Skenirao sam racunar sa Malwarebytes Anti-Malware i on je nasao neki update notification virus koji je izbrisao ali kad ponovo pokrenem sistem i skeniram opet ga nadje, nije ga izbrisao.

Isti slucaj i sa SUPERAntiSpyware Professional, obrise ga, posle ponovnog pokretanja sistema opet ga nadje kad skeniram.


Kako da trajno izbrisem ovaj trojanac?

Evo hijackthis loga:

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 00:47:19, on 02.08.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

FIREFOX: 22.0 (en-US)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\AVG\AVG2013\avgui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\AVG\AVG2013\avgfws.exe
C:\Program Files\AVG\AVG2013\avgidsagent.exe
C:\Program Files\AVG\AVG2013\avgwdsvc.exe
C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\AVG\AVG2013\avgnsx.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\AVG\AVG2013\avgemcx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\AVG\AVG2013\avgcsrvx.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
D:\Programi\CC Cleaner pro 7\utorrent.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
D:\Programi\Steam\steam.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Djole\Desktop\HijackThis 56.exe

O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [VMonitorVMUVC] "C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe" VMUVC
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Movie_Edit_Pro_17_Plus_Download_Version\TrayServer_en.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

--
End of file - 8332 bytes

Posalji Malwarebytes log da vidim.



Preuzmi FRST   -  (Farbar Recovery Scan Tool) i sacuvaj ga na Desktop

Napomena: Potrebno je preuzeti onu verziju koja je kompatibilna sa tvojim sistemom.
 

• Dvoklikom pokreni FRST;
  
• Kada se alat startuje, klikni Yes na disclaimer.
  
• Klikni na dugme Scan;
  
• Alat ce kreirati izvestaj (FRST.txt) u isti direktorijum gde je i FRST.exe sacuvan.
  
• Iskopiraj sadrzaj tog loga u poruku.
  
• Alat bi takodje pri prvom pokretanju trebao da kreira i dodatni izvestaj (Addition.txt). Taj izvestaj okaci u poruku koristeci opciju "Prikaci file".

evo Malwarebytes  loga:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.08.02.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Djole :: COMPUTER_0313 [administrator]

Protection: Disabled

02.08.2013 14:17:34
mbam-log-2013-08-02 (14-17-34).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 327143
Time elapsed: 1 hour(s), 1 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Security Center|UPDATESDISABLENOTIFY (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Evo frst loga:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-08-2013 01
Ran by Djole (administrator) on 02-08-2013 15:28:53
Running from C:\Documents and Settings\Djole\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 6
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2013\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(cyberlink) C:\Program Files\Cyberlink\Shared Files\brs.exe
(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
(Vimicro Corporation) C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgemcx.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(BitTorrent Inc.) D:\Programi\CC Cleaner pro 7\utorrent.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcsrvx.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BDRegion] - C:\Program Files\Cyberlink\Shared Files\brs.exe [91432 2007-11-16] (cyberlink)
HKLM\...\Run: [RemoteControl] - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [72736 2007-10-28] (Cyberlink Corp.)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [62760 2007-10-11] ()
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [3147384 2012-12-11] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [SoundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [868352 2006-12-18] (Analog Devices, Inc.)
HKLM\...\Run: [SoundMAX] - C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [729088 2006-07-13] (Analog Devices, Inc.)
HKLM\...\Run: [VMonitorVMUVC] - C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe [135168 2007-12-20] (Vimicro Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2011-04-19] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM\...\Run: [TrayServer] - C:\Program Files\MAGIX\Movie_Edit_Pro_17_Plus_Download_Version\TrayServer_en.exe [90112 2008-11-13] (MAGIX AG)
Winlogon\Notify\AtiExtEvent: Ati2evxx.dll (ATI Technologies Inc.)
HKCU\...\Run: [MSMSGS] - C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL (Microsoft Corporation)
Handler: ipp - No CLSID Value -
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: msdaipp - No CLSID Value -
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [115440 2013-05-08] (SuperAdBlocker.com)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Djole\Application Data\Mozilla\Firefox\Profiles\ulv8ciwd.default
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: DownloadHelper - C:\Documents and Settings\Djole\Application Data\Mozilla\Firefox\Profiles\ulv8ciwd.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Documents and Settings\Djole\Application Data\Mozilla\Firefox\Profiles\ulv8ciwd.default\Extensions\{ea2b95c2-9be8-48ed-bdd1-5fcd2ad0ff99}.xpi
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

Chrome:
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Documents and Settings\Djole\Local Settings\Application Data\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\WINDOWS\system32\Adobe\Director\np32dsw_1202122.dll No File
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Extension: (Google Docs) - C:\DOCUME~1\Djole\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\DOCUME~1\Djole\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\DOCUME~1\Djole\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\DOCUME~1\Djole\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\DOCUME~1\Djole\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Documents and Settings\Djole\Local Settings\Application Data\CRE\cflheckfmhopnialghigdlggahiomebp.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [119024 2013-05-08] (SUPERAntiSpyware.com)
R2 avgfws; C:\Program Files\AVG\AVG2013\avgfws.exe [1342024 2012-12-10] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [5814904 2012-11-15] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [254552 2012-09-11] ()
S4 HidServ; %SystemRoot%\System32\hidserv.dll

R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf"

==================== Drivers (Whitelisted) ====================

R3 ati2mtag; C:\Windows\System32\DRIVERS\ati2mtag.sys [6537728 2011-04-20] (ATI Technologies Inc.)
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdXP3.sys [101904 2010-11-17] (Advanced Micro Devices)
R3 Avgfwdx; C:\Windows\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)
S3 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [179936 2012-10-22] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [55776 2012-10-15] (AVG Technologies CZ, s.r.o. )
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [19936 2012-09-21] (AVG Technologies CZ, s.r.o. )
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [159712 2012-10-02] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [177376 2012-09-21] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [94048 2012-11-15] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [35552 2012-09-14] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [164832 2012-09-21] (AVG Technologies CZ, s.r.o.)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R3 RTLE8023xp; C:\Windows\System32\DRIVERS\Rtenicxp.sys [83200 2006-08-14] (Realtek Semiconductor Corporation                           )
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R3 SenFiltService; C:\Windows\System32\drivers\Senfilt.sys [392960 2006-03-17] (Sensaura)
S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-14] (Microsoft Corporation)
S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] (Microsoft Corporation)
R3 VMUVC; C:\Windows\System32\Drivers\VMUVC.sys [252928 2010-01-12] (Vimicro Corporation)
R3 vvftUVC; C:\Windows\System32\drivers\vvftUVC.sys [398720 2008-07-01] (Vimicro Corporation)
S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] (Microsoft Corporation)
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B}; C:\Program Files\CyberLink\PowerDVD\000.fcl [41456 2007-11-03] (Cyberlink Corp.)
S4 IntelIde; No ImagePath
U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-02 15:28 - 2013-08-02 15:28 - 00000000 ____D C:\FRST
2013-08-02 15:27 - 2013-08-02 15:27 - 01222124 _____ (Farbar) C:\Documents and Settings\Djole\Desktop\FRST.exe
2013-08-02 15:25 - 2013-08-02 15:25 - 00000000 ____D C:\Documents and Settings\Djole\Start Menu\Programs\CyberLink PowerDVD
2013-08-01 12:50 - 2013-08-01 12:50 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-08-01 12:50 - 2013-08-01 12:50 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\SUPERAntiSpyware.com
2013-08-01 12:50 - 2013-08-01 12:50 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2013-07-31 18:46 - 2013-07-31 18:46 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-31 18:46 - 2013-07-31 18:46 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Malwarebytes
2013-07-31 18:46 - 2013-07-31 18:46 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-07-31 18:46 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-07-26 21:40 - 2013-07-26 21:40 - 00000982 _____ C:\WINDOWS\wininit.ini
2013-07-26 21:16 - 2013-07-26 21:16 - 00000933 _____ C:\Documents and Settings\Djole\Desktop\Spybot - Search & Destroy.lnk
2013-07-26 21:15 - 2013-07-26 23:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2013-07-26 21:15 - 2013-07-26 21:17 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-22 23:09 - 2013-07-22 23:09 - 00000000 ____D C:\bd1753b62b28c2cbb05745ac6393
2013-07-22 23:09 - 2013-07-22 23:09 - 00000000 ____D C:\a5fa3e0a84f7c8e96c77d4049bdb
2013-07-22 19:58 - 2013-07-22 19:58 - 00000872 _____ C:\Documents and Settings\All Users\Desktop\MAGIX Movie Edit Pro 17 Plus Download Version.lnk
2013-07-22 19:56 - 2013-07-22 19:56 - 00000000 ____D C:\Program Files\MAGIX
2013-07-22 19:55 - 2013-07-22 19:55 - 00000000 ____D C:\Program Files\Common Files\MAGIX Services
2013-07-22 19:52 - 2013-07-22 19:52 - 00003832 _____ C:\WINDOWS\updspapi.log
2013-07-22 19:51 - 2007-11-30 14:39 - 00017272 ____N (Microsoft Corporation) C:\WINDOWS\system32\spmsg.dll
2013-07-15 23:00 - 2013-07-23 14:11 - 00002973 _____ C:\WINDOWS\spupdsvc.log
2013-07-15 17:31 - 2013-07-15 17:31 - 00000206 _____ C:\Documents and Settings\Djole\My Documents\sifra.txt
2013-07-15 17:23 - 2013-07-15 18:22 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\Corel VideoStudio Pro
2013-07-15 17:23 - 2013-07-15 17:24 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Ulead Systems
2013-07-15 17:23 - 2013-07-15 17:23 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Corel
2013-07-15 17:23 - 2013-07-15 17:23 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Protexis
2013-07-15 17:22 - 2013-07-15 17:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallWMFDist11$
2013-07-15 17:22 - 2006-10-18 21:47 - 00276992 ____N (Microsoft Corporation) C:\WINDOWS\system32\audiodev.dll
2013-07-15 17:21 - 2013-07-15 17:22 - 00027491 _____ C:\WINDOWS\WMFDist11.log
2013-07-15 17:21 - 2013-07-15 17:21 - 00014603 _____ C:\WINDOWS\Wudf01000Inst.log
2013-07-15 17:21 - 2013-07-15 17:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallWudf01000$
2013-07-15 17:21 - 2013-07-15 17:21 - 00000000 ____D C:\WINDOWS\system32\LogFiles
2013-07-15 17:20 - 2013-07-15 17:21 - 00000000 ___HD C:\WINDOWS\msdownld.tmp
2013-07-15 17:20 - 2013-07-15 17:20 - 00000000 ____D C:\WINDOWS\system32\windows media
2013-07-15 17:19 - 2013-07-15 17:19 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\InterVideo
2013-07-15 17:15 - 2013-07-15 17:15 - 00000000 ____D C:\Program Files\Common Files\Protexis
2013-07-15 17:14 - 2013-07-15 17:15 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Corel
2013-07-15 17:14 - 2013-07-15 17:14 - 00000775 _____ C:\Documents and Settings\All Users\Desktop\Corel VideoStudio Pro X6.lnk
2013-07-15 17:05 - 2013-07-15 17:11 - 00000000 ____D C:\Program Files\Corel
2013-07-15 15:15 - 2013-07-15 15:15 - 00094208 _____ C:\WINDOWS\Minidump\Mini071513-01.dmp
2013-07-15 14:20 - 2013-07-15 14:20 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Apple Computer
2013-07-15 03:11 - 2013-07-15 03:11 - 00109562 _____ C:\Documents and Settings\Djole\My Documents\nn.pds
2013-07-15 02:32 - 2013-07-15 02:32 - 00000000 ____D C:\Documents and Settings\All Users\CyberLink
2013-07-15 02:30 - 2013-07-15 17:22 - 00000000 ____D C:\Program Files\SmartSound Software
2013-07-15 02:30 - 2013-07-15 17:22 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2013-07-15 02:29 - 2013-07-15 02:30 - 00000000 ____D C:\Program Files\QuickTime
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Apple
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Apple Computer
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Apple
2013-07-15 02:28 - 2013-07-15 02:28 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Apple Computer
2013-07-15 02:26 - 2013-07-15 02:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\install_clap
2013-07-10 23:45 - 2013-07-10 23:45 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Chromium
2013-07-10 23:37 - 2013-07-10 23:37 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\CPY_SAVES
2013-07-10 23:35 - 2013-07-10 23:35 - 00000868 _____ C:\Documents and Settings\All Users\Desktop\Football Manager 2013.lnk
2013-07-07 00:50 - 2013-07-07 17:46 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-06 21:16 - 2013-07-06 21:16 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Ubisoft Game Launcher
2013-07-05 00:45 - 2013-07-05 00:45 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\My Streaming Media

==================== One Month Modified Files and Folders =======

2013-08-02 15:28 - 2013-08-02 15:28 - 00000000 ____D C:\FRST
2013-08-02 15:28 - 2013-03-21 21:04 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\uTorrent
2013-08-02 15:27 - 2013-08-02 15:27 - 01222124 _____ (Farbar) C:\Documents and Settings\Djole\Desktop\FRST.exe
2013-08-02 15:25 - 2013-08-02 15:25 - 00000000 ____D C:\Documents and Settings\Djole\Start Menu\Programs\CyberLink PowerDVD
2013-08-02 15:25 - 2013-06-17 19:34 - 00000880 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-02 15:25 - 2013-03-20 19:17 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-08-02 15:25 - 2013-03-20 19:17 - 00000048 _____ C:\WINDOWS\wiaservc.log
2013-08-02 15:25 - 2013-03-20 18:26 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-08-02 15:25 - 2013-03-20 18:22 - 00327526 _____ C:\WINDOWS\WindowsUpdate.log
2013-08-02 14:52 - 2013-03-20 19:24 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
2013-08-02 14:50 - 2013-06-17 19:34 - 00000884 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-02 14:09 - 2001-08-23 13:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2013-08-02 03:01 - 2013-03-20 18:55 - 00065536 _____ C:\WINDOWS\system32\config\ACEEvent.evt
2013-08-02 03:01 - 2013-03-20 18:26 - 00032434 _____ C:\WINDOWS\SchedLgU.Txt
2013-08-02 03:01 - 2013-03-20 18:26 - 00000178 ___SH C:\Documents and Settings\Djole\ntuser.ini
2013-08-02 00:53 - 2013-03-20 19:21 - 00000000 ___RD C:\Documents and Settings\Djole\Desktop\Ostali programi i igrice
2013-08-01 12:50 - 2013-08-01 12:50 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-08-01 12:50 - 2013-08-01 12:50 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\SUPERAntiSpyware.com
2013-08-01 12:50 - 2013-08-01 12:50 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2013-08-01 02:00 - 2013-03-20 19:12 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\vlc
2013-07-31 20:37 - 2013-03-21 20:15 - 00002265 _____ C:\Documents and Settings\All Users\Desktop\Skype.lnk
2013-07-31 20:37 - 2013-03-20 18:47 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Skype
2013-07-31 19:56 - 2013-03-20 19:11 - 00000000 ____D C:\WINDOWS\Driver Cache
2013-07-31 19:55 - 2013-06-17 19:36 - 00001813 _____ C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
2013-07-31 19:23 - 2013-03-20 18:21 - 00000000 ____D C:\WINDOWS\system32\Restore
2013-07-31 18:46 - 2013-07-31 18:46 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-07-31 18:46 - 2013-07-31 18:46 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Malwarebytes
2013-07-31 18:46 - 2013-07-31 18:46 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-07-31 15:52 - 2013-03-20 19:26 - 00000702 _____ C:\Documents and Settings\All Users\Desktop\AVG 2013.lnk
2013-07-31 15:52 - 2013-03-20 19:14 - 00724109 _____ C:\WINDOWS\setupapi.log
2013-07-30 03:59 - 2013-03-20 18:26 - 00000000 ____D C:\Documents and Settings\Djole
2013-07-26 23:01 - 2013-07-26 21:15 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2013-07-26 21:40 - 2013-07-26 21:40 - 00000982 _____ C:\WINDOWS\wininit.ini
2013-07-26 21:33 - 2013-03-20 19:35 - 00000036 _____ C:\WINDOWS\avgui.INI
2013-07-26 21:17 - 2013-07-26 21:15 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-07-26 21:16 - 2013-07-26 21:16 - 00000933 _____ C:\Documents and Settings\Djole\Desktop\Spybot - Search & Destroy.lnk
2013-07-23 14:11 - 2013-07-15 23:00 - 00002973 _____ C:\WINDOWS\spupdsvc.log
2013-07-23 14:11 - 2013-03-20 18:27 - 00136504 _____ C:\Documents and Settings\Djole\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-07-23 14:10 - 2013-03-20 19:14 - 00425408 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-07-22 23:09 - 2013-07-22 23:09 - 00000000 ____D C:\bd1753b62b28c2cbb05745ac6393
2013-07-22 23:09 - 2013-07-22 23:09 - 00000000 ____D C:\a5fa3e0a84f7c8e96c77d4049bdb
2013-07-22 22:13 - 2013-03-20 18:35 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-07-22 20:02 - 2013-03-20 20:29 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\MAGIX
2013-07-22 19:58 - 2013-07-22 19:58 - 00000872 _____ C:\Documents and Settings\All Users\Desktop\MAGIX Movie Edit Pro 17 Plus Download Version.lnk
2013-07-22 19:58 - 2013-03-20 20:57 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\MAGIX
2013-07-22 19:58 - 2013-03-20 20:55 - 00000000 ____D C:\Program Files\Common Files\MAGIX Shared
2013-07-22 19:56 - 2013-07-22 19:56 - 00000000 ____D C:\Program Files\MAGIX
2013-07-22 19:56 - 2013-03-20 20:52 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\MAGIX
2013-07-22 19:55 - 2013-07-22 19:55 - 00000000 ____D C:\Program Files\Common Files\MAGIX Services
2013-07-22 19:52 - 2013-07-22 19:52 - 00003832 _____ C:\WINDOWS\updspapi.log
2013-07-22 19:52 - 2013-03-20 18:51 - 00000000 ____D C:\WINDOWS\system32\XPSViewer
2013-07-22 19:50 - 2013-03-20 19:15 - 00492798 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-07-18 23:28 - 2013-03-20 18:40 - 00002577 _____ C:\Documents and Settings\All Users\Desktop\ACDSee Pro 3.lnk
2013-07-15 18:30 - 2013-03-20 19:00 - 00000000 ____D C:\Program Files\CyberLink
2013-07-15 18:22 - 2013-07-15 17:23 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\Corel VideoStudio Pro
2013-07-15 17:31 - 2013-07-15 17:31 - 00000206 _____ C:\Documents and Settings\Djole\My Documents\sifra.txt
2013-07-15 17:24 - 2013-07-15 17:23 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Ulead Systems
2013-07-15 17:23 - 2013-07-15 17:23 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Corel
2013-07-15 17:23 - 2013-07-15 17:23 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Protexis
2013-07-15 17:22 - 2013-07-15 17:22 - 00000000 __HDC C:\WINDOWS\$NtUninstallWMFDist11$
2013-07-15 17:22 - 2013-07-15 17:21 - 00027491 _____ C:\WINDOWS\WMFDist11.log
2013-07-15 17:22 - 2013-07-15 02:30 - 00000000 ____D C:\Program Files\SmartSound Software
2013-07-15 17:22 - 2013-07-15 02:30 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2013-07-15 17:22 - 2013-03-20 19:15 - 00069602 _____ C:\WINDOWS\iis6.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00030117 _____ C:\WINDOWS\FaxSetup.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00024907 _____ C:\WINDOWS\ocgen.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00022090 _____ C:\WINDOWS\comsetup.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00019329 _____ C:\WINDOWS\tsoc.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00016150 _____ C:\WINDOWS\msmqinst.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00011678 _____ C:\WINDOWS\ntdtcsetup.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00006039 _____ C:\WINDOWS\netfxocm.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00002762 _____ C:\WINDOWS\MedCtrOC.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00002185 _____ C:\WINDOWS\tabletoc.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00001911 _____ C:\WINDOWS\ocmsn.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00001798 _____ C:\WINDOWS\msgsocm.log
2013-07-15 17:22 - 2013-03-20 19:15 - 00001374 _____ C:\WINDOWS\imsins.log
2013-07-15 17:22 - 2013-03-20 18:29 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-07-15 17:22 - 2013-03-20 18:22 - 00000000 __SHD C:\Documents and Settings\All Users\DRM
2013-07-15 17:22 - 2013-03-20 18:20 - 00064134 _____ C:\WINDOWS\wmsetup.log
2013-07-15 17:21 - 2013-07-15 17:21 - 00014603 _____ C:\WINDOWS\Wudf01000Inst.log
2013-07-15 17:21 - 2013-07-15 17:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallWudf01000$
2013-07-15 17:21 - 2013-07-15 17:21 - 00000000 ____D C:\WINDOWS\system32\LogFiles
2013-07-15 17:21 - 2013-07-15 17:20 - 00000000 ___HD C:\WINDOWS\msdownld.tmp
2013-07-15 17:21 - 2013-03-20 19:15 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-07-15 17:20 - 2013-07-15 17:20 - 00000000 ____D C:\WINDOWS\system32\windows media
2013-07-15 17:20 - 2013-03-20 18:23 - 00316640 _____ C:\WINDOWS\WMSysPr9.prx
2013-07-15 17:19 - 2013-07-15 17:19 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\InterVideo
2013-07-15 17:15 - 2013-07-15 17:15 - 00000000 ____D C:\Program Files\Common Files\Protexis
2013-07-15 17:15 - 2013-07-15 17:14 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Corel
2013-07-15 17:14 - 2013-07-15 17:14 - 00000775 _____ C:\Documents and Settings\All Users\Desktop\Corel VideoStudio Pro X6.lnk
2013-07-15 17:11 - 2013-07-15 17:05 - 00000000 ____D C:\Program Files\Corel
2013-07-15 17:11 - 2013-03-20 18:22 - 00000000 ____D C:\WINDOWS\system32\DirectX
2013-07-15 15:15 - 2013-07-15 15:15 - 00094208 _____ C:\WINDOWS\Minidump\Mini071513-01.dmp
2013-07-15 15:15 - 2013-04-13 17:45 - 00000000 ____D C:\WINDOWS\Minidump
2013-07-15 14:20 - 2013-07-15 14:20 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Apple Computer
2013-07-15 03:11 - 2013-07-15 03:11 - 00109562 _____ C:\Documents and Settings\Djole\My Documents\nn.pds
2013-07-15 02:45 - 2013-03-20 19:00 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\CyberLink
2013-07-15 02:32 - 2013-07-15 02:32 - 00000000 ____D C:\Documents and Settings\All Users\CyberLink
2013-07-15 02:31 - 2013-03-20 19:01 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\CyberLink
2013-07-15 02:30 - 2013-07-15 02:29 - 00000000 ____D C:\Program Files\QuickTime
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Program Files\Apple Software Update
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Apple
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Apple Computer
2013-07-15 02:29 - 2013-07-15 02:29 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Apple
2013-07-15 02:28 - 2013-07-15 02:28 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Apple Computer
2013-07-15 02:26 - 2013-07-15 02:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\install_clap
2013-07-14 14:21 - 2013-03-21 15:26 - 00692104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-07-14 14:21 - 2013-03-21 15:26 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-07-14 14:21 - 2013-03-20 19:01 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Adobe
2013-07-14 00:42 - 2013-03-20 19:20 - 00011264 _____ C:\Documents and Settings\Djole\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-07-10 23:45 - 2013-07-10 23:45 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Chromium
2013-07-10 23:37 - 2013-07-10 23:37 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\CPY_SAVES
2013-07-10 23:37 - 2013-05-20 15:49 - 00000000 ____D C:\Documents and Settings\Djole\Application Data\Sports Interactive
2013-07-10 23:35 - 2013-07-10 23:35 - 00000868 _____ C:\Documents and Settings\All Users\Desktop\Football Manager 2013.lnk
2013-07-07 17:51 - 2013-03-20 20:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-07 17:46 - 2013-07-07 00:50 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-06 21:16 - 2013-07-06 21:16 - 00000000 ____D C:\Documents and Settings\Djole\Local Settings\Application Data\Ubisoft Game Launcher
2013-07-06 20:12 - 2013-03-21 20:15 - 00000000 ___RD C:\Program Files\Skype
2013-07-06 20:12 - 2013-03-21 20:14 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Skype
2013-07-05 01:27 - 2013-03-20 18:26 - 00000000 __SHD C:\Documents and Settings\LocalService
2013-07-05 01:27 - 2013-03-20 18:25 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-07-05 01:27 - 2013-03-20 18:20 - 00000000 ____D C:\WINDOWS\Registration
2013-07-05 00:45 - 2013-07-05 00:45 - 00000000 ____D C:\Documents and Settings\Djole\My Documents\My Streaming Media

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2008-04-14 06:42] - [2008-04-14 06:42] - 0108544 ____A (Microsoft Corporation) 0e776ed5f7cc9f94299e70461b7b8185

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================




i Addition.txt

Fajlovi prikačeni uz poruku (kliknite na slike za punu veličinu)

Addition.txt (10.98 KB)

Iskljucen ti je Firewall pa te Malwarebytes pita da li si to sam iskljucio ili je neki malware, on to ne zna.

Nemas nikakav virus.

Nije mi iskljucen firewall, nego windows update sam iskljucio.

Ok, hvala.  Jos bolje je sto nije virus.