C:\WINDOWS\system32\restorer32_a.exe
C:\WINDOWS\System32\reader_s.exe
C:\Users\Administrator\reader_s.exe
F3 - REG:win.ini: load=C:\WINDOWS\fonts\services.exe
F3 - REG:win.ini: run=C:\WINDOWS\fonts\services.exe
O4 - HKLM\..\Run: [21488] C:\WINDOWS\system32\EF2.tmp.exe
O4 - HKLM\..\Run: [restorer32_a] C:\WINDOWS\system32\restorer32_a.exe
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKCU\..\Run: [reader_s] C:\Users\Administrator\reader_s.exe
O4 - HKCU\..\Run: [restorer32_a] C:\Users\Administrator\restorer32_a.exe
O4 - HKLM\..\Policies\Explorer\Run: [exec] C:\WINDOWS\fonts\services.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [LXPNewUser] %SystemRoot%\System32\TrunksLXP-NUserFix.cmd (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [restorer32_a] C:\Users\Administrator\restorer32_a.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LXPNewUser] %SystemRoot%\System32\TrunksLXP-NUserFix.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [restorer32_a] C:\Users\Administrator\restorer32_a.exe (User 'Default user')
Neutral (3.27 / 5.00)
O4 - HKUS\.DEFAULT\..\RunOnce: [LXPNewUser] %SystemRoot%\System32\TrunksLXP-NUserFix.cmd (User 'Default user')


Ukloni ovo, mada ... uz taj LastXP i gomilu krekova ....

Za sada radi,videcemo... Hvala na pomoci.

Dobro bez krekova se ne moze :) Ali bez tog custom djubr.. windowsa moze. Instaliraj normalnu instalaciju pa ga onda sminkaj do mile volje... Ti custom windowsi dolaze sa preinstaliranim virusima...

uh...ti izmedju ostalog imas i Virut...a tu malo sta pomaze... i ne moze da se izleci iz aktivnog Windowsa...
i nista ih ne moze obrisati tako lako pa ni mocni Combofix

C:\WINDOWS\System32\reader_s.exe

moja preporuka..(sto je najbolje) format C i odmah na svezem Windowsu Dr.Web Curit ili neki AntiVirus Live CD ,a moze i avast (jer avast ima boot scan) ...
kao "additional" scan ..malwarebytes antimalware...sve sto nadju obrisi!
bitno je na ne becupujes sve .exe ili .scr fajlove (to su uglavnom neki tvoji programi i instalacije..jer su i oni inficirani ,a ako pokrenes inficiranu instalaciju...jovo nanovo...)
...etc...


info::
http://www.secureworks.com/res...ats/virut-encryption-analysis/
http://vil.nai.com/vil/content/v_143034.htm



Dr.Web::



Srecno


PS: nakog nekog vremena ponovo pokreni HijackThis i videces da ce se pola HJT unosa "vratilo"

Realno,koliko je opasan taj Virut? Da ne bih ponovo instalirao windows, pokusacu ovu "kracu" opciju koju je dao Dashkes. Ako mi se u hijack logu nakon toga ne pojavi nesto kao reader_s.exe, da li sam siguran da sam ga se resio?

Nisi 100% siguran ...rekoh da cak ni Combofix +CFScript ne moze da ga ukloni a kamoli HJT ili rucno brisanje file-a.
Dr.Web ga uklanja ali ...iz aktivnog Windowsa se taj virus tesko odstranjuje...
zato sam ti i rekao...najsigurnije resenje..Becup tvojih podataka (samo ne programa) , FormatC..now Windows...pa odmah Dr.Web (imas gore uputstvo)
pa instaliraj avast ( update pa selektuj boot scan ) ...i onda bi trebalo da je system 100% cist...ali ako sacuvas neki krek (jer je taj malware i najverovatnije i dosao preko kreka) i pokrenes ga..jovo nanovo...kapiras?

Danas sam skenirao racunar sa Dr.Web, HDD 640Gb, 3 particije-potrajalo je oko 10 sati. Skenirano je 975365 fajlova, a od toga je inficirano 911, sumnjivo 3, adware 6, jokes 2, hacktools 17."izlecio" je 899, 5 je izbrisao, premestio je 15. Ali i dalje ne mogu da nadjem koliko je realno opasan taj virus, dakle, sta moze da uradi?

Ako piše virut, mani se ćorava posla, jer ćeš skenirati opet i opet će ti naći isto to ... bez obzira što piše da su fajlovi očišćeni.

Ja sam ti dao jedan link...ako taj nevalja...google ..keyword "what is Virut?" ...i sve ce ti se samo kazti :)

evo jos jedna pomoc:

http://remove-malware.com/anti...rut-and-why-is-it-sooooo-evil/

Uradio sam kako ste rekli-instalirao svez windows, iskljucio system restore, nakon toga u safe modu skenirao sa dr.web-om i jos nakon toga, skinuo i narezao Dr.Web Live CD i sa njim skenirao. Na C particiji nije vise nadjeno nista. Na D particiji je pronasao, ali sam te programe rucno izbrisao (to su samo instalacije programa, a ne instalirani programi na D particiji). Izbrisao sam i onaj folder system restore... E sada, finalno pitanje-ako ga Dr.Web vise ne nadje u racunaru, da li to znaci da sam se resio virut-a???

_{[Ovu poruku je menjao elektros dana 09.10.2009. u 17:54 GMT+1]}

pa trebalo bi da je tako ali to ti sa sigurnoscu niko ne moze tvrditi. Ja cu ti proveriti C particiju,a za drugu particiju svaki program brisi jer znaj da je inficiran.Ako ga pokrenes...i ako ga AV ne blokira na vreme..sve ispocetka.
Znaci AntiVirus moras imati (za sad preporucujem Avast!,a ako ti se nesvidi,promeni ga kasnije)

Sad,sto se tice C particije...procitaj Top Temu i Uputstvo o koriscenju Combofix-a!

Znaci... 1 .Iskljuci AntiVirus
2.Po uputstvu skini na Desktop CF i pokreni ga
3.kopiraj ovamo log koji dobijes

Danas nemam vremena da pokrecem Combofix, ali cu to uraditi sutra ili prekosutra. Malo sam "tvrdoglav" i "zao" mi je da brisem instalacije sa D particije (uglavnom igre), a i nasao sam negde na internetu da Virut ne napada sve exe fajlove, pa za sada necu brisati te instalacije ako ih Dr.Web nije oznacio kao inficirane. Kada instaliram neku od tih igara, i ako mi se ponovo pojavi virut, e onda cu sigurno sve obrisati, sacuvati podatke i uraditi format svih particija!

Evo Combofix log-a:

ComboFix 09-10-11.01 - Administrator 12.10.2009 9:45.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.712 [GMT -7:00]
Running from: c:\users\Administrator\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091011-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Data
c:\windows\system32\install.exe
d:\my documents\java.exe

.
((((((((((((((((((((((((( Files Created from 2009-09-12 to 2009-10-12 )))))))))))))))))))))))))))))))
.

2009-10-11 17:34 . 2001-08-18 05:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-10-11 17:34 . 2004-08-04 07:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-10-11 17:34 . 2004-08-04 05:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-10-10 02:50 . 2007-05-18 00:30 318976 ----a-w- c:\windows\system32\avisynth.dll
2009-10-10 02:50 . 2004-02-22 17:11 719872 ----a-w- c:\windows\system32\devil.dll
2009-10-10 02:50 . 2005-07-14 19:31 27648 ----a-w- c:\windows\system32\AVSredirect.dll
2009-10-10 02:50 . 2004-01-25 07:00 70656 ----a-w- c:\windows\system32\yv12vfw.dll
2009-10-10 02:50 . 2004-01-25 07:00 70656 ----a-w- c:\windows\system32\i420vfw.dll
2009-10-10 02:50 . 2009-10-10 02:50 -------- d-----w- c:\program files\AviSynth 2.5
2009-10-10 02:48 . 2008-03-16 12:30 216064 --sh--r- c:\windows\system32\nbDX.dll
2009-10-10 02:48 . 2007-02-21 10:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2009-10-10 02:48 . 2006-05-03 09:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2009-10-10 02:48 . 2009-10-10 02:48 -------- d-----w- c:\program files\eRightSoft
2009-10-09 22:12 . 2004-08-04 06:10 38016 ----a-w- c:\windows\system32\drivers\bthmodem.sys
2009-10-09 22:09 . 2004-08-04 05:58 100992 ----a-w- c:\windows\system32\drivers\bthpan.sys
2009-10-09 22:08 . 2004-08-04 07:56 8192 ----a-w- c:\windows\system32\wshirda.dll
2009-10-09 22:08 . 2004-08-04 06:10 59648 ----a-w- c:\windows\system32\drivers\rfcomm.sys
2009-10-09 22:08 . 2004-08-04 06:10 17024 ----a-w- c:\windows\system32\drivers\bthenum.sys
2009-10-09 22:08 . 2004-08-04 07:56 152576 ----a-w- c:\windows\system32\irftp.exe
2009-10-09 22:08 . 2004-08-04 07:56 27136 ----a-w- c:\windows\system32\irmon.dll
2009-10-09 22:08 . 2004-08-04 06:10 274304 ----a-w- c:\windows\system32\drivers\bthport.sys
2009-10-09 22:08 . 2004-08-04 06:10 18944 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS
2009-10-09 22:07 . 2009-10-09 22:07 -------- d-----w- C:\Drivers
2009-10-09 20:12 . 2009-10-09 20:12 -------- d-----w- c:\users\Administrator\Local Settings\Application Data\WMTools Downloaded Files
2009-10-09 01:50 . 2009-10-09 01:50 -------- d-----w- c:\users\Administrator\Application Data\Malwarebytes
2009-10-09 01:50 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 01:50 . 2009-10-09 01:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-09 01:50 . 2009-10-09 01:50 -------- d-----w- c:\users\All Users\Application Data\Malwarebytes
2009-10-09 01:50 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-08 23:40 . 2009-10-08 23:40 25464 ----a-w- c:\users\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-08 23:37 . 2009-10-08 23:37 -------- d-----w- c:\users\Administrator\Application Data\Ahead
2009-10-08 20:39 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-08 20:39 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-08 20:39 . 2009-09-15 10:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-08 20:39 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-08 20:39 . 2009-09-15 10:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-08 20:39 . 2009-09-15 10:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-08 20:39 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-08 20:39 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-08 20:39 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-08 20:39 . 2009-10-08 20:39 -------- d-----w- c:\program files\Alwil Software
2009-10-08 19:43 . 2009-10-10 01:51 -------- d-----w- c:\users\Administrator\DoctorWeb
2009-09-27 04:09 . 2009-09-27 04:09 -------- d-----w- c:\users\All Users\Application Data\TuneUp Software
2009-09-27 04:09 . 2009-09-27 04:09 -------- d-----w- c:\users\Administrator\Application Data\TuneUp Software
2009-09-27 04:08 . 2004-08-04 06:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-09-27 04:07 . 2005-03-22 15:00 65536 ----a-w- c:\windows\system32\CNAB4SMK.DLL
2009-09-27 04:07 . 2005-03-22 15:00 57344 ----a-w- c:\windows\system32\CNAB4RPK.EXE
2009-09-27 04:07 . 2005-03-22 15:00 28672 ----a-w- c:\windows\system32\CNAB4PTU.DLL
2009-09-27 04:07 . 2005-03-22 15:00 28672 ----a-w- c:\windows\system32\CNAB4LMK.DLL
2009-09-27 04:07 . 2005-03-22 15:00 135168 ----a-w- c:\windows\system32\CNAB4EMU.DLL
2009-09-27 04:07 . 2009-09-27 04:08 -------- d-----w- c:\program files\Canon
2009-09-27 04:03 . 2009-09-27 04:03 -------- d-----w- c:\program files\Alcohol Soft
2009-09-27 04:02 . 2009-09-27 04:02 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-09-27 04:01 . 2009-09-27 04:01 -------- d-----w- c:\users\Administrator\Local Settings\Application Data\Adobe
2009-09-27 04:01 . 2009-09-27 04:01 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-09-27 04:00 . 2009-09-27 04:00 -------- d-----w- c:\program files\Common Files\Adobe
2009-09-27 03:59 . 2009-09-27 03:59 -------- d-----w- c:\program files\The KMPlayer
2009-09-27 03:57 . 2009-10-10 02:59 -------- d-----w- c:\users\Administrator\Application Data\Thinstall
2009-09-27 03:51 . 2009-09-27 03:51 -------- d-----w- c:\users\Administrator\Local Settings\Application Data\Identities
2009-09-27 02:08 . 2009-09-27 02:08 -------- d-----w- c:\program files\Microsoft Works
2009-09-27 02:04 . 2009-09-27 02:04 -------- d-----w- c:\windows\SHELLNEW
2009-09-27 02:04 . 2009-09-27 02:04 -------- d-----w- c:\users\Administrator\Local Settings\Application Data\Microsoft Help
2009-09-27 02:04 . 2009-09-27 02:09 -------- d-----w- c:\users\All Users\Application Data\Microsoft Help
2009-09-27 02:04 . 2009-09-27 02:04 -------- d-----r- C:\MSOCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-27 04:07 . 2009-09-27 01:33 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-27 01:44 . 2009-09-27 01:39 -------- d-----w- c:\program files\Creative
2009-09-27 01:44 . 2009-09-27 01:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-27 01:35 . 2009-09-26 18:19 4840 ----a-w- c:\windows\system32\drivers\INFCACHE.1
2009-09-27 01:30 . 2009-09-27 01:30 -------- d-----w- c:\program files\ULI5289
2009-09-27 01:30 . 2009-09-27 01:30 12628 ----a-w- c:\windows\system32\drivers\netuli.PNF
2009-09-27 01:28 . 2009-09-27 01:28 295 ----a-w- c:\windows\system32\StartAU.cmd
2009-09-27 01:26 . 2009-09-27 01:26 -------- d---a-w- c:\program files\Utilities
2009-09-27 01:24 . 2009-09-27 01:24 -------- d-----w- c:\program files\VAIOXP
2009-09-27 01:21 . 2009-09-27 01:21 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-27 01:21 . 2009-09-27 01:21 -------- d-----w- c:\program files\Windows Media Connect 2
2006-05-03 09:06 . 2009-10-10 02:48 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-10-10 02:48 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-10-10 02:48 216064 --sh--r- c:\windows\system32\nbDX.dll
.

------- Sigcheck -------

[-] 2007-06-28 . 1A5FB58FC6E970A308719A4EA49EB8B5 . 360704 . . [5.1.2600.3002] . . c:\windows\system32\drivers\tcpip.sys

[-] 2007-06-28 . 69A39AAFF83508304FC92B49A81915DE . 2321792 . . [5.1.2600.3093] . . c:\windows\system32\ntoskrnl.exe

[-] 2007-06-28 . C7BCEA1533BE5C9E15884D6C39B667F1 . 80216 . . [7.0.6000.374] . . c:\windows\system32\wuauclt.exe

[-] 2007-03-14 . E373EBA833DBBC604726CF51A450E583 . 1656832 . . [6.00.2900.2894] . . c:\windows\explorer.exe


c:\windows\system32\regsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 102400]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALi5289"="c:\program files\ULI5289\ALi5289.exe" [2005-06-07 409600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-28 8466432]
"WinSys2"="c:\windows\system32\winsys2.exe" [2006-04-29 208896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-28 81920]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-06-28 1626112]
"P17Helper"="P17.dll" - c:\windows\system32\P17.dll [2005-05-03 64512]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2004-08-04 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"LXPNewUser"="c:\windows\System32\TrunksLXP-NUserFix.cmd" [2007-06-28 2303]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2007-06-28 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\CNAB4RPK.EXE"=

R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [2.7.2007 23:03 52480]
R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\drivers\AGPKX.SYS [26.9.2009 18:30 45056]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8.10.2009 13:39 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8.10.2009 13:39 20560]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [26.9.2009 18:30 28672]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ASPI32
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: {430CAA2F-2111-44DB-8F4F-44FC0697EBE3} = 212.200.191.166,212.200.190.166
.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - c:\users\Administrator\Desktop\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-12 09:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-10-12 9:49
ComboFix-quarantined-files.txt 2009-10-12 16:49

Pre-Run: 47.656.886.272 bytes free
Post-Run: 47.648.870.400 bytes free

183

Ok,Combofix log je cist,mada je pronasao par stvari na drugoj particiji sa .exe extenzijom koji su jos inficirani.
Nebi bilo lose da jos jednom "precesljas" drugu particiju i obrises sve stvari sa .exe extenzijom...jer ili su svi inficirani i cekaju "aktivaciju" ili su osteceni.

Uninstaliraj Combofix
Start >> Run
Combofix /u
Ok

PS: avast boot scan si odradio?


u sustini...to je to...sad znas na cemu si..kako stoje stvari...
"koristite zastitu"

Kada pokrenem start---run---ComboFix/u kaze da ne moze da nadje taj fajl. I pri restartu mi normalno "dize" windows, bez odabira windows ili combofix (mozda zato sto mi je sistem restore iskljucen). Skenirao sam sa Avast-om, i nalazi mi samo neke trojance (D particija),ali mislim da to nije toliko "opasno". Boot scan nisam uradio, ali mogu i to. Skeniracu D particiju jos jednom sa Dr.Web-om, pa ako jos negde naidje na infekciju-BRISEM JE! Hvala svima koji su pomogli, magna86 tebi pogotovo! Imam racunar 10 godina i isto toliko sam na internetu, ali ovo je po prvi put da mi se desi nesto ovako. U tih deset godina, koristio sam uglavnom kasperskog, ali kada mi se ovo desilo, verovatno nisam apdejtovao bazu, ili je Virut ipak prosao kroz antivirus. Za sada je sve ok, videcemo... Hvala jos jednom!

kaspersky ima definicije za taj malware...u stvari vecina jacih i poznatijih AV ga poznaje ali problem je u tome sto "nasi" alati ovaj malware nemogu ukloniti.
Kaspersky Live CD ( rescue disk) je takodje dobar za uklanjanje ove napasti.


ps: hvala