Evo ovako,od skoro sam poceo ponovo da koristim neki svoj stari komp koji je pentium III i ima samo 128 Mb RAM , pokusao sam da instaliram instaliram nekoliko antivirusa ( AVG , Avast , Avira...) , ali logicno nijedan od njih nije mogao da radi na tako slabom kompu. zato sam skinuo Spybot i Malwarebytes . Prvo sam skenirao uz pomoc Spybot-a i on je pronasao 10-ak virusa , obrisao sam ih i pokrenuo Malwarebytes , on je pronasao 100+ virusa i obrisao sam i njih . Restartovao sam komp i skenirao ga ponovo ( Malwarebytes ) , i ponovo 100+ virusa. Pitanje je , kako da ih se resim zauvek?

Preuzmi Program DDS http://download.bleepingcomputer.com/sUBs/dds.scr
                 
Dvoklikom pokreni DDS
Sacekaj malo, izbacice ti dva loga
Kopiraj mi log DDS.txt

Evo:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2800.1106
Run by user at 16:33:09 on 2011-09-04
Microsoft Windows XP Professional  5.1.2600.1.1250.381.1033.18.127.7 [GMT 2:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\smsc.exe
D:\Program Files\Vip Internet\BackgroundService\ServiceManager.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Vip Internet\BackgroundService\ModemListener.exe
D:\Program Files\Vip Internet\ModemApplication.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.rs/
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\progra~1\spybot~1\SDHelper.dll
EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Malwarebytes' Anti-Malware] "d:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [VIP_Serbia Wave ModemListener] d:\program files\vip internet\backgroundservice\ModemListener.exe start
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoActiveDesktop = 00000000
IE: &Search
IE: Iz&vezi u Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: Interfaces\{B0DDF554-530B-4760-B790-A935F168ED76} : NameServer = 8.8.8.8 8.8.4.4
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\user\application data\mozilla\firefox\profiles\bmj6b131.default\
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
.
============= SERVICES / DRIVERS ===============
.
R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\drivers\Amps2prt.sys [2003-1-10 9728]
S3 cg300;cg300VidCap;c:\windows\system32\drivers\cg300vc.sys [1998-1-1 13468]
S3 cg300Au;cg300 Audio Capture;c:\windows\system32\drivers\cg300Au.sys [1998-1-1 17167]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys --> c:\windows\system32\drivers\ew_hwusbdev.sys [?]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys --> c:\windows\system32\drivers\ewusbnet.sys [?]
.
=============== Created Last 30 ================
.
2011-09-03 21:58:02   --------   d-----w-   c:\documents and settings\user\application data\PhotoScape
2011-09-03 18:55:39   106112   ----a-w-   c:\windows\system32\drivers\jrdusbser.sys
2011-09-03 18:50:08   --------   d-----w-   c:\program files\ACD
2011-09-03 15:06:47   38320   ----a-w-   c:\windows\system32\f3PSSavr.scr
2011-09-03 10:34:39   --------   d-----w-   c:\documents and settings\user\application data\Malwarebytes
2011-09-03 10:33:21   41272   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2011-09-03 10:33:11   --------   d-----w-   c:\documents and settings\all users\application data\Malwarebytes
2011-09-03 10:32:59   21048   ----a-w-   c:\windows\system32\drivers\mbam.sys
2011-09-03 07:17:11   --------   d-----w-   c:\documents and settings\all users\application data\Spybot - Search & Destroy
2011-09-02 19:42:51   50703   ----a-w-   c:\windows\system32\lpdd.exe
2011-09-01 16:19:10   50703   ------r-   c:\windows\system32\smsc.exe
2011-09-01 09:59:00   --------   d--h--w-   c:\windows\system32\GroupPolicy
2011-09-01 08:19:32   --------   d-----w-   c:\documents and settings\user\application data\.purple
2011-08-31 17:48:53   --------   d--h--w-   c:\documents and settings\all users\application data\Common Files
2011-08-31 17:48:24   --------   d-----w-   c:\documents and settings\all users\application data\MFAData
2011-08-31 03:18:49   --------   d-----w-   c:\documents and settings\all users\application data\mts mobilni internet
2011-08-31 03:18:10   14640   ------w-   c:\windows\system32\spmsgXP_2k3.dll
2011-08-31 03:17:42   28672   ----a-w-   c:\windows\system32\drivers\usbccid.sys
2011-08-31 03:17:42   1112288   ----a-w-   c:\windows\system32\drivers\WdfCoInstaller01007.dll
2011-08-31 03:17:14   1112288   ----a-w-   c:\windows\system32\wdfcoinstaller01007.dll
2011-08-31 03:14:28   --------   d-----w-   c:\documents and settings\all users\application data\DatacardService
2011-08-06 11:09:58   --------   d-----w-   c:\documents and settings\user\local settings\application data\Mozilla
.
==================== Find3M  ====================
.
2011-09-01 08:47:00   355086   ----a-w-   c:\windows\system32\PerfStringBackup.TMP
2011-08-06 11:09:52   404640   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-18 20:28:13   23   ----a-w-   c:\windows\clofghls.dll
.
============= FINISH: 16:35:04.95 ===============

Preuzmi ComboFix sa sledece adrese na Desktop:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe



Pokreni Combofix iskljucivo sa desktopa (I Agree)
Na svaki popup prozor klikci Yes \ Ok

Kad zavrsi skeniranje izbacice ti log na desktop

Kopiraj mi log ovde

Edit by chelavi1: Tomislave logove dijagnostickih alata smeju da zatraze samo moderatori i clanovi sa dozvolom, a vec ako trazis log, neka to bude od alata koji valja i nje zastareo  :wave: :wave:

 :P :P :P

[sorry za off ]

to kako si napisao da nemozes da obrises viruse,to moze samo jedno creckovan trojanac i zato ako nemas da kupis drugi racunar nosi kod majstora da sredi jer se i meni isto to desilo jer taj virus tesko ces da obrises,i ako deinstaliras sistem jer se patricije samo pune i pune dok hdd ne prsne.ovo sam rekao zato sto sam imao iskutsva sa tim.

Razocaracu te. Al nemas dozvolu da trazis i analiziras logove.. Pogotovo one koji nam nista nece reci (HJT logovii) u 80 % slucajeva o malware-u

Opsirnije

http://forum.burek.com/pc-klinika-pravila-i-preporuke-za-clanove-t427047.html



Vec je kod majstora  :[115]: Doduse virtuelnih, sto je jos bolje, ako pogledamo ko je sve danas majstor in real world.  :wave:

nisam mislio virtualne majstore nego prave da poprave i izbrisu to i flesuju bios.takoje kod mene bilo zbog tih virusa.ja mislim da sam u pravu.

ma kakvi pravi majstori , sta oni mogu da urade , a sto ne moze ovako :)  i da , sredio sam problem sa jos nekoliko skeniranja i brisanja (gledanjem karantina ukapirao sam da nisu isti virusi uvek u pitanju ) . nakon toga sam ocistio registar uz pomoc RegSeeker - a i sad komp juri 100 na sat :) hvala svima na ulozenom trudu .