Dale, instalirao sam hosts fajl(ili fajlove) i nazalost nista se nije promenilo.Probacu da instaliram Aviru pa da vidim
sta dalje, ukoliko Vi nemate neki drugi predlog

Da se ne bi mrcvario sa avirom ili bilo kakvim drugim skenerima jer je to nepotrebno...odradi ovo:

PreuzmiDDS Program na Desktop
http://download.bleepingcomputer.com/sUBs/dds.com

Dvoklikom pokreni dds,kad zavrsi, DDS ce otvoriti dva loga:
         1. DDS.txt
         2. Attach.txt
Oba izvestaja sacuvaj na Desktop.
Kopiraj mi DDS.txt


Ako je malware napravio bilo kakve izmene u sistemu,ovaj program ce to izlistati i prikazati...
...ako si voljan da probamo i ovako naravno.

DDS (Ver_10-11-27.01) - NTFSx86 
Run by Rade at 21:16:32,82 on sre 01.12.2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Home Edition  5.1.2600.3.1250.381.1033.18.503.173 [GMT 1:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated)   {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: COMODO Firewall Pro *enabled*   {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Telenor Internet\Telenor Internet.exe
C:\Documents and Settings\Rade\Desktop\dds.com

============== Pseudo HJT Report ===============

uInternet Connection Wizard,ShellNext = iexplore
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\2.1.1119.1736\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: FreshDownload Bar: {ed0e8ca5-42fb-4b18-997b-769e0408e79d} -
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [AutoStartNPSAgent] c:\program files\samsung\samsung new pc studio\NPSAgent.exe
mRun: [Dell QuickSet] c:\program files\dell\quickset\Quickset.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
mRunOnce: [WIAWizardMenu] RUNDLL32.EXE c:\windows\system32\sti_ci.dll,WiaCreateWizardMenu
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uPolicies-explorer: NoRecentDocsNetHood = 1 (0x1)
uPolicies-explorer: NoStrCmpLogical = 00000000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to Mp3 Converter - c:\documents and settings\rade\application data\dvdvideosoftiehelpers\youtubetomp3.htm
IE: Prevedi sa Di recnikom - c:\program files\di recnik\diie.htm
IE: Translate with Di dictionary -
IE: {C2FDBB68-9A30-4707-AA49-6DA27C906FD0}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - c:\program files\winhttrack\WinHTTrackIEBar.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: {223EAED1-4867-4E07-ADCE-9EC16F55B22E} = 217.65.192.101 217.65.192.102
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\rade\applic~1\mozilla\firefox\profiles\43724fmr.default\
FF - prefs.js: browser.search.selectedEngine - Википедија (sr)
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: vShare: vshare@toolbar - c:\docume~1\rade\applic~1\mozilla\firefox\profiles\43724fmr.default\extensions\vshare@toolbar
FF - Extension: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - c:\docume~1\rade\applic~1\mozilla\firefox\profiles\43724fmr.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Extension: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - c:\docume~1\rade\applic~1\mozilla\firefox\profiles\43724fmr.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]
R2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-8-30 20072]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-3-23 233472]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-3-23 36608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 cpudrv;cpudrv;\??\c:\program files\systemrequirementslab\cpudrv.sys --> c:\program files\systemrequirementslab\cpudrv.sys [?]
S3 DellBIOS;DellBIOS;c:\windows\DellBIOS.Sys [2010-3-4 5120]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-8-30 100480]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 aawservice;Lavasoft Ad-Aware Service;

=============== File Associations ===============

regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1

=============== Created Last 30 ================

2010-12-01 11:24:52   6273872   ----a-w-   c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{2b8f9957-89fa-4136-8b49-6bee546669f0}\mpengine.dll
2010-11-30 02:55:28   159744   ----a-w-   c:\program files\internet explorer\plugins\npqtplugin6.dll
2010-11-30 02:55:28   159744   ----a-w-   c:\program files\internet explorer\plugins\npqtplugin5.dll
2010-11-30 02:55:28   159744   ----a-w-   c:\program files\internet explorer\plugins\npqtplugin4.dll
2010-11-30 02:55:28   159744   ----a-w-   c:\program files\internet explorer\plugins\npqtplugin3.dll
2010-11-30 02:55:28   159744   ----a-w-   c:\program files\internet explorer\plugins\npqtplugin2.dll
2010-11-30 02:55:28   159744   ----a-w-   c:\program files\internet explorer\plugins\npqtplugin.dll
2010-11-30 00:26:49   --------   d-----w-   c:\docume~1\rade\locals~1\applic~1\Apple Computer
2010-11-29 12:40:39   159744   ----a-w-   c:\program files\mozilla firefox\plugins\npqtplugin6.dll
2010-11-29 12:40:39   159744   ----a-w-   c:\program files\mozilla firefox\plugins\npqtplugin5.dll
2010-11-29 12:40:39   159744   ----a-w-   c:\program files\mozilla firefox\plugins\npqtplugin4.dll
2010-11-29 12:40:38   159744   ----a-w-   c:\program files\mozilla firefox\plugins\npqtplugin3.dll
2010-11-29 12:40:38   159744   ----a-w-   c:\program files\mozilla firefox\plugins\npqtplugin2.dll
2010-11-29 12:40:38   159744   ----a-w-   c:\program files\mozilla firefox\plugins\npqtplugin.dll
2010-11-29 12:40:29   94208   ----a-w-   c:\windows\system32\QuickTimeVR.qtx
2010-11-29 12:40:29   69632   ----a-w-   c:\windows\system32\QuickTime.qts
2010-11-29 12:40:28   180224   ----a-w-   c:\windows\system32\QTCF.dll
2010-11-29 12:40:12   --------   d-----w-   c:\program files\QuickTime Alternative
2010-11-29 08:09:11   6273872   ----a-w-   c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2010-11-28 20:12:38   --------   d-----w-   c:\docume~1\rade\locals~1\applic~1\Temp
2010-11-28 13:12:02   --------   d-----w-   c:\program files\Microsoft Security Essentials
2010-11-28 00:10:16   --------   d-----w-   c:\program files\Freemake
2010-11-27 23:09:37   --------   d-----w-   c:\docume~1\rade\applic~1\DVDVideoSoft
2010-11-27 23:00:59   --------   d-----w-   c:\docume~1\rade\applic~1\DVDVideoSoftIEHelpers
2010-11-27 22:59:44   --------   d-----w-   c:\program files\common files\DVDVideoSoft
2010-11-27 22:59:43   --------   d-----w-   c:\program files\DVDVideoSoft
2010-11-22 17:58:26   --------   d-----w-   c:\docume~1\rade\applic~1\Foxit Software
2010-11-22 17:56:08   --------   d-----w-   c:\program files\Foxit Software
2010-11-22 12:35:59   --------   dc-h--w-   c:\windows\ie8
2010-11-18 09:29:39   --------   d-----w-   c:\windows\system32\wbem\repository\FS
2010-11-18 09:29:39   --------   d-----w-   c:\windows\system32\wbem\Repository
2010-11-13 08:38:41   --------   d-----w-   c:\docume~1\rade\applic~1\DeviceDoctorSoftware
2010-11-12 18:46:58   4280320   ----a-w-   c:\windows\system32\GPhotos.scr

==================== Find3M  ====================

2010-10-19 20:51:33   222080   ------w-   c:\windows\system32\MpSigStub.exe
2010-09-18 10:23:26   974848   ----a-w-   c:\windows\system32\mfc42u.dll
2010-09-18 06:53:25   974848   ----a-w-   c:\windows\system32\mfc42.dll
2010-09-18 06:53:25   954368   ----a-w-   c:\windows\system32\mfc40.dll
2010-09-18 06:53:25   953856   ----a-w-   c:\windows\system32\mfc40u.dll
2010-09-15 02:50:37   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2010-09-15 00:29:49   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2010-09-10 05:58:08   916480   ----a-w-   c:\windows\system32\wininet.dll
2010-09-10 05:58:06   43520   ------w-   c:\windows\system32\licmgr10.dll
2010-09-10 05:58:06   1469440   ------w-   c:\windows\system32\inetcpl.cpl

============= FINISH: 21:16:57,89 ===============

Nema tragova malware-a. PC je cist. Ali imas dosta ostataka od nepravilne uninstalacije AVG AntiVirusa.

Poseti ovaj sajt:
http://www.askvg.com/ultimate-collection-of-uninstallers-removal-tools-for-all-popular-anti-virus-software/
direktno:
http://www.avg.com/ww-en/download-tools

Preuzmi AVG uninstall tool i ocisti ostatke. Mozda ovo resi problem.

Ondak preuzmi ovaj Program: TFC
http://forum.burek.com/csrss-exe-problem-t524154/?action=dlattach;id=1527911

Pokreni ga sa Dektopa i sacekaj da zavrsi. On ce ti temeljno isprazniti temp fajlove...

Ondak neki registry clenaer (ne moze da skodi) ..izaberi:

http://vit-registry-fix.en.softonic.com/
http://www.wisecleaner.com/

Toliko od mene ... bar znamo da nije do neke infekcije.



edit: Comodo firewall...i njega nisi deinstalirao kako treba,jer ja ga ne vidim nigde u logu.
mislim da te to zeza

edit2:
Znaci Comodo treba uninstalirati kompletno sa racunara kao i AVG. E sad...nema alat kojic e ukloniti Combodo.
To se moze ComboFix-om uraditi ali necemo sa tim da se zezamo jer mozda radnja bude uzaludna.

Imas dva nacina da uklonis comodo:

1. tezi nacin:
 Da proucis ovaj link:
http://forums.comodo.com/frequently_asked_questions_faq_for_comodo_firewall/manual_uninstall_of_cfp_2x-t5326.0.html

po postupku obrises ostatke ili ...

2.laksi ali manje siguran i/ili efikasan
instaliras ponovo Combodo Firewall...i kad vidis da program ponovo radi sipravno...uninstaliraj ga pomocu YourUninstaller-a. koristeci njegov "super mode"


Mislim da ti je ovo usrok problema ali ja to ne mogu znati tok ne odradis pa ne javis jel pomoglo.

 

Poslusacu savete koliko budem znao i umeo.Vama veliko hvala za ulozeni trud a meni ostaje da se nadam
da ce vasa uputstva doneti neki rezultat.U svakom slucaju javicu sta sam uradio.

Da li sada mozes da kopiras ovde hosts fajl?

Ovako sada treba da ti izgleda:

Ja mislim da on ima virus, a razlog sto mu se nista nije promenilo na bolje kad je kopirao cist hosts fajl jeste to sto ga je virus odmah potom nanovo 'napakovao'... Ali dobro - antivirusni program uvek treba da se stavlja poslednji, a nije ni neophodan zar ne?

Videcemo sta je u pitanju kad covek vidi jel mu sada host file ok ili je vracen na staro.

Sto se tice antivirusa, bolje je i bilo koji nego nikakav, osim ako koristis ovakav OS sa kojeg sada pisem.

@Crowz
Da je hosts file izmenjen,DDS log bi to zabelezio. Ja ipak mislim da njemu Combodo pravi problem... 

@Bulma...ne ide to bas tako,uostalom njegov racunar nije inficiran virusom ili nekim malware-om.
Ja sam mu pregledao task manager,browser helper object,toolbarove,sve sto se dize sa startup-om,winlogon i notify,setovanja browsera,listu fajlova koji su tu,hidden ili superhidden kao i spisak iz services.msc-a.
Sve su to mesta gde malware-i postave svoje fajlove. Sve su to mesta koje ce AV takodje da proceslja i nece naci nista.

Covek ima MSE instaliran na racunaru jer mu je OS legalan.

Naisao sam jednom na komp kome je hosts file bio toliko veliki da mi je trebalo 5 minuta da skrolujem kako bi dosao do kraja. Kada sam to zamenio pravim, nakon restarta, fajl se vracao na isto, a prethodno sam sve proverio i to po vise puta, raznim alatima. Problem je sto covek daje jako stura objasnjenja, jer ako mu je hosts fajl onoliko veliki kao sto on kaze, ne bi mogao na masu stranica da ide.

Moguce je da mu comodo pravi probleme, samo mi nije jasno kako je comodo izabrao bas krstaricu.