Ale nez staci clovek neco udelat, sezere mi par souboru, ktery jsou nenavratne pryc...Windows mam upgradly, NOD32 s aktualni virovou databazi + Kerio a stejne 
Pls pomocte I successfully removed this from a XP SP2 machine.
1. On a clean XP SP2 machine, download from www.microsoft.com the Microsoft Malicious Software Removal Tool.
2. Burn to CD the removal tool and a copy of C:\windows\system32\userinit.exe
3. Boot the infected machine in safe mode and run the removal tool from the CD. Let it do it's thing but... !!!DON'T restart the machine at the end like it asks!!! Bring up the task manager and kill the 'userinit' process. Overwrite the current c:\windows\system32\userinit.exe file with the clean one on the CD.
3. Now reboot and enjoy.
http://www.microsoft.com/downloads/deta ... laylang=enope this would help.
Virus Description:
the virus only infect exe files. but it would infect your antivirus software and userinit.exe which
would be run as you logon. the DL.exe keep downloading the virus from "utenti.lycos.it" which could be see if you open
the dl.exe or userinit.exe with ultraedit32 and search for "lycos.it". The virus would attach the dl.exe to some important
windows exe files like userinit.exe, regedit.exe, iexplore.exe, rundll32.exe(it is run when you use the windows add/remove programs).
So it come back quickly.
Want to know more:
The description of McAfee of this Virus:
»vil.nai.com/vil/content/v_134857.htm
Somehow difference is that I didn't find the GAELICUM.EXE nor the CBACK.exe on my laptop.
A virus analysis:
»www.nod32.com/msgs/tengaa.htm
Remove instruction:
1.kill excess process in the windows task manager, which means leave the the svchost.exe there, end the other process you could kill.
Those process showing two name there, the one with about 4~6k memory should be the virus dl.exe.
2.after killing the excess process, you should be able to access to internat temporary. Download the Malware remove tools
from Microsoft quickly:
»www.microsoft.com/downloads/deta···ylang=en
run it and it should find the w32/Gael virus, thousands of files infected, repaired them.
Some of the exe files may be removed here, so far I only got two of my program files missing.
after that, would be asked to restart, before you restart, do these things:
a. del any values in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
b. del anything in the windows/prefatch and set the folder to read only
c. open your administrative tools/services, stop any excess services related to your installed programs, which are usually with a short description, and set them or manual or disabled.
d. DISCONNECT your computer from internat, unplug the cable and stop wireless network. This make sure virus won't come back from internat again.
when the virus is there, although it seem that you could not access to internat through internat explore, the virus could still access the virus server.
3.Now after restart your computer, open your task manager quickly, if any excess process is there,like the userinit.exe, cftmon.exe,wscntfy.exe,kill them quickly.
4.Do a quick check with the Malware remove tools from microsoft, should be not files infected. Don't run any excess programs, they may still be infected.
5.Bring up the windows add/remove programs and remove your antivirus software and reinstalled it, make sure you install from cd and the installation files are not infected, while doing this,
keep tracking the process with the task manager, any process(except svchost.exe) appear with two,should kill the one with about 4~6k memory quickly.
if you are asked to restart after remove program, make sure step 2.a, 2.b, 2.c, 2.d are done. after restart, do a quick check with malware remove tool
6.restart after you reinstall you antivirus software, if the antivirus software is working, job is almost done. Make sure step 4 is done. If the antivirus software is still not working, go back to step 1, make sure you are disconnected from internat from step3 to step6.
if this still doesn't work, leave me a message.
7.Now you could plug in your cable, do the antivirus update first, after restart, do the full scan, you should still find some virus on your computer,
kill them or repair them. Now it is done.
) v práci na jednom kompu kromě dalších 16 virů čistil komp od mssearchnet.exe, tj. podobné svini, a musel jsem mimo jiné též i vypnout obnovu systému, kam se zazálohoval a odmáznout zpod Windows\System32\ příslušné soubory + manuální zásah do registru - odmazat jeho klíče. /všechno v nouzovém režimu s dosovskou příkazovou řádkou/. Snad i v tom najdeš nějakou tu inspiraci. 
a mam treba 2dny klid...a pak zase najednou znova Je to desna svine ten vir, zere jen exe soubory, jenze si klidne sezere spousteci i odinstalacni exe soubor a program je totalne v haji... Kód: Vybrat vše
Logfile of HijackThis v1.99.1
Scan saved at 12:13:27, on 9.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\NOD32\nod32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
E:\Kerio\Personal Firewall 4\kpf4gui.exe
E:\NOD32\nod32kui.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
E:\Adobe\Acrobat 7\Distillr\Acrotray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
E:\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
E:\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
E:\FireFox\firefox.exe
E:\WinRAR\WinRAR.exe
C:\DOCUME~1\Nidzo\LOCALS~1\Temp\Rar$EX00.297\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe\Acrobat 7\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - E:\FlashGet\jccatch.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\FlashGet\fgiebar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nod32kui] "E:\NOD32\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [CloneCDTray] "E:\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "E:\Adobe\Acrobat 7\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Převést cíl vazby do Adobe PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést cíl vazby do existujícího PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést do Adobe PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést do existujícího PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Převést vybrané vazby do Adobe PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Převést vybrané vazby do existujícího PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Převést výběr do Adobe PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Převést výběr do existujícího PDF - res://E:\Adobe\Acrobat 7\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Stáhnout pomocí FlashGet - E:\FlashGet\jc_link.htm
O8 - Extra context menu item: Stáhnout vše pomocí FlashGet - E:\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://nidzo.gamezforum.net
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129917699125
O17 - HKLM\System\CCS\Services\Tcpip\..\{68E05E01-A60D-411A-9AEC-C6E4B739E5EB}: NameServer = 62.40.68.2,194.228.2.61
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - E:\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\NOD32\nod32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
No tak to si me moc nepotesil...zombux píše:...
Mno zas tak dulezity nejsouzombux píše:napadá to jen EXE Win32 soubory, to snad nejsou důležitý data... někam zazálohuj co se dá a je...
Ale toz to ono ho tu ted nemam, scany z antiviraku jsou cisty, v nouzaku utility specialne pro nej urceny ho taky nenajdou, ale zase se za par dnu objevi, sezere par souboru, ja ho smazu a bude opet klid na chvilku... Jak je napsáno výše:Nidzo píše:
Ja se bojim abych to nepreinstaloval a mel ho tu pak zase...navic by me zajimalo kudy se prave ke me dostal/dostava...
Napadá mě dát si ten utenti.lycos.it v hosts souboru jako local host.This detection covers a parasitic worm virus that spreads to both host executables as well as over accessible systems on a network. The worm also downloads and executes other files.
When run, the worm infects .EXE files on the local system, appending itself to host files. 10 threads are created to search for infectable computers on the Internet, SYN packets are sent to random IP addresses on TCP 139 (netbios). The worm then attempts to connect to responding systems via the IPC$ and open shares to parasitically infect files remotely.
The worm also attempts to download and execute a file name dl.exe from utenti.lycos.it . At the time of this writing the site was not responding. However, the virus was known to fetch a downloader trojan, Downloader-ACX, which downloaded two other files:
* gaelicum.EXE - dropper of W32/Gael.worm
* CBACK.EXE - a new remote access trojan, BackDoor-CTM
Doufam ze budes mit pravdu...shadow píše:Domnívám se, že ano
Proč to sdílíš, kvůli domácí síti?
Ale pokud jsi za routerem, tak by to imho nemělo vadit.
(teda snad doufam ze je to tim)...
Jj pomohlo, musis vypnout sdileny C:, proste korenovyho diskualea206 píše:Chci se zeptat jestli to vypnutí sdílení ti pomohlo, protože já ho tam mám teď taky
Jo a zdílim v síti eště tiskárnu a internetový připojení mám to taky vypnout?
