"c:\\WINDOWS\\ALCMTR.EXE"=
"c:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"=
"c:\\Program Files\\Common Files\\Ulead Systems\\DVD\\ULCDRSvr.exe"=
"c:\\Program Files\\WinFast\\WFDTV\\DTVSchdl.exe"=
"d:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"c:\\Program Files\\HP\\Smart Web Printing\\hpswp_clipbook.exe"=
"c:\\Program Files\\WinFast\\WFDTV\\WFWIZ.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqSTE08.exe"=
"c:\\Program Files\\QuickTime\\qttask.exe"=
"d:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Yahoo!\\Companion\\Installs\\cpn\\ytbb.exe"=
"d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"=
"d:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"d:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"d:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FAH.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"d:\\Program Files\\BitTorrent\\bittorrent.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"d:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"=
"d:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"=
"d:\\Program Files\\Flagship Studios\\Hellgate London\\Launcher.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=
"c:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe"=
"c:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe"=
"c:\\cf\\NirCmd.cfexe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-24 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-24 20560]
R3 WFIOCTL;WFIOCTL;c:\program files\WinFast\WFDTV\WFIOCTL.sys [2009-01-14 9446]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\user\LOCALS~1\Temp\YDQ2.tmp --> c:\docume~1\user\LOCALS~1\Temp\YDQ2.tmp [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-15 356920]
S4 ekrn;Eset Service;"c:\program files\ESET\ESET Smart Security\ekrn.exe" --> c:\program files\ESET\ESET Smart Security\ekrn.exe [?]
S4 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\ESSVR.EXE [2009-01-13 73728]
S4 FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe;FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe;d:\program files\Deep Silver\Sacred 2 - Fallen Angel\FAH.exe -svcstart --> d:\program files\Deep Silver\Sacred 2 - Fallen Angel\FAH.exe -svcstart [?]
S4 FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe;FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe;d:\program files\Deep Silver\Sacred 2 - Fallen Angel\system\FAH.exe -svcstart --> d:\program files\Deep Silver\Sacred 2 - Fallen Angel\system\FAH.exe -svcstart [?]
S4 FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe;FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe;d:\program files\Ubisoft\Far Cry 2\bin\FAH.exe -svcstart --> d:\program files\Ubisoft\Far Cry 2\bin\FAH.exe -svcstart [?]
S4 GEST Service;GEST Service for program management.;c:\program files\Gigabyte\EnergySaver\GSvr.exe [2009-01-14 80392]
S4 YahooAUService;Yahoo! Updater;c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\autorun.exe
\Shell\install\command - F:\setup.exe
\Shell\install1\command - DirectX\DXSETUP.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\FrameworkCheck.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-484763869-1343024091-1801674531-1003.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-24 22:32]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.rs/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-15 22:24:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\System\controlset005\Services\FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+FAH.exe]
"ImagePath"="d:\program files\Deep Silver\Sacred 2 - Fallen Angel\FAH.exe -svcstart"

[HKEY_LOCAL_MACHINE\System\controlset005\Services\FAH@D:+Program Files+Deep Silver+Sacred 2 - Fallen Angel+system+FAH.exe]
"ImagePath"="d:\program files\Deep Silver\Sacred 2 - Fallen Angel\system\FAH.exe -svcstart"

[HKEY_LOCAL_MACHINE\System\controlset005\Services\FAH@D:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe]

[HKEY_LOCAL_MACHINE\System\controlset005\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\user\LOCALS~1\Temp\YDQ2.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-484763869-1343024091-1801674531-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:dd,0a,15,9a,2e,75,6d,6a,55,60,f6,e5,85,cf,3f,f9,11,f6,d1,91,87,af,2c,
2d,41,ca,90,45,b6,23,39,e0,c5,3b,7c,9b,0f,42,ed,e8,5d,39,0c,48,90,f7,34,6e,\
"??"=hex:77,4f,82,e5,3a,6e,27,31,e7,f6,21,c9,c7,9b,a8,1a

[HKEY_USERS\S-1-5-21-484763869-1343024091-1801674531-1003\Software\SecuROM\License information*]
"datasecu"=hex:e6,ee,3b,5c,4d,8e,ab,04,51,e1,62,61,81,06,cf,62,e7,cd,32,4a,dd,
c0,41,d5,7f,00,68,11,cc,81,a8,fd,01,6a,a3,47,f5,68,eb,3b,09,f1,ce,9c,96,60,\
"rkeysecu"=hex:7c,75,f1,77,63,d6,c5,55,fe,a2,c8,50,3e,96,16,28
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1056)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-02-15 22:26:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-15 21:26:02
ComboFix2.txt 2009-02-15 17:44:38
ComboFix3.txt 2009-01-24 18:09:27

Pre-Run: 22,297,710,592 bytes free
Post-Run: 22,299,254,784 bytes free

Current=5 Default=5 Failed=7 LastKnownGood=4 Sets=1,2,3,4,5,6,7
464

Dopuna: 15 Feb 2009 22:38

GUZ - Glavom U Zid
https://www.mycity.rs/must-login.png

Poslao: 15 Feb 2009 22:43
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Ovo je sad mnoogo bolje...
Pitaj druga dal ima jos uvek probleme...

Poslao: 16 Feb 2009 14:03
Idi na vrh
offline
  • Veljko
  • Pridružio: 29 Jul 2008
  • Poruke: 615
  • Gde živiš: Zemun

Otici cu da proverim malo kasnije danas

Dopuna: 16 Feb 2009 14:03

BIO sam do njega.Koliko sam video nema siptoma

Poslao: 16 Feb 2009 19:04
Idi na vrh
offline
  • diarno  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 15 Jun 2007
  • Poruke: 5572

Ok... to je to...

Neka uradi jos ovo :


Klikni START a zatim RUN
U liniju za unos teksta ukucaj Combofix /u i klikni OK





Sačekaj da se proces deinstalacije završi
Gornja procedura će:
Obrisati sledeće:
ComboFix i njegove file-ove i foldere
VundoFix Backups folder, ako postoji
C:\Deckard folder, ako postoji
C:\OtMoveIt folder, ako postoji
Resetovati podešavanja sata na kompjuteru
Sakriti ekstenzije file-ova, ako je potrebno
Sakriti sistemske/skrivene file-ove/foldere, ako je potrebno
Resetovati System Restore

MyCity » Ambulanta -> Arhiva Ambulante » system guard 2009

Ko je trenutno na forumu
 

Ukupno su 1141 korisnika na forumu :: 32 registrovanih, 6 sakrivenih i 1103 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: A.R.Chafee.Jr., acatomic, airsuba, ajo baba, Andrija357, Ben Roj, bojank, cavatina, cenejac111, Denaya, Dorcolac, goxin, Jakov01, JimmyNapoli, jukeboxer, Kibice, kunktator, milutin134, operniki, procesor, savaskytec, Shinobi, Sirius, stankolich, suponik, Toper, VJ, zdrebac, Zoca, Šraf, Žrnov, 1107