Problem sa vsbntlo.exe

vidim da se covjek koji je pokrenuo temu nije javljao vise, pa cu se ja nadovezat. Hijackthis mi je izbacio sledeci log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:51 PM, on 12/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Corel\Corel Graphics 12\Programs\CorelDRW.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Epilog\My Documents\install\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [av_md] C:\WINDOWS\system32\av_md.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Epilog\reader_s.exe
O4 - HKCU\..\Run: [av_md] C:\Documents and Settings\Epilog\av_md.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

--
End of file - 3301 bytes


+ problemcic mi je da mi je konekcija non stop aktivna iako ne skidam nista s neta, niti browse-ujem
molim da mi objasnite i pomognete sto i kako dalje

---

Prebacio sam tvoj post u novu temu, biće lakše za snalaženje.

Elem, ovde na prvo gledanje upada u oči
vsbntlo.exe i av_md.exe

E sad, mene zanima jesi li ti skenirao računar sa Nod-om, jer bi on trebalo da eliminiše ovog trojanca ... mislim da ga ima u bazi samo pod drugim imenom
Takodje, zamolio bih te da preskeniraš računar sa Malwarebytes

---

Zoran je u pravu,ali skini trial Nod,ako vec ne posedujes licencu i free Malwarebytes'...nemoj sa nekim "neregularnim" verzijama da skeniras,dzabe ti je...ovaj virus ne bi trebao da predstavlja nikakav problem,samo poslusaj moderatora...prosto je...

---

odradih i jedno i drugo. Evo Nodovog fajla poslije skeniranja:

Scan Log
Version of virus signature database: 4686 (20091214)
Date: 12/14/2009 Time: 3:31:46 PM
Scanned disks, folders and files: Operating memory;C:\Boot sector;C:\
C:\hiberfil.sys - error opening [4]
C:\pagefile.sys - error opening [4]
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_000146 » INNO » files.info - file is not an archive
C:\Documents and Settings\Epilog\Local Settings\Temp\mm1.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm2.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm3.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm4.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temporary Internet Files\Content.IE5\MD68AUQ1\l0a.ie6[2].js » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\malwarebytes\mbam-setup.exe » INNO » files.info - file is not an archive
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » PROCESS_LIBRARY.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HIRING_REQUISITION_CUSTOMIZED.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HARDWARE_TRACKER.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HIRING_REQUISITION.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » CUSTOMER_SUPPORT.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » TRACK_ISSUES.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » STATUS_REPORT.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » POLICIES.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\PLS360\Uls2008_2.19.34.exe » NSIS » convertdb.exe - archive damaged - the file could not be extracted.
C:\Documents and Settings\Epilog\My Documents\install\PLS360\Uls2008_2.19.34.exe » NSIS » Uls2008un.exe - incorrect CRC checksum, the file may be damaged
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IVOD2H0X\l0a.ie6[1].js » MIME - is OK (internal scanning not performed)
C:\WINDOWS\system32\dllcache\atapi.sys - a variant of Win32/Kryptik.ABX trojan - cleaned by deleting - quarantined [1]
C:\WINDOWS\system32\drivers\atapi.sys - a variant of Win32/Kryptik.ABX trojan - unable to clean
Number of scanned objects: 153145
Number of threats found: 2
Number of cleaned objects: 1
Time of completion: 3:58:28 PM Total scanning time: 1602 sec (00:26:42)

Notes:
[1] Object has been deleted as it only contained the virus body.
[4] Object cannot be opened. It may be in use by another application or operating system.

-------------
Evo loga od malwarebyte-a:

Malwarebytes' Anti-Malware 1.42
Database version: 3357
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/14/2009 3:12:31 PM
mbam-log-2009-12-14 (15-12-24).txt

Scan type: Quick Scan
Objects scanned: 103838
Time elapsed: 2 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12cfg214-k641-12sf-n85p (Worm.AutoRun) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av_md (Trojan.Dropper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av_md (Trojan.Dropper) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-8958109911-5019663954-600520128-1108\nissan.exe) Good: (Explorer.exe) -> No action taken.

Folders Infected:
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> No action taken.

Files Infected:
C:\RECYCLER\S-1-5-21-8958109911-5019663954-600520128-1108\nissan.exe (Worm.Autorun.B) -> No action taken.
C:\Documents and Settings\Epilog\Local Settings\Temp\~TM11.tmp (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\Epilog\Local Settings\Temp\~TM145.tmp (Worm.KoobFace) -> No action taken.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Epilog\Application Data\wiaservg.log (Malware.Trace) -> No action taken.
----------------

koliko vidim ostao mi je jedan fajl neociscen. sto dalje radit...

---

Ček, jesi ti odabrao opciju na kraju skeniranja da malwarebytes pobriše sve nepoželjne fajlove?

Treba da piše
Quarantined and deleted successfully.
A ne
No action taken.

---

jesam ali mi nije jasno zasto nije odradio sto je trebao..
ali, uradih jos jedan i evo zadnjeg log-a

Malwarebytes' Anti-Malware 1.42
Database version: 3358
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/14/2009 4:20:23 PM
mbam-log-2009-12-14 (16-20-23).txt

Scan type: Quick Scan
Objects scanned: 104098
Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
-----------

Zorane, usput puno hvala na pomoci jer me vec pocela bila glava boljet naveliko ;)

---