Ja koliko vidim oni su imali problema sa Look2Me sto ovde nije slucaj, a i da jeste SpyBot bi ga vec ubio

Ma znas kako,ovaj spy sweeper ima vecu bazu od spy bot-a i pronasao mi je par nekih virusa koje spy bot nije.Izmedju ostalog i neke trojance.Sve sam to skenirao i ocistio iz safe mode-a medjutim cini mi se da jednog trojanca nije uklonio,i to onog glavnog sto zadaje glavobolje!

  Kako znas da nije ocistio sve?, jel si skeniro sa nekim AV-om?, SpySweeper nije antivirus i netreba i nemoze da ti bude jedina zastita od trojanaca, odradi HijackThis i postavi log

Pazi,imam nod32 i instalirao sam spy bot i spy sweeper.I ocistio sam prvo sa spy bot-om sve,a zatim upalio spy sweeper i skenirao ponovo.I on mi je nasao nekih 8 virusa

Evo ga Hijack This!
Logfile of HijackThis v1.99.1
Scan saved at 11:43:17, on 7.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Jerema\Local Settings\Temp\wz3883\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mobilnisvet.com/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download with GetRight Pro - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Subscribe in default RSS reader - C:\Documents and Settings\Jerema\Application Data\RssBandit\iecontext_subscribefeed.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146330245243
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ldr64 - ldr64.dll (file missing)
O20 - Winlogon Notify: winfvy32 - C:\WINDOWS\SYSTEM32\winfvy32.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe

O2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
Ovo moras da ubijes, ja sam se jedno vreme lomio da objasnim ljudima da NOD32 nije Antivirus nego smece kojem ce uvek proletati ovakve stvari, stavi neki bolji AV (Kaspersky, BitDefender, Panda...) uloguj se u safe mode, iskljuci system restore ako vec nisi iskljucio i neukljucuj ga vise, skeniraj iz Safe Mode-a sa Antivirusom za koji se odlucis, sa Adaware i sa SpyBot Search & Destroy a mozes i sa SpySweeper-om

Kazhe da nije Look2me u ovom textu.
Ovako cemo: (ali nishta ne radi dok neko drugi ne kazhe da li sam ti dobro rekla)
 
Download killbox to your desktop from this link http://www.downloads.subratam.org/KillBox.exe   We'll use it in safe mode later.

Download Ewido Security Suite  http://www.ewido.net/en/download/  then set it up this way : http://rstones12.geekstogo.com/ewidosetup.htm

 We will run it from safe mode later

Next, please reboot your computer in Safe Mode by doing the following:
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap F8.
Instead of Windows loading as normal, a menu should appear
Select the first option, to run Windows in Safe Mode.

Pokreni HighJack This i ukloni:

O2 - BHO: (no name) - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
O20 - Winlogon Notify: winfvy32 - C:\WINDOWS\SYSTEM32\winfvy32.dll

Double-click on Killbox.exe to run it.
Put a tick by Standard File Kill.
In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time.
Click on the button that has the red circle with the X in the middle after you enter each file.

C:\WINDOWS\Temp\idd3B.tmp.exe
C:\WINDOWS\SYSTEM32\winfvy32.dll

It will ask for confimation to delete the file.
Click Yes.
Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box.

Run Ewido and when the scan has completed, Ewido will create a report.txt file. Click the "Save Report" button on the bottom of the screen and save the log to your desktop.

Please reboot into normal mode and post the ewido log and a HT log.

Znachi posalji novi ewido log i HighJack This log.

Moderatori proverite da li je ovo ok !

p.s Mene ovo zabrinjava
O20 - Winlogon Notify: ldr64 - ldr64.dll (file missing)

Pokreni HT i stikliraj samo ovo i vidi shta ce da ti kazhe.

Ih bre MunkaZe daj da te izvedem na jedan drink retko da ima tako smart devojaka
Pazi nemogu se tako citati logovi, jer to sto si postovala jeste tacno ali to je za sasvim drugi log, ni Buger ni Jerema nemaju tih problema ustvari Jerema ima hp100.tmp sto sam mu i reko da kilne, winfvy32.dll nemora da kiluje jer to je legitiman proces wina koji u ovom slucaju sluzi samo da podize malopre pomenuti, zato oni savetuju da se i on kiluje ali to nemora da radi, dovoljno je da se loguje u Safe Mode i sa bilo kojim AV-om (osim NOD32) da ocisti masinu za sta mislim da je vec i uradio, sto se Bugera tice on ima ovaj tmp. dialer ali ga nema u logu Hijack-a sto znaci ili da ga je ubio, ili da ga je blokirao, tako da njemu ostaje samo da ga nadje manualno i da ga ubije manualno

Uspeo sam konacno da iz safe mode-a skeniram sistem i uklonim sve viruse(bilo ih je 12!),sad sam iz Hijack this ubio gore pomenuti HP100.tmp
i sada je valjda sve ok...

Hvala Lazo i hvala Zemunko!

np

@laza

"Pazi nemogu se tako citati logovi, jer to sto si postovala jeste tacno ali to je za sasvim drugi log, ni Buger ni Jerema nemaju tih problema ustvari Jerema ima hp100.tmp sto sam mu i reko da kilne, winfvy32.dll nemora da kiluje jer to je legitiman proces wina koji u ovom slucaju sluzi samo da podize malopre pomenuti, zato oni savetuju da se i on kiluje ali to nemora da radi,..."

Ja sam iscitala njegov log i napisala procese iz njegovog loga,a ne iz onog prema kome sam se vodila A winfvy32 jeste legitiman proces,ali ako se ( a ne kazhem da se ) kachi na Adobe dialer,kao i ldr64 (sto je kod mene bio sluchaj),odnosno podizhe tmp sa Adobe dialera,onda mora da se kiluje (iz sopstvenog iskustva) 

Sve u svemu,problem resen