[SpeedRacer]

ComboFix 08-09-15.02 - Tom Stratman 2008-09-16 16:53:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.184 [GMT -5:00]
Running from: C: \ Documents and Settings \ Tom Stratman \ Desktop \ ComboFix.exe
* Created novu točku vraćanja

UPOZORENJE-ovaj stroj nema Recovery Console Installed!
.

Ostali ((((((((((((((((((((((((((((((((((((((( brisanja ))))))))) ))))))))))))))))))))))))))))))))))))))))
.

C: \ Documents and Settings \ Tom Stratman \ Application Data \ FNTS ~ 1
C: \ Documents and Settings \ Tom Stratman \ Application Data \ FNTS ~ 1 \ F? Nts \
C: \ Documents and Settings \ Tom Stratman \ Application Data \ SSTEM ~ 1
C: \ Temp \ 1cb
C: \ Temp \ 1cb \ syscheck.log
C: \ Temp \ fse
C: \ Temp \ fse \ tmpZTF.log
C: \ test.txt
C: \ WINDOWS \ system32 \ MSINET.oca
C: \ WINDOWS \ system32 \ rqtwa.bak1
C: \ WINDOWS \ system32 \ rqtwa.bak2
C: \ WINDOWS \ system32 \ rqtwa.ini
C: \ WINDOWS \ system32 \ wnstsiit32.exe
C: \ WINDOWS \ system32 \ wyadd.bak1
C: \ WINDOWS \ system32 \ wyadd.bak2
C: \ WINDOWS \ system32 \ wyadd.ini
C: \ WINDOWS \ system32 \ wyadd.ini2
C: \ WINDOWS \ system32 \ wyadd.tmp

.
((((((((((((((((((((((((((((((((((((((( Driveri / Usluge )))))))) )))))))))))))))))))))))))))))))))))))))))
.

------- \ Legacy_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2008/08/16 da 2008/09/16 ))))))))))) ))))))))))))))))))))
.

2008-09-16 06:36. 2008-09-16 06:36 <DIR> d -------- C: \ Program Files \ Trend Micro
2008-09-15 21:25. 2008-09-15 21:27 <DIR> d -------- C: \ Program Files \ Malwarebytes 'Anti-Malware
2008-09-15 21:25. 2008-09-15 21:25 <DIR> d -------- C: \ Documents and Settings \ Tom Stratman \ Application Data \ Malwarebytes
2008-09-15 21:25. 2008-09-15 21:25 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes
2008-09-15 21:25. 2008-09-10 00:04 38.528 - a ------ C: \ WINDOWS \ System32 \ Drivers \ mbamswissarmy.sys
2008-09-15 21:25. 2008-09-10 00:03 17.200 - a ------ C: \ WINDOWS \ System32 \ Drivers \ mbam.sys
2008-09-14 11:13. 2008-09-14 11:13 107.888 - a ------ C: \ WINDOWS \ system32 \ CmdLineExt.dll
2008-09-10 13:37. 2008-09-10 13:38 <DIR> d -------- C: \ Program Files \ iTunes
2008-09-10 13:37. 2008-09-10 13:38 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ (3276BE95_AF08_429F_A64F_CA64CB79BCF6)
2008-09-10 13:35. 2008-09-10 13:35 <DIR> d -------- C: \ Program Files \ Bonjour
2008-09-10 13:29. 2008-09-05 22:16 1.900.544 - a ------ C: \ WINDOWS \ system32 \ usbaaplrc.dll
2008-09-06 15:09. 2008-09-06 15:09 90.112 - a ------ C: \ WINDOWS \ system32 \ QuickTimeVR.qtx
2008-09-06 15:09. 2008-09-06 15:09 57.344 - a ------ C: \ WINDOWS \ system32 \ QuickTime.qts
2008-08-29 10:18. 2008-08-29 10:18 87.336 - a ------ C: \ WINDOWS \ system32 \ DNS-sd.exe
2008-08-29 09:53. 2008-08-29 09:53 61.440 - a ------ C: \ WINDOWS \ system32 \ dnssd.dll
2008-08-27 02:30. 2008-08-27 02:56 <DIR> d -------- C: \ WINDOWS \ system32 \ CatRoot_bak
2008-08-25 19:08. 2008-08-25 19:08 <DIR> d -------- C: \ Program Files \ AviSynth 2,5
2008-08-25 19:07. 2008-08-25 19:07 <DIR> d -------- C: \ Program Files \ Red Kawa

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))) ))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-16 21:40 --------- d ----- w C: \ Documents and Settings \ Tom Stratman \ Application Data \ uTorrent
2008-09-16 06:42 --------- d ----- w C: \ Documents and Settings \ All Users \ Application Data \ Google Updater
2008-09-15 20:53 --------- d - h - w C: \ Program Files \ InstallShield Installation Information
2008-09-15 20:53 --------- d ----- w C: \ Program Files \ Electronic Arts
2008-09-10 18:38 --------- d ----- w C: \ Program Files \ iPod
2008-09-10 18:34 --------- d ----- w C: \ Program Files \ QuickTime
2008-09-10 18:33 --------- d ----- w C: \ Program Files \ Common Files \ Apple
2008-09-06 03:16 36.864 ---- aw C: \ WINDOWS \ system32 \ drivers \ usbaapl.sys
2008-08-21 21:36 --------- d ----- w C: \ Program Files \ Apple Software Update
2008-08-11 21:22 --------- d ----- w C: \ Program Files \ Microsoft Silverlight
2008-08-07 16:37 --------- d ----- w C: \ Program Files \ Google
2008-03-01 20:28 75.496-c - aw C: \ Documents and Settings \ Tom Stratman \ Application Data \ GDIPFONTCACHEV1.DAT
2007-09-26 01:26 45.422-c - aw C: \ Documents and Settings \ Tom Stratman \ Application Data \ wklnhst.dat
2007-06-28 21:37 7.248-c - aw C: \ Documents and Settings \ All Users \ Application Data \ ypinfo.bin
2007-04-15 04:54 32-c - ar C: \ Documents and Settings \ All Users \ hash.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))) ))))))))))))))))))))))))))))))))))))))))
.
.
* Note * empty entries & čitljiv default unose se ne prikazuju
REGEDIT4

[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Curre ntVersion \ Run]
"DellSupport" = "C: \ Program Files \ DellSupport \ DSAgnt.exe" [2007-03-15 460784]
"LDM" = "C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe" [2007-02-23 67128]
"MSMSGS" = "C: \ Program Files \ Messenger \ msmsgs.exe" [2004-10-13 1694208]
"DellSupportCenter" = "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544]

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run]
"PCMService" = "C: \ Program Files \ Dell \ Media Experience \ PCMService.exe" [2004-04-11 290816]
"DVDLauncher" = "C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe" [2004-08-23 57344]
"dla" = "C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe" [2004-08-13 122939]
"igfxtray" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2005-09-20 77824]
"igfxpers" = "C: \ WINDOWS \ system32 \ igfxpers.exe" [2005-09-20 114688]
"CanonMyPrinter" = "C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe" [2006-03-21 1191936]
"SSBkgdUpdate" = "C: \ Program Files \ Common Files \ ScanSoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe" [2003-09-30 155648]
"OpwareSE4" = "C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe" [2006-03-21 69632]
"IMJPMIG8.1" = "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.E XE" [2004-08-04 208952]
"MSPY2002" = "C: \ Windows \ System32 \ IME \ PINTLGNT \ ImScI nst.exe" [2004-08-04 59392]
"PHIME2002ASync" = "C: \ Windows \ System32 \ IME \ TINTLGNT \ TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A" = "C: \ Windows \ System32 \ IME \ TINTLGNT \ TIN TSETP.EXE" [2004-08-04 455168]
"SoundMAXPnP" = "C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe" [2004-10-14 1404928]
"Adobe Reader Speed Launcher" = "C: \ Program Files \ Adobe \ Reader 8,0 \ Reader \ Reader_sl.exe" [2008-01-11 39792]
"dscactivate" = "C: \ Program Files \ Dell Support Center \ gs_agent \ običaj \ dsca.exe" [2007-11-15 16384]
"DellSupportCenter" = "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" [2007-11-15 202544]
"QuickTime Task" = "C: \ Program Files \ QuickTime \ QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier" = "C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe" [2008-09-03 111936]
"iTunesHelper" = "C: \ Program Files \ iTunes \ iTunesHelper.exe" [2008-09-08 289576]
"Logitech Hardware Abstraction Layer" = "KHALMNPR.EXE" [2008/02/29 C: \ WINDOWS \ KHALMNPR.Exe]
"Kernel i hardver Abstraction Layer" = "KHALMNPR.EXE" [2008/02/29 C: \ WINDOWS \ KHALMNPR.Exe]

[HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run]
"DWQueuedReporting" = "C: \ programa ~ 1 \ UOBIČAJENA ~ 1 \ MICROS ~ 1 \ DW \ dwtrig20.exe" [2007-03-13 39264]

C: \ Documents and Settings \ Tom Stratman \ Start Menu \ Programs \ Startup \
SpywareGuard.lnk - C: \ Program Files \ SpywareGuard \ sgmain.exe [2003-08-29 360448]

C: \ Documents and Settings \ All Users \ Start Menu \ Programs \ Startup \
Logitech Desktop Messenger.lnk - C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe [2007-02-23 67128]
Logitech SetPoint.lnk - C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe [2008-08-09 805392]
Microsoft Office.lnk - C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE [2001-02-13 83360]
WinZip Quick Pick.lnk - C: \ Program Files \ WinZip \ WZQKPICK.EXE [2005-02-11 118784]

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ winlogon \ obavijestiti \ LBTWlgn]
2008-05-02 02:42 72208 C: \ Program Files \ Common Files \ Logitech \ Bluetooth \ LBTWLgn.dll

[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Contro l \ SafeBoot \ Minimal \ WdfLoadGroup]
@ = ""

[HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ AuthorizedApplications \ List]
"% windir% \ \ system32 \ \ sessmgr.exe" =
"C: \ Program Files \ \ Media Player \ \ wmplayer.exe" =
"C: \ \ Program Files \ \ Common Files \ \ AOL \ \ Loader \ \ aolload.exe" =
"C: \ Program Files \ \ PopCap Games \ \ knjiški moljac Deluxe \ \ BookWorm.exe" =
"C: \ \ Program Files \ \ AIM \ \ aim.exe" =
"C: \ \ Program Files \ \ AIM6 \ \ aim6.exe" =
"C: \ \ Program Files \ \ Logitech \ \ Desktop Messenger \ \ 8876480 \ \ Program \ \ LogitechDesktopMessen ger.exe" =
"C: \ \ Program Files \ \ uTorrent \ \ uTorrent.exe" =
"C: \ \ Program Files \ \ Bonjour \ \ mDNSResponder.exe" =
"C: \ \ Program Files \ \ iTunes \ \ iTunes.exe" =

[HKLM \ ~ \ Services \ sharedaccess \ Parameters \ firewallpo licy \ standardprofile \ GloballyOpenPorts \ List]
"17770: TCP" = 17770: TCP: BitComet 17.770 TCP
"17770: UDP" = 17.770: UDP: 17770 UDP BitComet

R1 aswSP; avast! Self Protection; C: \ Windows \ System32 \ Drivers \ aswSP.sys [2008-07-19 78416]
R2 aswFsBlk; aswFsBlk; C: \ Windows \ System32 \ Drivers \ aswF sBlk.sys [2008-07-19 20560]
R2 npkcmsvc; npkcmsvc, C: \ Nexon \ Mabinogi \ npkcmsvc.exe [2007-08-02 80528]
R2 glediąta Manager Service; glediąta Manager Service; C: \ Program Files \ glediąta \ Common \ ViewpointService.exe [2007-01-04 24652]
S2 DP1112, DP1112, C: \ WINDOWS \ system32 \ Drivers \ DP.sys []
S3 FTD2XX; Outlaw Audio Device Driver Model 990, C: \ WINDOWS \ system32 \ Drivers \ FTD2XX.sys [2003-01-24 24197]
S3 XDva020; XDva020, C: \ WINDOWS \ system32 \ XDva020.sys []
.
Sadržaj je 'Scheduled Tasks' folder
.
- - - - Orphans Odstranjena - - - --

HKCU-Run-updateMgr - C: \ Program Files \ Adobe \ Acrobat 7,0 \ Reader \ AdobeUpdateManager.exe
HKCU-Run-Aim6 - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profil - C: \ Documents and Settings \ Tom Stratman \ Application Data \ Mozilla \ Firefox \ Profiles \ e41ez35c.default \
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp: / / dsl.sbc.yahoo.com /
.

************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit / potaja detector by Gmer zlonamjernih programa, http://www.gmer.net
Rootkit scan 2008-09-16 17:01:58
5/1/2600 Windows Service Pack 2 NTFS

skeniranja skrivenih procesa ...

skeniranja skrivenih autostart entries ...

skeniranja skrivenih datoteka ...

scan uspješno završena
skrivenih datoteka: 0

************************************************** ************************
.
------------------------ Other Running Processes ----------------------- --
.
C: \ Program Files \ Windows Defender \ MsMpEng.exe
C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Bonjour \ mDNSResponder.exe
C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe
C: \ Program ~ 1 \ WinZip \ WZQKPICK.EXE
C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
C: \ Program Files \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.exe
C: \ Program Files \ iPod \ bin \ iPodService.exe
.
************************************************** ************************
.
Completion time: 2008-09-16 17:13:41 - stroj digne
ComboFix-u karanteni-files.txt 2008-09-16 22:13:22

Pre-Run: 263.151.616 bytes free
Post-Run: 674.275.328 bytes free

180 --- EOF --- 2008-09-16 11:27:11


============= END COMBO FOX ==================================


Logfile of Trend Micro HijackThis v2.0.2
Skenirajte spremljena u 5:26:48, on 9/16/2008
Platforma: Windows XP SP2 (Winnt 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Pokretanje procesa:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ Winlogon.exe
C: \ WINDOWS \ system32 \ services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ Svchost.exe
C: \ Program Files \ Windows Defender \ MsMpEng.exe
C: \ WINDOWS \ System32 \ Svchost.exe
C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
C: \ WINDOWS \ system32 \ spoolsv.exe
C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Bonjour \ mDNSResponder.exe
C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
C: \ Nexon \ Mabinogi \ npkcmsvc.exe
C: \ Program Files \ Dell \ Media Experience \ PCMService.exe
C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe
C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
C: \ WINDOWS \ system32 \ hkcmd.exe
C: \ WINDOWS \ system32 \ igfxpers.exe
C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe
C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe
C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe
C: \ WINDOWS \ system32 \ Svchost.exe
C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe
C: \ Program Files \ glediąta \ Common \ ViewpointService.exe
C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe
C: \ Program Files \ QuickTime \ QTTask.exe
C: \ Program Files \ iTunes \ iTunesHelper.exe
C: \ Program Files \ DellSupport \ DSAgnt.exe
C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe
C: \ Program Files \ Messenger \ msmsgs.exe
C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe
C: \ Program Files \ WinZip \ WZQKPICK.EXE
C: \ Program Files \ SpywareGuard \ sgmain.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
C: \ Program Files \ Common Files \ Logishrd \ KHAL2 \ KHALMNPR.EXE
C: \ Program Files \ iPod \ bin \ iPodService.exe
C: \ WINDOWS \ system32 \ wuauclt.exe
C: \ WINDOWS \ explorer.exe
C: \ Program Files \ Mozilla Firefox \ firefox.exe
C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe

R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://dsl.sbc.yahoo.com/
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.dell4me.com/mywaybiz
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Postavke, ProxyServer = 0.0.0.0
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Postavke, ProxyOverride = *. lokalne
R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 2.1.1119.1736 \ s wg.dll
O3 - Toolbar: (no name) - (BA52B914-B692-B683-46c4-905236F6F655) - (no file)
O3 - Toolbar: (no name) - (E0E899AB-F487-11D5-8D29-0050BA6940E3) - (no file)
O4 - HKLM \ .. \ Run: [PCMService] "C: \ Program Files \ Dell \ Media Experience \ PCMService.exe"
O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ CyberLink \ PowerDVD \ DVDLauncher.exe"
O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
O4 - HKLM \ .. \ Run: [igfxtray] C: \ WINDOWS \ system32 \ igfxtray.exe
O4 - HKLM \ .. \ Run: [igfxhkcmd] C: \ WINDOWS \ system32 \ hkcmd.exe
O4 - HKLM \ .. \ Run: [igfxpers] C: \ WINDOWS \ system32 \ igfxpers.exe
O4 - HKLM \ .. \ Run: [CanonMyPrinter] C: \ Program Files \ Canon \ MyPrinter \ BJMyPrt.exe / prijava
O4 - HKLM \ .. \ Run: [SSBkgdUpdate] "C: \ Program Files \ Common Files \ ScanSoft Shared \ SSBkgdUpdate \ SSBkgdupdate.exe"-ugradnja-boot
O4 - HKLM \ .. \ Run: [OpwareSE4] "C: \ Program Files \ ScanSoft \ OmniPageSE4.0 \ OpwareSE4.exe"
O4 - HKLM \ .. \ Run: [IMJPMIG8.1] "C: \ WINDOWS \ IME \ imjp8_1 \ IMJPMIG.EXE" / ukvariti / RemAdvDef / Migration32
O4 - HKLM \ .. \ Run: [MSPY2002] C: \ Windows \ System32 \ IME \ PINTLGNT \ ImScInst.exe / Sync
O4 - HKLM \ .. \ Run: [PHIME2002ASync] C: \ Windows \ System32 \ IME \ TINTLGNT \ TINTSETP.EXE / Sync
O4 - HKLM \ .. \ Run: [PHIME2002A] C: \ Windows \ System32 \ IME \ TINTLGNT \ TINTSETP.EXE / IMEName
O4 - HKLM \ .. \ Run: [SoundMAXPnP] C: \ Program Files \ Analog Devices \ Core \ smax4pnp.exe
O4 - HKLM \ .. \ Run: [Logitech Hardware apstrakcije Layer] KHALMNPR.EXE
O4 - HKLM \ .. \ Run: [Kernel i sloj apstrakcije hardvera] KHALMNPR.EXE
O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8,0 \ Reader \ Reader_sl.exe"
O4 - HKLM \ .. \ Run: [dscactivate] "C: \ Program Files \ Dell Centar \ gs_agent \ custom \ dsca.exe"
O4 - HKLM \ .. \ Run: [DellSupportCenter] "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [AppleSyncNotifier] C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe"
O4 - HKCU \ .. \ Run: [DellSupport] "C: \ Program Files \ DellSupport \ DSAgnt.exe" / pokretanja
O4 - HKCU \ .. \ Run: [LDM] C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe
O4 - HKCU \ .. \ Run: [MSMSGS] "C: \ Program Files \ Messenger \ msmsgs.exe" / background
O4 - HKCU \ .. \ Run: [DellSupportCenter] "C: \ Program Files \ Dell Support Center \ bin \ sprtcmd.exe" / P DellSupportCenter
O4 - HKUS \ S-1-5-18 \ .. \ Run: [DWQueuedReporting] "C: \ programa ~ 1 \ UOBIČAJENA ~ 1 \ MICROS ~ 1 \ DW \ dwtrig20.exe"-t (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [DWQueuedReporting] "C: \ programa ~ 1 \ UOBIČAJENA ~ 1 \ MICROS ~ 1 \ DW \ dwtrig20.exe"-t (User 'Default user')
O4 - Startup: SpywareGuard.lnk = C: \ Program Files \ SpywareGuard \ sgmain.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ LogitechDesktopMessenger. Exe
O4 - Global Startup: Logitech SetPoint.lnk = C: \ Program Files \ Logitech \ SetPoint \ SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C: \ Program Files \ Microsoft Office \ Office10 \ OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C: \ Program Files \ WinZip \ WZQKPICK.EXE
O6 - HKCU \ Software \ Policies \ Microsoft \ Internet Explorer \ Control Panel prisutan
O8 - Extra kontekst meni stavka: & AIM Search - res: / / C: \ Program Files \ AIM Toolbar \ AIMBar.dll / aimsearch.htm
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11cf-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - (08B0E5C0-4FCB-11cf-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_01 \ bin \ ssv.dll (file missing)
O9 - Extra button: AIM - (AC9E2541-2814-11d5-BC6D-00B0D0A1DE45) - C: \ Program Files \ AIM \ aim.exe
O9 - Extra button: Web Player MUSICMATCH MX - (d81ca86b-ef63-42af-bee3-4502d9a03c2d) -- http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O16 - DPF: (149E45D8-163E-4189-86FC-45022AB2B6C9) (SpinTop DRM Control) - file: / / C: \ Program Files \ grebati \ Slike \ stg_drm.ocx
O16 - DPF: (17492023-C23A-453E-A040-C7C580BBF700) (Windows Genuine Advantage Validation Tool) -- http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: (288C5F13-7E52-4ADA-A32E-F5BF9D125F98) (CR64Loader Object) -- http://miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: (30528230-99f7-4bb4-88d8-fa1d4f56a2ab) (Installation Support) - C: \ Program Files \ Yahoo! \ Common \ Yinsthelper.dll
O16 - DPF: (406B5949-7190-4245-91A9-30A17DE16AD0) (Snapfish Activia) -- http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: (48884C41-EFAC-433D-958A-9FADAC41408E) (EGamesPlugin Class) -- https: / / www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: (5F5F9FB8-878E-4455-95E0-F64B2314288A) -- http://gamedownload.ijjimax.com/game...lugin11USA.cab
O16 - DPF: (5F8469B4-B055-49DD-83F7-62B522420ECC) (Facebook Foto Uploader Control) -- http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: (CC450D71-CC90-424C-8638-1F2DBAC87A54) (ArmHelper Control) - file: / / C: \ Program Files \ grebati \ Slike \ armhelper.ocx
O16 - DPF: (CD995117-98E5-4169-9920-6C12D4C0B548) -- http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O18 - Protocol: bwfile-8876480 - (9462A756-7B47-47BC-8C80-C34B9B80B32B) - C: \ Program Files \ Logitech \ Desktop Messenger \ 8876480 \ Program \ GAPlugProtocol-8876480.dll
O23 - Service: Apple Mobile Device - Apple Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ Alwil Software \ Avast4 \ ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown vlasnika - C: \ Program Files \ DellSupport \ brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe
O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc - C: \ Program Files \ Zajedničke Files \ Logitech \ Bluetooth \ LBTServ.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel (R) Corporation - C: \ Program Files \ Intel \ PROSetWired \ NCS \ Sync \ NetSvc.exe
O23 - Service: npkcmsvc - INCA Internet Co, Ltd - C: \ Nexon \ Mabinogi \ npkcmsvc.exe
O23 - Service: SupportSoft zupčasti Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc - C: \ Program Files \ Dell Support Center \ bin \ sprtsvc.exe
O23 - Service: glediąta Manager Service - vidikovac Corporation - C: \ Program Files \ glediąta \ Common \ ViewpointService.exe

--
End of file - 10.675 bajtova

[evilfantasy]

• Kliknite START tada Pokrenuti
• Sada upišite Combofix / u u runbox
• Provjerite da li postoji razmak između Combofix a / u
• Tada hit Enter.

• Gore navedeni postupak će:
• Izbrišite sljedeće:
• ComboFix i njegove povezane datoteke i mape.
• Reset podešenja sata.
• Sakrij nastavke, ako je potrebno.
• Sakrij System / Skrivene datoteke, ako je potrebno.
• Postavi novu, čisto Restore Point.

----------

Preuzimanje ViewpointKiller.zip

• Otvoriti rajsfešlus programa i svih sadržaja ViewpointKiller.zip na lokaciju kao radnu površinu.
• Dvaput kliknite na ikonu za pokretanje ViewpointKiller ViewpointKiller.exe.
• Odaberite Datoteka izbornika, i odaberite Provjerite da li imate instaliran glediąta.
• ViewpointKiller Ako se pokaže da bilo koja od stajališta varijante su instalirani, odaberite odgovarajući Ubiti opcija u Datoteka izbornika.

• Slijedite upute i upute vrlo pažljivo, odgovaranja Da ili Ne ovisno o tome koja opcija koje su vam najvažnije zadovoljni.
• The MSConfig upute su vrlo važna, stoga se pobrinite za to da ih pažljivo pročitate.

• Napomena: Kada završite s ViewpointKiller desni klik i izbrišite sve datoteke koje su bile unzipped.

----------

Vaš Java je zastarjela.

Starije verzije imaju propusta koji zlonamjernim web stranice možete koristiti za zaraziti sustav.

Prvo instalirajte novi Nedjelja Java Runtime Environment

Budite sigurni da zatvorite sve prozore preglednika prije nego počnu instalirati.

Izvadite staru verziju (s)

• Download JavaRa i otvoriti rajsfešlus datoteku na svoj Desktop.
  
• Otvori JavaRA.exe i odabrati Ukloni Starije verzije
  
• Nakon kompletne JavaRA izlaz i brisanje programa.
  
• Pokreni CCleaner.

----------

Preuzimanje ATF čistiju by Atribune na svoj Desktop.

Alternate download link

Napomena: Vista korisnici moraju koristiti Pokreni kao administrator

• Pod Main: Odaberite Delete Files u odaberite: Odaberi Sve.
• Kliknite Prazan Izdvojeno gumb.
• Ako koristite Firefox preglednik klikni Firefox na vrhu i odaberite: Odaberi Sve
• Kliknite Prazan Izdvojeno gumb.
  Ako želite zadržati svoje spremljene lozinke kliknite Ne na redak.
• Ako koristite Opera browser klikni Opera na vrhu i odaberite: Odaberi Sve
• Kliknite Prazan Izdvojeno gumb.
  Ako želite zadržati svoje spremljene lozinke kliknite Ne na redak.
• Kliknite Izlaz na glavnom izborniku za zatvaranje programa.

Imajte na umu da vaš sustav će se pokrenuti sporiji za pokretanje ili dva nakon što koristiti ovaj alat kako ne paničari.

Važno: Ponovo pokrenite računalo prije nego što nastavite.

----------

Pokreni ovaj online scan. Potreban je Internet Explorer

Koristite ESET NOD32 Online Scanner

1. Potvrdite okvir pored Da, prihvaćam Uvjete korištenja.
2. Kliknite Početak
3. Na pitanje, omogućiti ActiveX kontrole za instalaciju
4. Kliknite Početak
5. Provjerite je li mogućnost Uklonite pronađene prijetnje i mogućnost Scan neželjenih aplikacija provjerite je označen.
6. Kliknite Scan
7. Pričekajte za skeniranje do kraja
8. Koristite notesa za otvaranje logfile se nalaze na C: \ Program Files \ EsetOnlineScanner \ log.txt
9. Dodati taj C: \ Program Files \ EsetOnlineScanner \ log.txt Prijavite se na svoj sljedeći odgovor

[SpeedRacer]

# Version = 4 # OnlineScanner.ocx = 1.0.0.635 # OnlineScannerDLLA.dll = 1, 0, 0, 79 # OnlineScannerDLLW.dll = 1, 0, 0, 78 # OnlineScannerUninstaller.exe = 1, 0, 0, 49 # vers_standard_module = 3447 (20080916) # vers_arch_module = 1,064 (20080214) # vers_adv_heur_module = 1,064 (20070717) # EOSSerial = 8983b3a42701b342bf8e75ec7f82c98f # end = završio remove_checked = true # # unwanted_checked = true # utc_time = 2008-09-17 05:39:16 # local_time = 2008-09-17 12:39:16 (-0600, Central Daylight Time) # zemlje = "Sjedinjene Države" # osver = NT 5.1.2600 Service Pack 2 # # skenirane = 226.155 found = 0 # scan_time = 4.934

[evilfantasy]

Postavi novu točku vraćanja za sprečavanje mogućih reinfection od starog
Postavljanje novu točku vraćanja NAKON čišćenja sustava omogućit će računalo roll-back na čisto radno države ako je potrebno.

• Idi na Početak > Programi > Pribor > System Tools i kliknite System Restore
• Odaberite radio gumb označen Napravite Restore Point Na prvom ekranu zatim kliknite Dalje Dajte Restore Point zatim kliknite naziv Napravi.
• The new točku vraćanja će biti ovjerene kod trenutni datum i vrijeme. Voditi zapisnik ovog pa možete ga lako naći Ukoliko morate koristiti System Restore.
• Dalje idite na Početak > Pokrenuti i tip Cleanmgr
• Kliknite U redu
• Kliknite Više opcija Tab.
• Kliknite Clean Up u odjeljku System Restore da biste uklonili sve točke vraćanja prethodnih osim novokreiran čisti jedan.

Možete pronaći upute o tome kako omogućiti i ponovno omogućiti System Restore ovdje:

Windows XP System Restore Vodič ili Windows Vidik Sistem Vratiti Vodič

----------

Koristite Secunia Software inspektor provjeriti za nesuvremen softvera.
Zastario softver sigurnosnih propusta ima zlonamjernih programa koji mogu iskoristiti.

• Kliknite Počnite odmah
• Potvrdite okvir pored Enable temeljita sustav inspekcije.
• Kliknite Početak
• Dopusti da se završi skeniranje i pomaknite se dolje da vidim ako je bilo koji su nadopune potrebne.
• Update ništa navedene.

----------

Idi na Microsoft Windows Update i dobiti sva kritična ažuriranja.

----------

Ovdje su neki veliki FREE alate koji će vam pomoći da zadržite od uzimajući okužen ponovno. Ovi alati koristiti malo ili nikakve resurse pa neće usporiti vaše računalo.

Browser Security zabrinuti? Razmislite o korištenju Mozilla Firefox 3,0.

Kako biste spriječili da se nepoznata aplikacija instalirana na vaše računalo instalirati WinPatrol 2008
* Korištenje Winpatrol da zaštiti svoje računalo od zlonamjernih programa

Htjela predlažemo da koristite SiteAdvisor. SiteAdvisor stope lokacije na poslovne prakse i spama. Sigurnost ratings from McAfee SiteAdvisor se temelje na automatizirano ispitivanje sigurnosti web-mjesta.

SpywareBlaster - Sigurna Vašeg Internet Explorera kako bi se teže za tim ActiveX za pokretanje programa na računalu. Također prestati određeni kolačiće od dodan u vašem računalu kada prikazuju temelji preglednicima kao što su Mozilla Firefox.
* Korištenje SpywareBlaster zaštititi vaše računalo od Spyware i zaštita od zlonamjernih programa
* Ako ne znate što su ActiveX kontrole, vidi ovdje

Check out Imajući Yourself sigurno na Webu Za savjete i slobodne alate da bi vas sigurno u budućnosti.

Također pogledajte Computer Sporo? To ne može biti zaštita od zlonamjernih programa besplatno za čišćenje / održavanje alata za pomoć držati tvoj računalo trčanje glatka.

Koristite samo pouzdana sigurnosni softver, poput programa navedenih na ovoj stranici. Trusted sigurnosne alate i resurse

[SpeedRacer]

Ne mogu vam dovoljno zahvaliti. Osjećam se puno sigurnije o mojem računalo sad zahvaljujući vama.
Ja sam izuzetno impresioniran na pletora znanja na ovim stranicama i da će nastaviti da ih koriste za moj računalne potrebe.

[evilfantasy]

Drago mi je radila.

Sef surfing ...