Virtual box suck

Pre nekoliko dana je pocela da mi se pojavljuje poruka "VIRTUAL BOX SUCK" koju ne mogu nikako da iskljucim, osim preko Task Managera, ali opet se pojavljuje pri svakom restartovanju kompjutera.
Pocelo je da mi se pojavljuje kada sam prikljucio drugaricin USB na komp.
Evo kako izgleda:

Imam "Avast home" antivirus i on ne pronalazi nikakav virus.
Hvala unapred na pomoci...

LOL! Sta kaze kada pritisnes OK? Vidi da li je u servisima (Control Panel->Administrative Tools->Services) ukljucen "Messenger service". Ako jeste iskljuci ga.

Avast nije anti virus, avast je igračka, a što pre to ljudi shvate, biće bolje.

Uzmi bilo koji drugi antivirus iole bolji, ako baš oćeš besplatni, neka bude Avira free i skeniraj komp.

Moja preporuka Kaspersky naravno, a ako baš hoćeš da zadržiš avast, onda skini http://www.malwarebytes.org/mbam.php i očisti to.

Potpis

... Vladimir Vučićević aka. Bachi
~~~ www.bachi.in.rs <<<<>>>> [email protected]
>>> It's nice to be important, but it's more important to be nice...

:) ... Prvi put vidim
Okači nam HijackThis logo fajl ... Uputstvo se nalazi OVDE

@ bachi, miroslav

Antivirusi: besplatni vs plaćeni ... potreba ili razbacivanje resursima :)

Potpis

Lomografija je kad imaš sa čime, a nećeš … a Pinhole kad nemaš sa čime, a hoćeš! ^tm

Hvala na odgovorima. Izgleda da ga je ocistio Malwarebytes...

Koristan info u svakom slučaju.

Ako je problem ipak kojim slučajem opstao, javi mi na PP da otključam temu.

EDIT:
Malwarebytes nije resio problem ...idemo dalje ;)

Potpis

Lomografija je kad imaš sa čime, a nećeš … a Pinhole kad nemaš sa čime, a hoćeš! ^tm

Malocas sam prikljucio mobilni telefon na komp i kada sam pokusao da udjem na karticu sacekalo me je iznenadjenje: "VIRTUAL BOX SUCK" :)
Mogu da udjem na karticu kada odem na desni klik i explore.
Evo ga i moj HijackThis logo fajl:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:30:29, on 3.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\AlienGUIse\wbload.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\hasplms.exe
F:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\CDBurnerXP\NMSAccessU.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\Mixer.exe
F:\Program Files\Google\Gmail Notifier\gnotify.exe
F:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
F:\Documents and Settings\Milan\rundli32.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\MyFreeWeather\myweather.exe
F:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\Winamp\winamp.exe
F:\Program Files\Opera\opera.exe
C:\LiveUSB.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashQuick.exe
F:\HiJackThis\Nenad.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - F:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - F:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] F:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NokiaMServer] F:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [GrooveMonitor] "F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "F:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Updater] F:\Documents and Settings\Milan\rundli32.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "F:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "F:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "F:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [myweather] "F:\Program Files\MyFreeWeather\myweather.exe" /autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Alienware Dock.lnk = F:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - F:\WINDOWS\system32\hasplms.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - F:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMSAccessU - Unknown owner - F:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6589 bytes

Pitao sam da proveris da li ti je "Messenger Service" ukljucen u servisima? Nisam pitao bez veze.

Zaboravio sam da ti odgovorim...
Iskljucen mi je "Messenger Service", cak sam ga iskljucivao i pomocu ovog programa da bi bio siguran:
http://www.grc.com/stm/shootthemessenger.htm

Upotreba specijalizovanih alata za ciscenje malware-a nije samo "Next > Next > Finish" - MBAM je trazio restart da bi napast bila ociscena, ali to izgleda nije uradjeno. Hajde ponovo pokreni MBAM, kada zavrsi sa skeniranjem idi na "Show Results", proveri da li je sve stiklirano, odaberi "Remove Selected", potvrdi sa OK, i ako pita za restart odmah to uradi pritiskom na odgovarajuce dugme u tom dijalog boxu. Posle toga ponovo odradi skeniranje sa HJT, cini mi se da ima tu kandidata za uklanjanje. I pre nego sto odradis skeniranje sa HJT, pozatvaraj sve programe tipa opere, winampa i slicnih, ovako samo log izgleda natrpanije i otezava pracenje.

Restartovao sam sam kompjuter kada me je pitao.
Evo sada sam skenirao opet komp i nije nista nasao Malewarebytes...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:19:14, on 3.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\AlienGUIse\wbload.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\hasplms.exe
F:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\CDBurnerXP\NMSAccessU.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\Mixer.exe
F:\Program Files\Google\Gmail Notifier\gnotify.exe
F:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
F:\Documents and Settings\Milan\rundli32.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\MyFreeWeather\myweather.exe
F:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\Winamp\winamp.exe
F:\Program Files\Opera\opera.exe
F:\Program Files\uTorrent\uTorrent.exe
F:\HiJackThis\Nenad.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - F:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - F:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] F:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NokiaMServer] F:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [GrooveMonitor] "F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "F:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Reader Updater] F:\Documents and Settings\Milan\rundli32.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "F:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "F:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "F:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [myweather] "F:\Program Files\MyFreeWeather\myweather.exe" /autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Alienware Dock.lnk = F:\Program Files\AlienGUIse\AlienwareDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - F:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HASP License Manager (hasplms) - Aladdin Knowledge Systems Ltd. - F:\WINDOWS\system32\hasplms.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - F:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMSAccessU - Unknown owner - F:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6571 bytes

Evo ga opet ovaj:



No nema veze. Posalji ovaj fajl

F:\Documents and Settings\Milan\rundli32.exe

na

http://www.virustotal.com/rs/

pa vidi sta kaze - pre nekih 5-6 godina postojao je neki LADE crv koji se maskirao pod tim imenom, a i ovaj mi "smrdi" da ako nije bas taj, onda je neki njegov bliski rodjak...

Ne znam da li sam ja corav ili tog fajla nema tamo gde treba da bude:


Ne znam kako da ga nadjem...

Pogledajte uz pomoc GMER-a

Nasao sam ovaj fajl pomocu GMER-a i prekopirao ga na desktop, posto ne znam kako bi ga drugacije poslao na http://www.virustotal.com/rs/
Kada sam ga uploadovao na ovaj sajt, samo mi je otvorilo prazan prozor i nista se ne desava. Ili je sajt preopterecen ili mene nece da radi. Pokusao sam vise puta da uploadujem i uvek se isto desava...
Jel postoji neki drugi nacin da proverim ovaj fajl?

Skini Kaspersky 9 Trial, deinstaliraj Avast, instaliraj Kaspersky 9 trial , uradi update i očisti tog crva.

Posle, ako hoćeš vrati Avast ;)

Potpis

Lomografija je kad imaš sa čime, a nećeš … a Pinhole kad nemaš sa čime, a hoćeš! ^tm

F:\Documents and Settings\Milan\rundli32.exe je 100% neko djubre...

i verovatno je sakriven (hidden)...

skini prfree programcic - izlista aktivne programe a sa kill imas i opciju obrisi fajl :)

Pokusacu prvo sa Kasperskim, pa ako ne uspe onda idemo dalje...
Ima i ovaj program GMER opciju "kill", samo ne znam koliko je pametno da uradim to.
I kako da znam da necu da napravim jos veci problem, ako "ubijem" taj fajl?

Prekopirajte taj fajl u neki folder pa ga izbrisite. Ako bude problema, samo ga vratite (ne verujem da ce ih biti, mozda ce cak i nestati :D).
Samo jedno pitanjce - jeste li skenirali racunar uz pomoc MBAM-a i Dr.Web CureIt!-a?