Problem sa vsbntlo.exe

vidim da se covjek koji je pokrenuo temu nije javljao vise, pa cu se ja nadovezat. Hijackthis mi je izbacio sledeci log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:51 PM, on 12/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Corel\Corel Graphics 12\Programs\CorelDRW.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\My Documents\install\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [av_md] C:\WINDOWS\system32\av_md.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Epilog\reader_s.exe
O4 - HKCU\..\Run: [av_md] C:\Documents and Settings\Epilog\av_md.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3301 bytes


+ problemcic mi je da mi je konekcija non stop aktivna iako ne skidam nista s neta, niti browse-ujem
molim da mi objasnite i pomognete sto i kako dalje

Potpis

Xtreme all the way

www.pktitograd.com

Prebacio sam tvoj post u novu temu, biće lakše za snalaženje.

Elem, ovde na prvo gledanje upada u oči
vsbntlo.exe i av_md.exe

E sad, mene zanima jesi li ti skenirao računar sa Nod-om, jer bi on trebalo da eliminiše ovog trojanca ... mislim da ga ima u bazi samo pod drugim imenom
Takodje, zamolio bih te da preskeniraš računar sa Malwarebytes

Potpis

Lomografija je kad imaš sa čime, a nećeš … a Pinhole kad nemaš sa čime, a hoćeš! ^tm

Zoran je u pravu,ali skini trial Nod,ako vec ne posedujes licencu i free Malwarebytes'...nemoj sa nekim "neregularnim" verzijama da skeniras,dzabe ti je...ovaj virus ne bi trebao da predstavlja nikakav problem,samo poslusaj moderatora...prosto je...

Potpis

A wolf is weaker than a lion and a tiger, but doesn't play in the circus.

odradih i jedno i drugo. Evo Nodovog fajla poslije skeniranja:

Scan Log
Version of virus signature database: 4686 (20091214)
Date: 12/14/2009 Time: 3:31:46 PM
Scanned disks, folders and files: Operating memory;C:\Boot sector;C:\
C:\hiberfil.sys - error opening [4]
C:\pagefile.sys - error opening [4]
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_000146 » INNO » files.info - file is not an archive
C:\Documents and Settings\Epilog\Local Settings\Temp\mm1.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm2.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm3.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm4.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temporary Internet Files\Content.IE5\MD68AUQ1\l0a.ie6[2].js » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\malwarebytes\mbam-setup.exe » INNO » files.info - file is not an archive
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » PROCESS_LIBRARY.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HIRING_REQUISITION_CUSTOMIZED.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HARDWARE_TRACKER.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HIRING_REQUISITION.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » CUSTOMER_SUPPORT.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » TRACK_ISSUES.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » STATUS_REPORT.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » POLICIES.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\PLS360\Uls2008_2.19.34.exe » NSIS » convertdb.exe - archive damaged - the file could not be extracted.
C:\Documents and Settings\Epilog\My Documents\install\PLS360\Uls2008_2.19.34.exe » NSIS » Uls2008un.exe - incorrect CRC checksum, the file may be damaged
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IVOD2H0X\l0a.ie6[1].js » MIME - is OK (internal scanning not performed)
C:\WINDOWS\system32\dllcache\atapi.sys - a variant of Win32/Kryptik.ABX trojan - cleaned by deleting - quarantined [1]
C:\WINDOWS\system32\drivers\atapi.sys - a variant of Win32/Kryptik.ABX trojan - unable to clean
Number of scanned objects: 153145
Number of threats found: 2
Number of cleaned objects: 1
Time of completion: 3:58:28 PM Total scanning time: 1602 sec (00:26:42)

Notes:
[1] Object has been deleted as it only contained the virus body.
[4] Object cannot be opened. It may be in use by another application or operating system.

-------------
Evo loga od malwarebyte-a:

Malwarebytes' Anti-Malware 1.42
Database version: 3357
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/14/2009 3:12:31 PM
mbam-log-2009-12-14 (15-12-24).txt

Scan type: Quick Scan
Objects scanned: 103838
Time elapsed: 2 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12cfg214-k641-12sf-n85p (Worm.AutoRun) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av_md (Trojan.Dropper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av_md (Trojan.Dropper) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-8958109911-5019663954-600520128-1108\nissan.exe) Good: (Explorer.exe) -> No action taken.

Folders Infected:
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> No action taken.

Files Infected:
C:\RECYCLER\S-1-5-21-8958109911-5019663954-600520128-1108\nissan.exe (Worm.Autorun.B) -> No action taken.
C:\Documents and Settings\Epilog\Local Settings\Temp\~TM11.tmp (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\Epilog\Local Settings\Temp\~TM145.tmp (Worm.KoobFace) -> No action taken.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Epilog\Application Data\wiaservg.log (Malware.Trace) -> No action taken.
----------------

koliko vidim ostao mi je jedan fajl neociscen. sto dalje radit...

Potpis

Xtreme all the way

www.pktitograd.com

Ček, jesi ti odabrao opciju na kraju skeniranja da malwarebytes pobriše sve nepoželjne fajlove?

Treba da piše
Quarantined and deleted successfully.
A ne
No action taken.

Potpis

Lomografija je kad imaš sa čime, a nećeš … a Pinhole kad nemaš sa čime, a hoćeš! ^tm