Prebacio sam tvoj post u novu temu, biće lakše za snalaženje.

Elem, ovde na prvo gledanje upada u oči
vsbntlo.exe i av_md.exe

E sad, mene zanima jesi li ti skenirao računar sa Nod-om, jer bi on trebalo da eliminiše ovog trojanca ... mislim da ga ima u bazi samo pod drugim imenom
Takodje, zamolio bih te da preskeniraš računar sa Malwarebytes

Zoran je u pravu,ali skini trial Nod,ako vec ne posedujes licencu i free Malwarebytes'...nemoj sa nekim "neregularnim" verzijama da skeniras,dzabe ti je...ovaj virus ne bi trebao da predstavlja nikakav problem,samo poslusaj moderatora...prosto je...

odradih i jedno i drugo. Evo Nodovog fajla poslije skeniranja:

Scan Log
Version of virus signature database: 4686 (20091214)
Date: 12/14/2009 Time: 3:31:46 PM
Scanned disks, folders and files: Operating memory;C:\Boot sector;C:\
C:\hiberfil.sys - error opening [4]
C:\pagefile.sys - error opening [4]
C:\Documents and Settings\Epilog\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_000146 » INNO » files.info - file is not an archive
C:\Documents and Settings\Epilog\Local Settings\Temp\mm1.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm2.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm3.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temp\mm4.mht » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\Local Settings\Temporary Internet Files\Content.IE5\MD68AUQ1\l0a.ie6[2].js » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\malwarebytes\mbam-setup.exe » INNO » files.info - file is not an archive
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » PROCESS_LIBRARY.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HIRING_REQUISITION_CUSTOMIZED.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HARDWARE_TRACKER.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » HIRING_REQUISITION.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » CUSTOMER_SUPPORT.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » TRACK_ISSUES.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » STATUS_REPORT.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\MS Office 2007 blue edition\MO-07-sp2-egydown\Enterprise.WW\EnterWW.cab » CAB » POLICIES.FDT » MIME - is OK (internal scanning not performed)
C:\Documents and Settings\Epilog\My Documents\install\PLS360\Uls2008_2.19.34.exe » NSIS » convertdb.exe - archive damaged - the file could not be extracted.
C:\Documents and Settings\Epilog\My Documents\install\PLS360\Uls2008_2.19.34.exe » NSIS » Uls2008un.exe - incorrect CRC checksum, the file may be damaged
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\IVOD2H0X\l0a.ie6[1].js » MIME - is OK (internal scanning not performed)
C:\WINDOWS\system32\dllcache\atapi.sys - a variant of Win32/Kryptik.ABX trojan - cleaned by deleting - quarantined [1]
C:\WINDOWS\system32\drivers\atapi.sys - a variant of Win32/Kryptik.ABX trojan - unable to clean
Number of scanned objects: 153145
Number of threats found: 2
Number of cleaned objects: 1
Time of completion: 3:58:28 PM Total scanning time: 1602 sec (00:26:42)

Notes:
[1] Object has been deleted as it only contained the virus body.
[4] Object cannot be opened. It may be in use by another application or operating system.

-------------
Evo loga od malwarebyte-a:

Malwarebytes' Anti-Malware 1.42
Database version: 3357
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/14/2009 3:12:31 PM
mbam-log-2009-12-14 (15-12-24).txt

Scan type: Quick Scan
Objects scanned: 103838
Time elapsed: 2 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12cfg214-k641-12sf-n85p (Worm.AutoRun) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av_md (Trojan.Dropper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\av_md (Trojan.Dropper) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-8958109911-5019663954-600520128-1108\nissan.exe) Good: (Explorer.exe) -> No action taken.

Folders Infected:
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> No action taken.

Files Infected:
C:\RECYCLER\S-1-5-21-8958109911-5019663954-600520128-1108\nissan.exe (Worm.Autorun.B) -> No action taken.
C:\Documents and Settings\Epilog\Local Settings\Temp\~TM11.tmp (Worm.KoobFace) -> No action taken.
C:\Documents and Settings\Epilog\Local Settings\Temp\~TM145.tmp (Worm.KoobFace) -> No action taken.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Epilog\Application Data\wiaservg.log (Malware.Trace) -> No action taken.
----------------

koliko vidim ostao mi je jedan fajl neociscen. sto dalje radit...

Ček, jesi ti odabrao opciju na kraju skeniranja da malwarebytes pobriše sve nepoželjne fajlove?

Treba da piše
Quarantined and deleted successfully.
A ne
No action taken.

jesam ali mi nije jasno zasto nije odradio sto je trebao..
ali, uradih jos jedan i evo zadnjeg log-a

Malwarebytes' Anti-Malware 1.42
Database version: 3358
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

12/14/2009 4:20:23 PM
mbam-log-2009-12-14 (16-20-23).txt

Scan type: Quick Scan
Objects scanned: 104098
Time elapsed: 3 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
-----------

Zorane, usput puno hvala na pomoci jer me vec pocela bila glava boljet naveliko ;)