Uvali mi sestra laptop vidim šta mu je. Upalim ga kad od stndardnog XP logina pojavi mi se login kao u WIN2000 sa drugim korisničkim imenom i istim passwordom kao i prije.  Instalirao brdo antivirusnih programa al ine da mi se spojiti na internet. Kao malog korisnika izbaci me nakon par sekundi. Na poslu mi neda se spojiti na mrežu. Ne mogu uradit update i ne mogu čekirati sa najnovijim antivirusima. Ima li tko kakvih ideja prije nego ga formatiram.

mozda problem pravi neki virus koji se zavukao u hosts

Start / Run kopiraj ovo
pa Enter
pojavice ti se notepad

sve tamo obrisi i napisi ovo (copy / paste )

sacuvaj promene
mozda budes morao sve to da radis iz safe moda

posle ovoga bi trebao da mozes da se spojis na net

a sto se tice programa instaliraj ovaj

http://www.malwarebytes.org/mbam.php

evo ti update pa mozes da ga updateujes rucno

http://malwarebytes.gt500.org/database.jsp

idi na Quick Scan

Kad zavrsi skeniranje,klikni OK / Show Results:
u listi detektovanog malware-a, obeležite sve stavke i klikni Remove Selected

srecno 

Uradit ću to, ali pojavio se novi problem. Nekako se NOD32 updato ali od tad se ne mogu ulogirati na windowse. Logiram se i automatski se odlogira sam od sebe. Budem to u safe modu po tvojim uputama.

Urađeno po uputama, našao je nekakvih trojana (u safe modu) i skinuo ih, ali i dalje se ne mogu ulogirati na windowse. odma me odlogira.

Igdje cu nac "client server for netware" da ga uninstsaliram. Kad oću da promijenim način logiranja traži mi da to skinem.

Prilikom pojavljivanja doticnih problema kao preliminarno resenje preporucujemo vam da skenirate vas racunar sa azuriranim Anti-Virus i Anti-Spyware programima. Posetite ovu temu za vise informacija, kao i ovu temu za spisak i test najboljih Anti-Virus programa.
Ukoliko se Vas problem i dalje pojavljuje, preporucujemo Vam da skenirate Vas racunar sa HiJackThis software-om koji je besplatan i mozete ga download-ovati na ovoj adresi, nakon cega zakacite ovde Vas tekstualni HiJackThis log.

Prošišćeno sve sa antivirusima ali ista stvar, tj. još gora. Resetirao sam laptop i sad ni u safe modu ne mogu da se ulogiram ni na jedan korisnički račun. Evo loga.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:38:40, on 8.1.2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\WLTRAY.exe
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\System32\keyhook.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\System32\CTFMON.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
E:\Instalacija\Antivirus\HiJackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\ndetect.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4C840D2A-37D0-49F3-BA98-37C464B2F1C2} - C:\WINDOWS\System32\ssqronKd.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\System32\WLTRAY
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [9c79baa2] rundll32.exe "C:\WINDOWS\System32\odunpwww.dll",b
O4 - HKLM\..\RunOnce: [RemoveWGA] C:\Documents and Settings\Administrator\Desktop\RemoveWGA.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1482476501-1604221776-725345543-500\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: ClipBook (ClipSrv) - Unknown owner - C:\WINDOWS\system32\clipsrv.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Network DDE (NetDDE) - Unknown owner - C:\WINDOWS\system32\netdde.exe (file missing)
O23 - Service: Network DDE DSDM (NetDDEdsdm) - Unknown owner - C:\WINDOWS\system32\netdde.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Locator (RpcLocator) - Unknown owner - C:\WINDOWS\System32\locator.exe (file missing)
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\System32\rsvp.exe (file missing)
O23 - Service: Smart Card Helper (SCardDrv) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)
O23 - Service: Smart Card (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe (file missing)
O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing)
O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe (file missing)
O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing)

--
End of file - 5813 bytes
5814

Restartuj racunar i udji u Safe Mode ( pritiskaj F8 dok se dize OS, i odaberi Safe Mode). Podesi da se vide skriveni fajlovi, ako vec nije podeseno ( udji u bilo koji folder, pa Tools, Folder Options, View i obelezi Show hidden files and folders). Nadji fajl ssqronKd.dll, eader_s.exe i odunpwww.dll ( nalaze se u C:\WINDOWS\System32\) i rucno ih obrisi ( Shift + Delete ili ako nece KillBox alatom). Kada si obrisao, ostani u Safe Mode-u i pokreni Hijackthis, fixuj sledece:

O2 - BHO: (no name) - {4C840D2A-37D0-49F3-BA98-37C464B2F1C2} - C:\WINDOWS\System32\ssqronKd.dll (file missing)
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [9c79baa2] rundll32.exe "C:\WINDOWS\System32\odunpwww.dll",b

Restartuj racunar, i udji u Normal Mode, pokreni Hijackthis i daj mi novi log.

Kad uđem u safe mode i pokušam  se logirati automatski me odmah odlogira. ne mogu pristupiti windowsima ni preko safe moda.

Moj predlog je da formatiras disk i ponovo intaliras windows jer je ocigledno da imas viruse, a virus kad jednom napravi haos u sisemu, sta god posle da ti popravljao nece biti nikada kako treba. Tako da je format najjednostavnije i najefikasnije resenje, a realno ces manje vremena izgubiti za to, nego da se smaras sa ciscenjem sistema i popravljanjem koje nece puno pomoci.

i meni se čini da će na kraju biti tako