"Pushbot.vr" problem

neznam kako, ali nekako mi se uspio usuljati navedeni worm u sistem, moze biti da je mala sestricna koja je jucer bila na kompjuteru skinula nesto dok mene nije bilo u blizini...

microsoft essentials mi javlja da se navedeni program pokusava aktivirati, ja sam stisnuo da ga makne, sto je i napravio, ali nakon 5 minuta se javlja ista poruka...ako ima dobre duse sa znanjem da mi pomogne rijesiti se malog napasnika, bio bi jako zahvalan.

Pushbot je veoma zaribana stvar ako će se ubuduće pojavljivati probaj ovo http://www.zimbio.com/Latest+Computer+Threats/articles/lNcW42dkj5x/Manually+Remove+Worm+Win32+Pushbot+VJ+Instructions

evo logova od otsa i rouge killera

http://speedy.sh/6KQRN/RKreport-1.txt

http://speedy.sh/mVySk/OTS.Txt

http://speedy.sh/k4QsD/2.txt

http://speedy.sh/t9yJv/06202012-143230.log

evo od mbama log

usb stickove cu kasnije cistit, moram ih prvo sve nac a i moram sad ic. dodem kasnije doma, pa rijesim to.

hvala na pomoci

http://speedy.sh/B6FXz/mbam-log-2012-06-20-15-41-40.txt

...procitaj post od Total-a KLIK (na pocetku teme) i napravi sta kaze, vjerojatno ce ti se on javit kasnije...

otvori OTS i ovo kopiraj u prazno polje

[Kill All Processes]

[Unregister Dlls]

[Processes - Safe List]

YY -> bprotect.exe -> C:\ProgramData\bProtectorForWindows\2.2.432.10\bProtect.exe

YY -> ibsvc.exe -> C:\ProgramData\IBUpdaterService\ibsvc.exe

[Modules - No Company Name]

YY -> protector.dll -> C:\ProgramData\bProtectorForWindows\2.2.432.10\protector.dll

[Win32 Services - Safe List]

YY -> (bProtector) bProtector [Auto | Running] -> C:\ProgramData\bProtectorForWindows\2.2.432.10\bProtect.exe

YY -> (IBUpdaterService) Updater Service [Auto | Running] -> C:\ProgramData\IBUpdaterService\ibsvc.exe

[Driver Services - Safe List]

YY -> (cebktwfc) cebktwfc [Kernel | System | Stopped] -> C:\Windows\System32\drivers\cebktwfc.sys

[Registry - Safe List]

< Internet Explorer Settings [HKEY_USERS\S-1-5-21-794456854-922485584-2299247323-1001\] > -> 

YN -> HKEY_USERS\S-1-5-21-794456854-922485584-2299247323-1001\: Main\\"Start Page" -> http://domredi.com/1/

YN -> HKEY_USERS\S-1-5-21-794456854-922485584-2299247323-1001\: Main\\"Start Page Redirect Cache_TIMESTAMP" -> 53 F8 25 DF 47 15 CC 01  [binary data]

< HOSTS File > ([2006-02-08 04:19:40 | 000,000,946 | ---- | M] - 27 lines) -> C:\Windows\System32\drivers\etc\hosts

YN -> Reset Hosts -> 

< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

YY -> {11111111-1111-1111-1111-110011221158} [HKLM] -> C:\Program Files\I Want This\I Want This.dll [I Want This]

< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls

YY -> c:\progra~2\bprote~1\22432~1.10\protec~1.dll -> c:\ProgramData\bProtectorForWindows\2.2.432.10\protector.dll

< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

YN -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck]

[Files/Folders - Created Within 30 Days]

NY ->  cebktwfc.sys -> C:\Windows\System32\drivers\cebktwfc.sys

NY ->  cdbspuwo.sys -> C:\Windows\System32\drivers\cdbspuwo.sys

NY ->  searchplugins -> C:\searchplugins

NY ->  searchplugins -> C:\Users\User\Desktop\searchplugins

NY ->  searchplugins -> C:\Users\User\searchplugins

NY ->  bProtectorForWindows -> C:\ProgramData\bProtectorForWindows

NY ->  I Want This -> C:\Users\User\AppData\Local\I Want This

NY ->  I Want This -> C:\Program Files\I Want This

NY ->  IBUpdaterService -> C:\ProgramData\IBUpdaterService

NY ->  Pando Networks -> C:\Program Files\Pando Networks

[Files/Folders - Modified Within 30 Days]

NY ->  cebktwfc.sys -> C:\Windows\System32\drivers\cebktwfc.sys

NY ->  fwdfy.exe -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fwdfy.exe

NY ->  gjmnlu.exe -> C:\Users\User\AppData\Local\gjmnlu.exe

NY ->  cdbspuwo.sys -> C:\Windows\System32\drivers\cdbspuwo.sys

NY ->  1749 C:\Users\User\AppData\Local\Temp\*.tmp files -> C:\Users\User\AppData\Local\Temp\*.tmp

NY ->  1749 C:\Users\User\AppData\Local\Temp\*.tmp files -> C:\Users\User\AppData\Local\Temp\*.tmp

[Files - No Company Name]

NY ->  fwdfy.exe -> C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fwdfy.exe

NY ->  gjmnlu.exe -> C:\Users\User\AppData\Local\gjmnlu.exe

NY ->  qjaxlkio.dss -> C:\ProgramData\qjaxlkio.dss

[File - Lop Check]

NY ->  Babylon -> C:\Users\User\AppData\Roaming\Babylon

[Alternate Data Streams]

NY -> @Alternate Data Stream - 388 bytes -> C:\Windows\System32\drivers\cdbspuwo.sys:changelist

NY -> @Alternate Data Stream - 528 bytes -> C:\Windows\System32\drivers\cebktwfc.sys:changelist

[Purity]

[Empty Temp Folders]

[EmptyFlash]

[EmptyJava]

[Start Explorer]

[Reboot]

..da li bi nesto od tih "problema" rijesio neki od ovih programa:

 - MBAM

 - HitmanPro

 - Emsisoft Emergency Kit

 - CCE

...ili...

..neki od Live CD (npr. Kaspersky Rescue Cd...)

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Mozes mi reci sta znaci ono YY ili YN ili NY ispred svake "stavke"?

Sve sam uradio kako treba, i evo vec nekih 30minuta mi se niije ama bas nista pojavljivalo za viruse, i cak izgleda da mi je komp malo brzi nego prije :)!
Mnogo sam zahvalan na pomoci, momci hvala vam puno, total tebi najvise!!!!!
Evo i logova od OTS-a i ComboFix-a

http://speedy.sh/rfHZu/ComboFix-log.txt
http://speedy.sh/37U5Q/06252012-122839.log 
!!! 

Jedino sto ja jos mogu savjetovati je da sacekas jos malo Total-a (da vidi da li je sve OK), a usput mozes skenirat komp sa MBAM i HitmanPro.

To dolje je od Windowsa, to ti je Windows Defender i on bi trebao bit ugasen kad se stavi neki AV.

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Eto kad nemas original obavezno ga deinstaliraj i stavi neki Free AV + MBAM (free) i HitmanPro u rezervi.

Preporuka: Avira Free 

A cek cek, zadnji put kad sam to radio, stavljao drugi antivirus, morao sam da ga nosim na popravku jer sam imao 2 antivirusa :D, pa kako da uradim, dami se to opet ne desi :D?
PS: ESE NOD32 Antivirus 4 se tacnije zove ^^....

start/run/ u run polje kopiraj ovo i potvrdi

combofix /uninstall

otvori OTS i klik na CLEAN UP

ovo će izbrisati OTS i combofix ostatke

još ćemo provjeriti računalo s malwarebytesom, malwarebytes će pronaći još neke sitnice i kad se to izbriše bit će ok

skini malwarebytes>instaliraj program >pokreni update

-odaberi full scan /kompletna provjera

-log koji odnijš na kraj scana kopiraj

99,99 % sam siguran da svi scaneri nebi očistili računalo, svi ovi programi se baziraju na definicijama i ako nema definicije, računalo je čisto

HitmanPro treba izbjegavati za čiščenje računala, ..program je ok za provjeriti,a nikako za čistiti..u protivnom se dobije 

ovo

YY= yes/yes

YN=yes/no

NY=no/yes

Evo ja sam to uradio, izbrisao ComboFix, i OTS, i restartovao, sta sad, treba li jos sta?