Avira Free Antivirus - non-stop mi izbacuje isti prozor upozorenja

[ paterson @ 30.06.2012. 21:45 ] @

Ne znam kako da izađem na kraj sa tim dosadnim upozorenjem programa Avire Antivirus Free?

[ paterson @ 07.07.2012. 09:58 ] @

Hvala Vam na Vašem "brzom i neposrednom pomoći".

Edit:

U međuvremenu sam instalirao Avira Antivirus Premium 2012 na probni period od 30 dana, skenirao ga i nisam našao ništa, i ista pesma - non stop mi izbacuje isti prozor kao na slici u prethodnom postu.

I još jednom hvala što mesto da pomognete nekom u nevolji kako da reši problem, vi to jednostavno ignorišete.

_{[Ovu poruku je menjao paterson dana 07.07.2012. u 11:10 GMT+1]}

[ since1986BC @ 07.07.2012. 10:36 ] @

Klik na "Remove" dugme?

[ paterson @ 07.07.2012. 10:42 ] @

Ne vredi na REMOVE dugme. Kako god da pritisnem na REMOVE, na prethodnoj slici vidite čak 4 do 5 kako se kaže dole AVIRA crvene sličice i opet jovo na novo. Da ne bih usporavao rad računara jednostavno kliknem umesto na REMOVE gore na crveni KRSTIĆ i tako unedogled samo da mi ne usporava rad računara.

[ madcama @ 07.07.2012. 11:41 ] @

Imaš li admin pivilegije na tom računaru?

[ paterson @ 07.07.2012. 11:53 ] @

Citat:

madcama: Imaš li admin pivilegije na tom računaru?

Ne razumem pitanje. Budite malo više jasniji šta znači pitanje.

Mislim da je problem počeo od onog momenta (mislim od pre mesec dana) kad sam instalirao Windows Media Player, pa mi je Microsoft automatski stavio dole neki znak za automatski update, a znak se jedno vreme uopšte nije dao brisati niti deinstalirati.
Sad više nema tog znaka za Microsoft automatski update (mislim da sam ga deinstalirao u CONTROL PANEL/ADD OR REMOVE), ali mi se zato od sad javlja AVIRA non-stop neprijatan zvuk i isto prozorče.

Zanimljivo, tek sad vidim da nema ADD or REMOVE u CONTROL PANEL-u.

_{[Ovu poruku je menjao Goran Mijailovic dana 08.07.2012. u 17:34 GMT+1]}

[ superbaka @ 07.07.2012. 11:59 ] @

http://www.elitesecurity.org/p3015666

[ paterson @ 07.07.2012. 12:01 ] @

Citat:

superbaka: http://www.elitesecurity.org/p3015666

Zahvaljujem na odgovoru, ali ne znam šta ste time hteli reći?

[ superbaka @ 07.07.2012. 12:20 ] @

trebao si (ako nisi) procitati i ostale odgovore nakon ovog...

Avira daje dosta false positive obavestenja i ne daje mogucnost 'da joj se objasni' da fajl nije virus, i da prekine sa tim upozorenjima...

izbor AV programa zavisi od mnogo faktora, ukljucujuci recimo

- nivo edukativnosti o zastiti, i stepenu rizicnog ponasanja
- performansama kompjutera
- nivou tolerancije prema sra**ima koje AV radi itd...

konkretno, u mom slucaju, ja imam prilicno visok nivo poznavanja ove materije, i vrlo nizak nivo rizicnog ponasanja, zero toleranciju prema softveru koji opterecuje performanse, i zero tolerancije prema ovoj trecoj stavki... za mene je najbolji izbor NOD32 od placenih, odnosno Avast i Panda Cloud od besplatnih, mada je Avast zasrao stvari poslednjom verzijom jako opterecujuci sistem, ali ga postavljam tu kao porodican covek ciji racunar koriste zena i maloletno dete koji nemaju pojma o zastiti...

za nekog ko nema pojma o zastiti, klikce na sve zivo na pron sajtovima, ima azdaju od kompa, i ne obazire se mnogo sto ne moze da instalira neki legitiman program jer mu AV softver to ne dozvoljava, placena resenja poput Kaspersky, G Data i F-secure su najbolja resenja...

izmedju ovih dva ekstremna resenja treba traziti softver 'skrojen po meri'...

[ since1986BC @ 07.07.2012. 14:28 ] @

Potrazio sam na Avira forumu, i resenje problema postoji ali je dosta kompleksno.
http://forum.avira.com/wbb/ind...age=Thread&threadID=146446

U Google pretragu je samo trebalo upisati: " avira patched.za "

Koliko shvatam tvoje poznavanje PC terminologije je slabo, pa mi ne preostaje nista drugo nego da ti preporucim da nadjes neki drugi antivirus.

Citat:

Zanimljivo, tek sad vidim da nema ADD or REMOVE u CONTROL PANEL-u.

Klik na start dugme, potom u polje za pretragu/komande kucas: add or remove
i dobices ga ponudjenog u listi.

[ paterson @ 07.07.2012. 14:38 ] @

Citat:

since1986BC: Potrazio sam na Avira forumu, i resenje problema postoji ali je dosta kompleksno.
http://forum.avira.com/wbb/ind...age=Thread&threadID=146446

U Google pretragu je samo trebalo upisati: " avira patched.za "

Koliko shvatam tvoje poznavanje PC terminologije je slabo, pa mi ne preostaje nista drugo nego da ti preporucim da nadjes neki drugi antivirus.

Puno hvala na trudu. Pokušaću prvo da vidim kako da rešim sa AVIROM, pa ako ne uspem, onda deinstalacija AVIRE i instalacija AVG probni.

Što se tiče PC terminologije tu ste u pravu. Nisam u stanju pratiti "usavršavanje i napredak" PC jezika jer nisam u formi.

Citat:

since1986BC:Klik na start dugme, potom u polje za pretragu/komande kucas: add or remove
i dobices ga ponudjenog u listi.

Takođe zahvaljujem na odgovoru. Koristim CCleaner za deinstalaciju, a nikad ne koristim WINDOWS 7 ULTIMATE add or remove.

_{[Ovu poruku je menjao paterson dana 07.07.2012. u 15:48 GMT+1]}

[ mare005 @ 07.07.2012. 15:02 ] @

1- pokreni Aviru > Extras > Configuration > Expert Mode > PC protection > RealTime Protection > Scan > Exceptions > dodaj u processes and files ( što detektuje kao FP ) ,potvrdi na ok.

http://fotkica.com/slike.php?slika=1_58333573_Capture.jpg

Međutim,da bi skinuli sumnju da li je zaista FP ili Avira nije u mogućnosti da ukloni malware već ga samo detektuje moraš proveriti .S obzirom da sam tvrdiš da si ne upućen, mislim da je u tom slučaju najlakši način pomoću nekog programa.

2- Comodo Cleaning Essentials skini sa neta,obavezno update-uj ,uradi Full scan. Ako zatraži restartuj sistem.

https://www.comodo.com/busines...ection/cleaning_essentials.php

[ paterson @ 07.07.2012. 18:58 ] @

Citat:

mare005: 1- pokreni Aviru > Extras > Configuration > Expert Mode > PC protection > RealTime Protection > Scan > Exceptions > dodaj u processes and files ( što detektuje kao FP ) ,potvrdi na ok.

http://fotkica.com/slike.php?slika=1_58333573_Capture.jpg

Međutim,da bi skinuli sumnju da li je zaista FP ili Avira nije u mogućnosti da ukloni malware već ga samo detektuje moraš proveriti .S obzirom da sam tvrdiš da si ne upućen, mislim da je u tom slučaju najlakši način pomoću nekog programa.

Došao sam do Exceptions, ali mi nije jasno šta da dodam niti gde da dodam? Probao ručno napisati prvo W/32....., pa onda ručno u drugi red C:\....... i kliknuo OK i.... NIŠTA. I dalje opet ista pesma.

Citat:

mare005:2- Comodo Cleaning Essentials skini sa neta,obavezno update-uj ,uradi Full scan. Ako zatraži restartuj sistem.

https://www.comodo.com/busines...ection/cleaning_essentials.php

Posle 2 sata Full scan COMODO-a i detektovao 10 ne znam kako se kaže crvenih kao threads i aplikovao ih. I...... opet ništa tj. i dalje ista pesma.

[ paterson @ 07.07.2012. 19:05 ] @

Citat:

Probao nešto na onom gore linku, kliknuo za download OTL i umesto da dobijem ikonu OTL-a iz slike OTL1 dobijem drugu sliku ikone OTL iz slike OTL2. Kliknem na ikonu OTL iz slike OTL2, dobijem sliku OTL4, a trebala je slika OTL3.

Šta se tu dešava?!

_{[Ovu poruku je menjao paterson dana 07.07.2012. u 20:20 GMT+1]}

[ SStudio @ 08.07.2012. 00:34 ] @

Skini Aviru ili Kasperski live cd i sa njim preskeniraj komp.
Ako nešto nađu našli su ako ne let it be do sledeće reinstalacije....

[ sad_ste_face_jel @ 08.07.2012. 02:20 ] @

Ja koristim Karspersky KIS i zadovoljan sam.Ali na Wn 7 mnogo manje virusa ima nego na win xp! Mozda je to moja iluzija ali gde god sam surfovao kasperski mi nikada nije izbacivao da je nasao virus jedino na pojedine sajtove mi izbaci ta su sajtovi rizicni i to je to.Dok na 3 racunara na kojima je win xp nalazio po 300 pa i vise trojanca i ostalih smradova.Uglavnom koristim kaspersky 2012 kis i racunar mi radi lepo nema virusa,Nisam pokusao sa drugim antivirusnim programima ali eto drug je imao situaciju da kada je radio reinstalaciju sistema instalirao neki drugi AV i njegov brat je uspeo da nekako instalira jos jedan AV (mcafee) i pokosio mu je sistem u potpunosti dok sa kaspersky-jem nikad nisam imao problema.NOD32 je barem po meni nikakav AV jer sam ga imao i imam losa iskustva.Za AVG kazu da nije los ali iskreno sve to sto vam oni daju preko mesec dana da koristite za dzaba to je uzaludno.

[ paterson @ 08.07.2012. 05:37 ] @

Citat:

SStudio: Skini Aviru ili Kasperski live cd i sa njim preskeniraj komp.
Ako nešto nađu našli su ako ne let it be do sledeće reinstalacije....

Kažeš:

"Skini Aviru ili Kasperski live cd i sa njim preskeniraj komp."

Budi malo precizniji - Sa čim da preskeniram komp.?

Gde da nađem Kasperski live cd, a da ne košta ništa?

_{[Ovu poruku je menjao paterson dana 08.07.2012. u 06:49 GMT+1]}

[ kristi1 @ 08.07.2012. 06:43 ] @

Citat:

Ne radi nista sto ne razumes. Vidis da helper koristi profi alate i pise skripte koje se odnose iskljucivo na taj racunar i nijedan drugi. To nema veze sa tvojim sistemom. Mozes samo jos vecu stetu da napravis.

Zakacio si ZA rootkit (zero access). Korisnici svih antivirusa su pogodjeni ovom infekcijom.

Upamti za ubuduce. Nikada nemoj da menjas antivirus u trenutku kad imas aktivnu infekciju na sistemu. To je prva greska koju korisnik pravi u nadi da ce obrisati malware.

Pokreni Malwarebytes Quick scan http://www.malwarebytes.org/products/malwarebytes_pro

Dostavi log fajl posle brisanja.

Zatim pokreni RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ugasi sve programe
Pokreni RogueKiller

XP > dvoklik na ikonu programa
Windows Vista - Windows7 > desni klik na ikonu i koristiti opciju Run as Administrator

Sacekaj da program zavrsi inicijalno skeniranje
Klikni na karticu Scan

Sacekaj da se zavrsi skeniranje
Izvestaj ce se nalaziti na Desktopu
Klikni na karticu Delete

Izvestaj ce se nalaziti na desktopu
Zatim klikni na karticu ShortcutsFix

Izvestaj ce se nalaziti na radnoj povrsini.

Potrebno je priloziti sve RKreport.txt izvestaje na uvid

[ paterson @ 08.07.2012. 07:58 ] @

Da li zbog deinstalacije AVIRE ( iznervirao me je - i nisam imao strpljenja da čekam rešenje problema nedelju dana), došlo je do kraha sistema na laptopu i radim sada ovo u SAFE MODE WITH NETWORK.

Ne znam da li smem da pokrenem gore programe "Malwarebytes Quick scan" i "RogueKiller" u SAFE MODE WITH NETWORK?

[ kristi1 @ 08.07.2012. 08:06 ] @

Mozes.

[ paterson @ 08.07.2012. 08:55 ] @

Krah sistema sa porukom OPERATING SYSTEM IS NOT FOUND. Pomozite mi kako da rešim ovo.

EDIT

ovo je safe mode samo je pitanje koliko će izdržati - dosad je u tom safe modu krahirao 3 puta

[ paterson @ 08.07.2012. 10:10 ] @

Citat:

kristi1: Potrebno je priloziti sve RKreport.txt izvestaje na uvid

Valjda je to taj RKreport.txt izveštaj?

Citat:

RogueKiller V7.6.2 [07/02/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 32 bits version
Started in : Normal mode
User: Zoran [Admin rights]
Mode: Shortcuts HJfix -- Date: 07/08/2012 11:07:43

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 0 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 0 / Fail 0
My documents: Success 0 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 1 / Fail 0
Backup: [NOT FOUND]

Drives:
[C:] \Device\HarddiskVolume1 -- 0x3 --> Restored
[D:] \Device\CdRom0 -- 0x5 --> Skipped
[E:] \Device\HarddiskVolume2 -- 0x3 --> Restored

¤¤¤ Infection : ZeroAccess ¤¤¤

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

[ Goran Mijailovic @ 08.07.2012. 11:46 ] @

Citat:

SStudio: Nisi se ni potrudio da potražiš, već bi da ti neko servira sve gotovo, jer da jesi video bi da su besplatni.
I Kasperski i Aviru možeš da nađeš na ovom sajtu

http://justfuckinggoogleit.com/

Ili pretragom ovog foruma na primer:)

Citat:

Goran Mijailovic: Skini, na primer, Kaspersky Rescue Disk 10 pa skeniraj pomocu njega http://support.kaspersky.com/faq/?qid=208282173 ali taj disk moras narezati na nekoj cistoj mašini.

[ kristi1 @ 08.07.2012. 12:34 ] @

¤¤¤ Infection : ZeroAccess ¤¤¤

On je video ZA infekciju, ali ne moze da je ukloni iz Safe mode, ili ti nesto radis sto ne treba.

Ne znam sta si radio pa si napravio BSOD, u principu mbam delimicno brise ovu infekciju u normal mode

Ako uspes da udjes u normal mode pokreni OTL sa ovog linka i dostavi log fajl.

probaj kod restarta da izaberes last good configuration

Preuzmi OTL na desktop http://oldtimer.geekstogo.com/OTL.exe

Dvoklikom pokreni OTL;

klikni Run Scan;

Po završetku skeniranja, izveštaj ce se otvoriti u Notepad-u.

Kopiraj mi log.

[ kristi1 @ 08.07.2012. 12:54 ] @

OK, dok ja pregledam log ti odradi sledece:

Preuzmi program FRSTFarbar Recovery Scan Tool i sacuvaj ga na flash drive ( USB memorijski uredjaj )

Download link za 32bit-ni ( x86 ) operativni system:

Code:
download.bleepingcomputer.com/farbar/FRST.exe

Download link za 64bit-ni operativni system:

Code:
download.bleepingcomputer.com/farbar/FRST64.exe

Ubaci flash drive u inficiran racunar.
Pokreni System Recovery Options.

Da bi pristupio System Recovery Options iz Advanced Boot Options odradi sledece:

Restartuj racunar i pritiskaj F8 dugme dok ti se ne pojavi Advanced Boot Options.
Klikni na Repair your computer
Izaberi US kao jezik za podesavanje jezika za tastaturu i klikni na Next.
Izaberi tvoj Operativni System i klikni na Next.
Ukoliko imas dva ili vise instalirana operativna sistema,izaberi onaj koji sada radimo.
Izaberi svoj user account i klikni na Next.

U System Recovery Options meniju imaces sledece opcije:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Izaberi Command Prompt. Ukucaj "notepad" ( bez navodnika ) i pritisni Enter.
Kada se startuje notepad klikni na File pa klikni na Open.
Izaberi "Computer" da bi video koje je slovo dodeljeno tvom flash uredjaju.
Obicno je to slovo "e:" ali to nije uvek slucaj.
Upamti koje je slovo dodeljeno flash uredjaju i zatvori notepad.
U Command Prompt ukucaj sledece:
Za 32bit-ni ( x86 )Windows:

Code:
e:\frst.exe

Za 64bit-ni Windows ukucaj:

Code:
e:\frst64

Napomena: Umesto slova e upisi slovo od tvog flash uredjaja.

FRST ce se pokrenuti.
U prozoru koji se otvori klikni na Yes i a potom klikni na Scan dugme.

Po zavrsetku skeniranja, program ce kreirati log ( FRST.txt ) koji ce se nalaziti na tvom flash uredjaju.

Kopiraj sadrzaj tog loga uz poruku.

[ paterson @ 08.07.2012. 13:48 ] @

Citat:

kristi1:Kopiraj sadrzaj tog loga uz poruku.

Srećom, nisam zaboravio naredbe MS-DOS-a operativnog sistema koji sam koristio devedesetih godina prošlog veka i gde sam se dobro snalazio

Citat:

Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 07-07-2012 03
Ran by SYSTEM at 08-07-2012 14:39:27
Running from F:\FARBAR RECOVER
Windows 7 Ultimate (X86) OS Language: English(US)
The current controlset is ControlSet002

========================== Registry (Whitelisted) =============

HKLM\...\Run: [Di dictionary] "C:\Program Files\Di recnik\Di.exe" [518656 2007-03-16] (Antivari Software Design, s.a.)
HKLM\...\Run: [DATAMNGR] C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE [1694608 2012-03-06] (Bandoo Media, inc)
HKLM\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462408 2012-04-04] (Malwarebytes Corporation)
HKU\Zoran\...\Run: [ShowBatteryBar] "C:\Program Files\BatteryBar\ShowBatteryBar.exe" show [90624 2009-05-28] ()
HKU\Zoran\...\Run: [Google Update] "C:\Users\Zoran\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-01-02] (Google Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
AppInit_DLLs: C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll

================================ Services (Whitelisted) ==================

2 Battery Optimizer; "C:\Program Files\ReviverSoft\Battery Optimizer\BatteryOptimizerService.exe" [103296 2010-09-14] ()
2 BlueBirdservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe [408920 2010-12-22] (IObit)
2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [654408 2012-04-04] (Malwarebytes Corporation)
2 MDM; "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [322120 2003-06-19] (Microsoft Corporation)
2 NitroReaderDriverReadSpool; "C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe" [196912 2010-12-03] (Nitro PDF Software)
2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2253120 2011-10-15] (NVIDIA Corporation)
3 ose; "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [89136 2003-07-28] (Microsoft Corporation)
2 SkypeUpdate; "C:\Program Files\Skype\Updater\Updater.exe" [160944 2012-06-07] (Skype Technologies)

========================== Drivers (Whitelisted) =============

3 AgereSoftModem; C:\Windows\System32\DRIVERS\AGRSM.sys [1035776 2009-07-13] (LSI Corp)
3 FileMonitor; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\FileMonitor.sys [36280 2010-12-24] (IObit.com)
3 k57nd60x; C:\Windows\System32\DRIVERS\k57nd60x.sys [229888 2009-07-13] (Broadcom Corporation)
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [22344 2012-04-04] (Malwarebytes Corporation)
3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2010-12-30] (Padus, Inc.)
3 RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\RegFilter.sys [41424 2010-12-24] (IObit.com)
1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
3 TrojanKillerDriver; C:\Windows\System32\DRIVERS\gtkdrv.sys [16128 2012-01-04] (Windows (R) Win 7 DDK provider)
3 UrlFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [24432 2010-12-24] (IObit.com)

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-07-08 04:03 - 2012-07-08 14:39 - 00000000 ____D C:\FRST
2012-07-08 03:44 - 2012-07-08 03:44 - 00088770 ____A C:\Users\Zoran\Desktop\OTL.Txt
2012-07-08 03:44 - 2012-07-08 03:44 - 00037142 ____A C:\Users\Zoran\Desktop\Extras.Txt
2012-07-08 03:39 - 2012-07-08 03:39 - 00595968 ____A (OldTimer Tools) C:\Users\Zoran\Desktop\OTL.exe
2012-07-08 01:07 - 2012-07-08 01:07 - 00001137 ____A C:\Users\Zoran\Desktop\RKreport[4].txt
2012-07-08 01:04 - 2012-07-08 01:04 - 00001123 ____A C:\Users\Zoran\Desktop\RKreport[3].txt
2012-07-08 01:01 - 2012-07-08 01:01 - 00002403 ____A C:\Users\Zoran\Desktop\RKreport[2].txt
2012-07-08 00:57 - 2012-07-08 00:57 - 00002109 ____A C:\Users\Zoran\Desktop\RKreport[1].txt
2012-07-08 00:56 - 2012-07-08 01:01 - 00000000 ____D C:\Users\Zoran\Desktop\RK_Quarantine
2012-07-07 21:20 - 2012-07-08 00:47 - 00000958 ____A C:\Windows\PFRO.log
2012-07-07 15:00 - 2012-07-08 04:19 - 00000448 ____A C:\Windows\setupact.log
2012-07-07 15:00 - 2012-07-07 15:00 - 00000000 ____A C:\Windows\setuperr.log
2012-07-07 08:58 - 2012-07-07 08:58 - 00000000 ____D C:\CCE_Quarantine
2012-06-30 12:20 - 2012-06-30 12:20 - 00002963 ____A C:\Users\Zoran\Desktop\HiJackThis.lnk
2012-06-30 12:20 - 2012-06-30 12:20 - 00000000 ____D C:\Program Files\Trend Micro
2012-06-29 22:50 - 2012-06-29 23:24 - 00000000 ____D C:\Program Files\GridinSoft Trojan Killer
2012-06-29 22:50 - 2012-06-29 22:50 - 00001097 ____A C:\Users\Public\Desktop\Trojan Killer.lnk
2012-06-29 10:21 - 2012-06-29 10:21 - 00000058 ____A C:\user.js
2012-06-25 03:59 - 2012-07-08 00:07 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-06-25 03:59 - 2012-07-08 00:07 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-06-25 03:59 - 2012-06-25 03:59 - 00000000 ____D C:\Users\Zoran\AppData\Roaming\Malwarebytes
2012-06-25 03:59 - 2012-06-25 03:59 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-06-25 03:59 - 2012-04-04 05:56 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-24 12:51 - 2012-06-24 12:51 - 00000000 ____D C:\Users\Zoran\AppData\Local\Macromedia
2012-06-24 03:26 - 2012-06-24 03:51 - 00000000 ____D C:\Users\All Users\F4D55F3B00019BD2000CEDBAA6014588
2012-06-20 18:51 - 2011-02-18 21:33 - 00802304 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2012-06-20 18:48 - 2012-06-02 14:19 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-20 18:48 - 2012-06-02 14:19 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-20 18:48 - 2012-06-02 14:19 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-20 18:48 - 2012-06-02 14:12 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-20 18:47 - 2012-06-02 14:19 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-20 18:47 - 2012-06-02 14:19 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-20 18:47 - 2012-06-02 14:12 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-20 18:47 - 2012-06-02 05:19 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-20 18:47 - 2012-06-02 05:12 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-15 23:07 - 2012-06-15 23:08 - 00002086 ____A C:\Users\Zoran\Desktop\Cišcenje RAM memorije.lnk
2012-06-14 20:18 - 2012-07-07 02:42 - 00000000 ____D C:\Users\Zoran\AppData\Roaming\3Skeng
2012-06-14 20:18 - 2012-06-14 20:18 - 00000000 ____D C:\Users\Zoran\AppData\Roaming\Google, Inc
2012-06-14 20:17 - 2012-06-14 20:17 - 00000000 ____D C:\Program Files\SHK
2012-06-14 20:17 - 2012-06-14 20:17 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
2012-06-13 14:41 - 2012-05-17 14:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-13 14:40 - 2012-05-17 15:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-13 14:40 - 2012-05-17 14:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-13 14:40 - 2012-05-17 14:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-13 14:40 - 2012-05-17 14:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-13 14:40 - 2012-05-17 14:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-13 14:40 - 2012-05-17 14:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-13 14:40 - 2012-05-17 14:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-13 14:40 - 2012-05-17 14:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-13 14:40 - 2012-05-17 14:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-13 14:40 - 2012-05-17 14:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-13 14:40 - 2012-05-17 14:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-13 14:40 - 2012-05-17 14:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-13 14:40 - 2012-05-17 14:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-13 09:25 - 2012-06-13 09:25 - 00001064 ____A C:\Users\Public\Desktop\Picasa 3.lnk
2012-06-13 07:20 - 2012-05-14 17:12 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-13 07:20 - 2012-05-01 20:52 - 00163328 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-13 07:20 - 2012-04-27 19:19 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-13 07:20 - 2012-04-25 20:48 - 00129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-13 07:20 - 2012-04-25 20:48 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-13 07:20 - 2012-04-25 20:43 - 00008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-13 07:20 - 2012-04-23 20:47 - 01156608 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-13 07:20 - 2012-04-23 20:47 - 00139264 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-13 07:20 - 2012-04-23 20:47 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-13 07:20 - 2012-04-07 03:34 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-10 03:11 - 2012-06-10 03:11 - 00000000 ____D C:\Users\Zoran\AppData\Roaming\GlarySoft
2012-06-10 03:07 - 2012-07-08 04:19 - 00000312 ____A C:\Windows\Tasks\GlaryInitialize.job
2012-06-10 03:07 - 2012-06-10 03:07 - 00000958 ____A C:\Users\Zoran\Desktop\Glary Utilities.lnk
2012-06-10 03:07 - 2012-06-10 03:07 - 00000000 ____D C:\Program Files\Glary Utilities
2012-06-10 00:19 - 2012-06-19 07:37 - 00000000 ____D C:\Users\Zoran\Desktop\SketchUp7pr
2012-06-10 00:17 - 2012-06-10 00:17 - 00000000 ____D C:\Users\Zoran\AppData\Roaming\NVIDIA
2012-06-10 00:16 - 2012-06-10 00:16 - 00003120 ____A C:\Windows\System32\ALLFSAF7a.ocx

============ 3 Months Modified Files ========================

2012-07-08 04:19 - 2012-07-07 15:00 - 00000448 ____A C:\Windows\setupact.log
2012-07-08 04:19 - 2012-06-10 03:07 - 00000312 ____A C:\Windows\Tasks\GlaryInitialize.job
2012-07-08 04:19 - 2011-01-02 04:20 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-07-08 04:19 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-08 04:19 - 2009-07-13 20:34 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-08 04:19 - 2009-07-13 20:34 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-08 03:46 - 2011-01-02 04:20 - 00000884 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-07-08 03:44 - 2012-07-08 03:44 - 00088770 ____A C:\Users\Zoran\Desktop\OTL.Txt
2012-07-08 03:44 - 2012-07-08 03:44 - 00037142 ____A C:\Users\Zoran\Desktop\Extras.Txt
2012-07-08 03:42 - 2011-02-05 03:34 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-434528519-369196584-1690971123-1000UA.job
2012-07-08 03:39 - 2012-07-08 03:39 - 00595968 ____A (OldTimer Tools) C:\Users\Zoran\Desktop\OTL.exe
2012-07-08 03:27 - 2012-04-18 23:59 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-08 01:07 - 2012-07-08 01:07 - 00001137 ____A C:\Users\Zoran\Desktop\RKreport[4].txt
2012-07-08 01:04 - 2012-07-08 01:04 - 00001123 ____A C:\Users\Zoran\Desktop\RKreport[3].txt
2012-07-08 01:01 - 2012-07-08 01:01 - 00002403 ____A C:\Users\Zoran\Desktop\RKreport[2].txt
2012-07-08 00:57 - 2012-07-08 00:57 - 00002109 ____A C:\Users\Zoran\Desktop\RKreport[1].txt
2012-07-08 00:47 - 2012-07-07 21:20 - 00000958 ____A C:\Windows\PFRO.log
2012-07-08 00:07 - 2012-06-25 03:59 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-07 15:00 - 2012-07-07 15:00 - 00000000 ____A C:\Windows\setuperr.log
2012-07-07 13:42 - 2011-02-05 03:34 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-434528519-369196584-1690971123-1000Core.job
2012-07-07 02:42 - 2010-12-30 08:10 - 00004348 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-04 00:53 - 2009-07-13 20:53 - 00032642 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-30 12:20 - 2012-06-30 12:20 - 00002963 ____A C:\Users\Zoran\Desktop\HiJackThis.lnk
2012-06-29 22:50 - 2012-06-29 22:50 - 00001097 ____A C:\Users\Public\Desktop\Trojan Killer.lnk
2012-06-29 10:21 - 2012-06-29 10:21 - 00000058 ____A C:\user.js
2012-06-29 10:21 - 2010-12-30 11:33 - 00000045 ____A C:\Windows\System32\initdebug.nfo
2012-06-25 07:05 - 2010-12-30 09:45 - 00000965 ____A C:\Users\Public\Desktop\CCleaner.lnk
2012-06-23 15:27 - 2012-04-18 23:59 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-06-23 15:27 - 2011-06-06 04:00 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-06-15 23:08 - 2012-06-15 23:07 - 00002086 ____A C:\Users\Zoran\Desktop\Cišcenje RAM memorije.lnk
2012-06-13 19:46 - 2009-07-13 20:33 - 00481352 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-13 09:25 - 2012-06-13 09:25 - 00001064 ____A C:\Users\Public\Desktop\Picasa 3.lnk
2012-06-10 03:07 - 2012-06-10 03:07 - 00000958 ____A C:\Users\Zoran\Desktop\Glary Utilities.lnk
2012-06-10 00:16 - 2012-06-10 00:16 - 00003120 ____A C:\Windows\System32\ALLFSAF7a.ocx
2012-06-04 15:39 - 2012-06-04 15:39 - 00001413 ____A C:\Users\Zoran\Desktop\Internet Explorer.lnk
2012-06-03 20:08 - 2009-07-13 18:04 - 00000499 ____A C:\Windows\win.ini
2012-06-03 19:42 - 2012-06-03 19:42 - 03695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2012-06-03 19:42 - 2012-06-03 19:42 - 00580608 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00434176 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00367104 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-06-03 19:42 - 2012-06-03 19:42 - 00353792 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00353584 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00227840 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00223232 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00203776 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00162304 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00161792 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00152064 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2012-06-03 19:42 - 2012-06-03 19:42 - 00150528 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2012-06-03 19:42 - 2012-06-03 19:42 - 00130560 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00123392 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00118784 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00110592 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00101888 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00086528 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00078848 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00076800 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2012-06-03 19:42 - 2012-06-03 19:42 - 00074752 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2012-06-03 19:42 - 2012-06-03 19:42 - 00074752 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00074240 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2012-06-03 19:42 - 2012-06-03 19:42 - 00066048 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00063488 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2012-06-03 19:42 - 2012-06-03 19:42 - 00054272 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00035840 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00031744 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00023552 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-06-03 19:42 - 2012-06-03 19:42 - 00011776 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2012-06-03 19:42 - 2012-06-03 19:42 - 00010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-06-03 11:16 - 2012-06-03 11:16 - 00409088 ____A (Microsoft Corporation) C:\Windows\System32\systemcpl.dll
2012-06-03 03:10 - 2012-06-03 03:10 - 00001156 ____A C:\Users\Zoran\Desktop\Format Factory.lnk
2012-06-02 14:19 - 2012-06-20 18:48 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-20 18:48 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-20 18:48 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-20 18:47 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-20 18:47 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:12 - 2012-06-20 18:48 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:12 - 2012-06-20 18:47 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 05:19 - 2012-06-20 18:47 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 05:12 - 2012-06-20 18:47 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-05-17 15:11 - 2012-06-13 14:40 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 14:48 - 2012-06-13 14:40 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 14:45 - 2012-06-13 14:40 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 14:36 - 2012-06-13 14:40 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 14:35 - 2012-06-13 14:40 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 14:35 - 2012-06-13 14:40 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 14:33 - 2012-06-13 14:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 14:31 - 2012-06-13 14:40 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 14:29 - 2012-06-13 14:40 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 14:29 - 2012-06-13 14:40 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 14:27 - 2012-06-13 14:40 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 14:25 - 2012-06-13 14:40 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 14:24 - 2012-06-13 14:41 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 14:20 - 2012-06-13 14:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-14 17:12 - 2012-06-13 07:20 - 02342400 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-01 20:52 - 2012-06-13 07:20 - 00163328 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-27 19:19 - 2012-06-13 07:20 - 00177152 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-25 20:48 - 2012-06-13 07:20 - 00129536 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 20:48 - 2012-06-13 07:20 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 20:43 - 2012-06-13 07:20 - 00008192 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-23 20:47 - 2012-06-13 07:20 - 01156608 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 20:47 - 2012-06-13 07:20 - 00139264 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 20:47 - 2012-06-13 07:20 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

ZeroAccess:
C:\Windows\Installer\{dc3e9c90-d6f8-25b5-3542-cb213f62d5a3}
C:\Windows\Installer\{dc3e9c90-d6f8-25b5-3542-cb213f62d5a3}\U

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe A302BBFF2A7278C0E239EE5D471D86A9 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 20%
Total physical RAM: 2042.84 MB
Available physical RAM: 1617.81 MB
Total Pagefile: 2042.84 MB
Available Pagefile: 1626.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1979.22 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:86.39 GB) (Free:59.39 GB) NTFS
3 Drive f: () (Removable) (Total:1.92 GB) (Free:0.04 GB) FAT
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (Podaci) (Fixed) (Total:146.49 GB) (Free:82.26 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 232 GB 6144 KB
Disk 1 Online 1968 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 0 Extended 86 GB 8032 KB
Partition 2 Logical 86 GB 8064 KB
Partition 1 Primary 146 GB 86 GB

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C NTFS Partition 86 GB Healthy

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 Y Podaci NTFS Partition 146 GB Healthy

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1967 MB 16 KB

==================================================================================

Disk: 1
Partition 1
Type : 0E
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT Removable 1967 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-06-28 00:18

======================= End Of Log ==========================

[ kristi1 @ 08.07.2012. 14:19 ] @

OK resicemo problem, nemoj da brines, samo pazljivo prati moja uputstva.

Ponovo pristupi System Recovery Options iz Advanced Boot Options i pokreni FRST
(sve isto kao i prvi put sa umetnutim USB-om)

U polje Search upisi:

services.exe

Klikni an dugme Search File(s) i okaci sadrzaj loga Search.txt koji ce FRST napraviti

[ paterson @ 08.07.2012. 14:38 ] @

Citat:

kristi1:... i okaci sadrzaj loga Search.txt koji ce FRST napraviti

Citat:

Farbar Recovery Scan Tool Version: 07-07-2012 03
Ran by SYSTEM at 2012-07-08 15:33:59
Running from F:\FARBAR RECOVER

================== Search: "services.exe" ===================

C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

C:\Windows\System32\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____N (Microsoft Corporation) A302BBFF2A7278C0E239EE5D471D86A9

=== End Of Search ===

[ kristi1 @ 08.07.2012. 14:55 ] @

Otvoriti Notepad i iskopirati sledeci tekst:

Code:

start
HKLM\...\Run: [DATAMNGR] C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE [1694608 2012-03-06] (Bandoo Media, inc)
AppInit_DLLs: C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll

SubSystems: [Windows] ==> ZeroAccess
ZeroAccess:
C:\Windows\Installer\{dc3e9c90-d6f8-25b5-3542-cb213f62d5a3}
C:\Windows\Installer\{dc3e9c90-d6f8-25b5-3542-cb213f62d5a3}\U

Unlock: C:\Windows\System32\services.exe
Replace: C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe c:\WINDOWS\system32\services.exe

cmd: bootrec /FixMbr
cmd: bootrec /fixBoot
Control:
end

Sacuvaj fajl na flash drive kao fixlist.txt

Ponovo startuj System Recovery Options prateci isti postupak bas kao i prosli put.
Pokreni FRST i klikni na dugme Fix i pricekaj da program zavrsi.
Alat ce kreirati log na flash drive memorijskom uredjaju pod nazivom Fixlog.txt.
Restartuj racunar.
Kopiraj sadrzaj tog loga uz poruku.

[ paterson @ 08.07.2012. 15:30 ] @

Citat:

kristi1:..... pod nazivom Fixlog.txt.
...........Kopiraj sadrzaj tog loga uz poruku.

Citat:

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 07-07-2012 03
Ran by SYSTEM at 2012-07-08 16:24:21 Run:1
Running from F:\FARBAR RECOVER

==============================================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ DATAMNGR Value not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs Value was restored successfully .
HKEY_LOCAL_MACHINE\System\ControlSet002\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
Could not find c:\WINDOWS\system32\services.exe.
Could not find C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe.

========= bootrec /FixMbr =========

ÿþT h e o p e r a t i o n c o m p l e t e d s u c c e s s f u l l y .

========= End of CMD: =========

========= bootrec /fixBoot =========

ÿþT h e o p e r a t i o n c o m p l e t e d s u c c e s s f u l l y .

========= End of CMD: =========

==== End of Fixlog ====

[ kristi1 @ 08.07.2012. 15:41 ] @

Mozes li da udjes u Normal Mode.

Nesto nije dobro odradjeno, jesi kopirao komletnu skriptu, bez onog gore "Code"

Nisi valjda kopirao "Code"

[ paterson @ 08.07.2012. 15:45 ] @

Citat:

kristi1:Nesto nije dobro odradjeno, jesi kopirao komletnu skriptu, bez onog gore "Code"

Nisi valjda kopirao "Code"

Nisam, kopirao sam bez onog gore "Code".

[ kristi1 @ 08.07.2012. 15:47 ] @

Mozes li da udjes u Normal Mode.

[ paterson @ 08.07.2012. 15:48 ] @

Već sam u NORMAL MODE.

Skoro sve sam radio u NORMAL MODE.

[ kristi1 @ 08.07.2012. 15:52 ] @

OK

Moracu da proverim sa jos jednim alatom.

Preuzmi ComboFix sa sledece adrese na Desktop:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Iskljuci AV

Pokreni Combofix iskljucivo sa desktopa (I Agree)

Kad zavrsi skeniranje izbacice ti log na desktop

Kopiraj mi log ovde

[ sad_ste_face_jel @ 08.07.2012. 22:53 ] @

Gorane mogao si malo bolji razlog da nadjes od onog sredjivanje teme sto si mi obrisao poruku :"Ma sto ti lepo prijatelju ne sacuvas podatke na drugoj particiji i lepo instaliraj nanovo sistem.Posle toga instaliraj Kaspersky KIS (skines ga na njihovom sajtu i imas mesec dana besplatno)"
Ja nigde nisam naveo nikakvu pirateriju vec da ode na kaspersky sajt i tamo skine program a kasnije aktivira probnu verziju od 30 dana.I zasto je moja poruka predstavljala problem?
To sto se on muci da ocisti racunar od toga nema nista jer ce duplo manje vremena potrositi ako nanovo instalira sistem i na tako svez sistem instalira av i skenira.
A sto se tice ComboFix -a to je dobar program ali ne mora znaciti da ce on resiti stvar maltene samo odlazes neodlozno.

[ Goran Mijailovic @ 08.07.2012. 23:22 ] @

Pa mogao sam al takav je jedan od ponuđenih predefinisanih odgovora. Zar zaista misliš da je rešenje svaki čas preinstalirati Windows? Nikakvu pirateriju nisam ti ni prebacio.

[ sad_ste_face_jel @ 09.07.2012. 00:33 ] @

Pa dobro videce i sam da ce morati da reinstalira sistem evo i ja vec godinu dana koristim win 7 ali red je da ga reinstaliram.Reinstalacija sistema je veoma lak posao samo je malo muka ako ima mnogo vaznih podataka.A cim je on imao problem sa podizanjem sistema to mu je maltene kraj.Naravno ne mora znaciti da se ne moze popraviti ali kad su virusi u pitanju tu je najbolje reinstalirati sistem i ubaciti pravi av koji radi svoj posao.

[ kristi1 @ 09.07.2012. 07:30 ] @

Nema potrebe da reinstalira Windows. Nesto nije uradio kako treba kod prve skripte, najverovatnije los copy/paste, jer se to vidi iz izvestaja.

Ovde je bilo potrebno samo zameniti inficirani services.exe sa zdravom kopijom, a to je Combofix odradio automatski.
Prema tome ovaj slucaj je resen.

Radilo se o ovoj infekciji koga zanima.
https://www.virustotal.com/fil...eb4f4850ae842424a602/analysis/