Ne mogu nikako da izbrisem ovaj spyware ili malware, ne znam sta je. Skenirao sam sve preko spybot-a i malwarebyte-a i i dalje je tu. Komp mi je usporen za oko 50%. Inace izbrisani su mi par txt fajlova i kad se ulogujem na npr youtube, posle par minuta se odloguje sam. Kako da resim problem? 

Evo HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 7:45:40 PM, on 2/26/2012
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Windows\SysWOW64\msiexec.exe
F:\Stari hard disk\D particija\download\tools\Utills\Sistemski alat\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe
O4 - HKLM\..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\RunOnce: [RegistryDefrag Success Message] "C:\Program Files (x86)\TuneUp Utilities 2012\TUMessages.exe" /RegDefrag_Success
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{03D7DCB7-A025-4EF4-83A2-3E2A30C9BD54}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{03D7DCB7-A025-4EF4-83A2-3E2A30C9BD54}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{03D7DCB7-A025-4EF4-83A2-3E2A30C9BD54}: NameServer = 156.154.70.22,156.154.71.22
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFReaderDriverCreatorReadSpool2 (NitroReaderDriverReadSpool2) - Nitro PDF Software - C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Sony Ericsson PCCompanion - Avanquest Software - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe (file missing)

Ne mogu da vidim iz HJT loga nista.

Idemo ovako.

Preuzmi ComboFix sa sledece adrese na Desktop:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Iskljuci AV

Pokreni Combofix iskljucivo sa desktopa (I Agree)


Kad zavrsi skeniranje izbacice ti log na desktop

Kopiraj mi log ovde

Stavio sam ga da se skenira i kad se zavrsilo ne mogu da udjem ni u jedan program, mozilla, notepad, bilo gde... Sad sam preko fona pa ne znam kako da ti posaljem log. Jedino da slikam pa da postavim preko moba?
Inace izbaci mi erorr "Illegal operation attempted on a registry key that has been marked for deletion"

Brate sad sam ga restartovaojer je blokirao totalno posle onog skeniranja. Nece da digne sistem niti u safe mode da udje. Samo treperi crta gore levo i to je to... Sta sad da mu radim?

EDIT: Hoce mi pomoci neko, treba mi komp zbog posla. 

Probaj Last Known Good Configurations. Ukoliko ne pomaze...

Pristupi kompu preko nekog Live CD-a. Ubuntu ima Live CD ( opcija try Ubuntu )
Upload-uj negde C:\Qoobox\Quarantine i C:\ComboFix pa baci link vamo.

Nesto je krenulo po zlu. E sad...ili je Windows OS vec bio toliko ostecen ( Platform: Unknown Windows (WinNT 6.01.3505 SP1) ) ili ti nisi iskljucio AV kako treba ili se neki malware umesao u rad CF-a...bez logova ne mozemo znati. Mozda si imao maliciozni rootkit u sistemu.
Mozemo pokusati to ispraviti ali je potrebno da ustanovimo gde je zapelo.


..............


edit:
Odradi ovo. Ovaj alat ce pristupiti OS-u i mozemo ustanoviti uzrok greske: Takodje, kada pristupis OS-u , kopiraj Quarantine i Combofix log. Ovaj alat radi samo na Visti i Windows7 OS-u.


Preuzmi program FRST (Farbar Recovery Scan Tool) i sacuvaj ga na flash drive ( USB memorijski uredjaj )


Download link za 32bit-ni ( x86 ) operativni system:
Download link za 64bit-ni operativni system:

• Ubaci flash drive u inficiran racunar.
  
• Pokreni System Recovery Options.
  
  Da bi pristupio System Recovery Options iz Advanced Boot Options odradi sledece:
  
  
  • Restartuj racunar i pritiskaj F8 dugme dok ti se ne pojavi Advanced Boot Options.
    
  • Klikni na Repair your computer
    
  • Izaberi US kao jezik za podesavanje jezika za tastaturu i klikni na Next.
    
  • Izaberi tvoj Operativni System i klikni na Next.
    ]Ukoliko imas dva ili vise instalirana operativna sistema,izaberi onaj koji sada radimo.
    
  • Izaberi svoj user account i klikni na Next.
    
  
  U System Recovery Options meniju imaces sledece opcije:
  
  Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
  
  
• Izaberi Command Prompt. Ukucaj "notepad" ( bez navodnika ) i pritisni Enter.
  
• Kada se startuje notepad klikni na File pa klikni na Open.
  
• Izaberi "Computer" da bi video koje je slovo dodeljeno tvom flash uredjaju.
  Obicno je to slovo "e:" ali to nije uvek slucaj.
  
• Upamti koje je slovo dodeljeno flash uredjaju i zatvori notepad.
  
• U Command Prompt ukucaj sledece:
  Za 32bit-ni ( x86 )Windows:
  
  Kod:
  e:\frst.exe
  
  Za 64bit-ni Windows ukucaj:
  
  Kod:
  e:\frst64
  
  Napomena: Umesto slova e upisi slovo od tvog flash uredjaja.
  
  
  • FRST ce se pokrenuti.
    
  • U prozoru koji se otvori klikni na Yes i a potom klikni na Scan dugme.
    
  
  
• Po zavrsetku skeniranja, program ce kreirati log ( FRST.txt ) koji ce se nalaziti na tvom flash uredjaju.
  

>>>>   Kopiraj sadrzaj tog loga uz poruku kao i Combofix log. Quarantine folder upload-uj negde pa postavi link:

Dobro je, taman sam skinuo taj program i pokrenuo komp, kad zamisli nekako je pokrenuo sistem. Evo nasao sam ComboFix na c:/

Evo uzrok problema:

Imas dva aktivna AntiVirus programa.
>> Deinstaliraces jedan a drugi antivirus ostavi.

U uklanjanju AV-a kao i / ili njegovih ostataka pokreni ovaj alat.

http://www.appremover.com/



>> Potom obrisi Combofix i preuzmi svez Combofix sa datih linkova. Ostavi taj drugi AV i dalje iskljucenog i pokreni Combofix i ovde okaci svez log.

Koji bolje da ostavim? Mislio sam da je Comodo samo Firewall...

Comodo i jeste Firewall ali je i AV-us. Ako si ti uradio instalaciju nisi pazio pa si dozvolio i instalaciju i Comodo AntiVirusa.

U principu oba AV-sa su vrlo dobro za nase podrucje. Izaberi koje zelis. Preporucujem avast jer je besplatan mada comodo ti pruza veci opseg sigurnosti. Ako si kupio comodo onda ukloni avast. Izbor je na tebi. Baci se na posao dok sam jos tu 

Evo brisem, skeniram, kacim log...