VIRY.CZ

Ok, super, skusim sa cez vikend vrhnut na ten AVP tool a opacim aj ten TC container. Ale snad Vas uz nebudem musiet otravovat..
Inak Vam velmi pekne dakujem za cas investovany do mojich logov a profesionalny pristup za to sa budeme musiet vyrovnat, toto forum si zasluzi podporu

Vdaka za odpoved, skusim sa pohrat s nastaveniami FW a potom mountnem ten truecrypt container.. :)

Pokial ide o pocitac, ked som v T-Cleaner potvrdil vymazat erunt tak mi spadol system, ale rebootol sa. :) Aj OTC mi rebootol comp, ale pred tym na to upozornil. Pravdepodobne to je normalne ...

Bezi zatial bez problemov, takze uz som spokojny aj ja :D Dakujem pekne za pomoc, uz som si s tym nevedel rady a do reinstalacie systemu sa mi moc teda nechcelo.. :roll:

Este mam jednu otazku: je celkom mozne, ze sa mi virus vrati, ak mountnem trucrypt container (ktory moze byt teoreticky tiez ...

Hotovo, posielam vysledok :)

ComboFix 10-09-28.03 - kaliope . 09. 2010 22:01:46.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1353 [GMT 2:00]
Running from: c:\documents and settings\kaliope\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\kaliope ...

ComboFix 10-09-28.03 - kaliope . 09. 2010 20:35:13.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1450 [GMT 2:00]
Running from: c:\documents and settings\kaliope\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\kaliope\Desktop\CFScript.txt
AV ...

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-29 23:16:17
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\kaliope\LOCALS~1\Temp\kxniqfod.sys


---- System - GMER 1.0.15 ----

SSDT BA69923E ZwCreateKey
SSDT BA699234 ZwCreateThread
SSDT BA699243 ZwDeleteKey
SSDT ...

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-09-29 22:38:13
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\kaliope\LOCALS~1\Temp\kxniqfod.sys


---- System - GMER 1.0.15 ----

Code \??\C:\DOCUME~1\kaliope\LOCALS~1\Temp\catchme.sys pIofCallDriver ...

Pocitac aj flashe vyzeraju byt oka. Avira nehlasi blokovanie autorun.inf a sharic.exe sa zda zmizol tiez. Vsetko som poodpajal a zase pripojil - zatial ziadna nova detection. :)

Tu je vysledok: http://www.virustotal.com/file-scan/report.html?id ...

ComboFix 10-09-28.03 - kaliope . 09. 2010 21:40:00.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1564 [GMT 2:00]
Running from: c:\documents and settings\kaliope\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\kaliope\Desktop\CFScript.txt
AV ...

Dakujem. Ale pred tym este jedna otazka - v predposlednom riadku toho textu sa tyka MobilityManager. Ide o program, ktory pouzivam na pripojenie na internet (defaultna aplikacia). Moze byt infikovany?

############################## | UsbFix 7.027 | [Deletion]

User: kaliope (Administrator) # KALIOPE-363F854 [ ]
Updated 28/09/10 by El Desaparecido / C_XX
Started at 22:45:23 | 28/09/2010
Website: http://www.teamxscript.org
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Pentium(R) Dual CPU ...

ComboFix 10-09-27.05 - kaliope . 09. 2010 22:39:46.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1518 [GMT 2:00]
Running from: c:\documents and settings\kaliope\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743 ...

Zdravim, mal som problem s odstranenim autorun.inf a sharic.exe. Autorun.inf som odstranil manualne cez cmd (attrib -s -h -r *.* a del autorun.inf), ale antivirus mi stale obcas oznami, ze ho zablokoval. Sharic.exe som uz parkrat odstranil, ale stale sa vracia (momentalne sa nachadza na USB kluci ...