AIUTO URGENTE: VIRUS IRC VUP!

[Tico]

qualcuno sa qualcosa di questo virus?

[Tico]

ho trovato qualcosa in giro per la rete, ma non riesco assolutamente a toglierlo!
http://it.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=55150&VName=TROJ_IRCPUV.A
il virus dovrebbe essere il TROJ_IRCPUV.A (o IRC-Vup.dr, IRC-Vup)
mi crea un open proxy sulla porta 6588 (e, credo, pure 1080)
nella cartella WINNT\system32, oltre a prx.exe c'è anche prx.reg e proxy99.exe
praticamente non riesco più a connettermi a server irc


qualcuno può aiutarmi?
sono disperato, in giro per la rete ho trovato solo informazioni frammentarie
sono costretto a formattare?

[Tico]

Details:
Installation

Upon execution, it creates the folder RarSFX0 in the Windows Temp directory. It then drops the archived files into that folder. The following are the normal files that are dropped:

DDE.EXE
FIREDAEMON.EXE
PROXY99.EXE
PSEXEC.EXE
REMOTE.INI
SERVERS.INI
SVCHOST.EXE
URLS.INI
The file SVCHOST.EXE is a normal mIRC client program. The dropper program executes this file as soon as the files are dropped.

The above files would have functioned as normal, if not for these malicious files:

MIRC.INI
SCRIPT.INI
TEST.BAT
WIN2K.BAT
With these files, the mIRC client program effectively scans for random IP addresses and remote vulnerable machines.

Registry Shell Spawning

It also attempts shell spawning by adding the following registry entries.

HKEY_CLASSES_ROOT\ChatFile\DefaultIcon
@="c:\windows\temp\rarsfx0\mirc32.exe,0"

HKEY_CLASSES_ROOT\ChatFile\Shell\open\command
@="c:\windows\temp\rarsfx0\mirc32.exe "%1""

HKEY_CLASSES_ROOT\irc\DefaultIcon @="c:\windows\temp\rarsfx0\mirc32.exe,0"

HKEY_CLASSES_ROOT\irc\Shell\open\command @=""c:\windows\temp\rarsfx0\mirc32.exe" -s%1"

HKEY_LOCAL_MACHINE\Software\CLASSES\ChatFile\DefaultIcon @="c:\windows\temp\rarsfx0\mirc32.exe,0"

HKEY_LOCAL_MACHINE\Software\CLASSES\ChatFile\Shell\open\command @="c:\windows\temp\rarsfx0\mirc32.exe "%1""

HKEY_LOCAL_MACHINE\Software\CLASSES\irc\DefaultIcon @="c:\windows\temp\rarsfx0\mirc32.exe,0"

HKEY_LOCAL_MACHINE\Software\CLASSES\irc\Shell\open\command @=""c:\windows\temp\rarsfx0\mirc32.exe" -s%1"

These entries also attempts to associate chat files to MIRC32.EXE. However, these fail to have an effect since there is no MIRC32.EXE dropped in the RarSFX0 folder.

The self-extracting file is further compressed using UPX.