FF.EXE puuttuu

Noin äkkiä katsottuna vaikuttaisi virus madolta
skannaa koneesi jollain virustorjunta ohjelmalla.
Netti ei meinaan anna tuolla haulla kuin virus selvityksiä.
Eli jos haet näin Windows\System32\FF.EXE netistä niin sieltä selviää mikä on
Esim Zone labs
Type: Worm
Aliases: [Win32.]Rirc.A; [Win32.]Rirc.A!unpacked; [Backdoor.]Rirc.a (Kaspersky); [Win32/]Rirc.A.Worm; [BKDR_]RIRC.A (Trend); [W32.]HLLW.Rirc (Symantec); [W32/]Rirc.worm.gen (McAfee);
Date Modified: 22-Jun-2004
Date Published: 12-May-2004

Description:
Win32.Rirc.A is a network share worm, that spreads by guessing windows share passwords.

On execution, it copies itself to %Windows%\SYSTEM32\FF.EXE .

Under Windows 9x, it adds the following entry, to the system.ini file :

shell=Explorer.exe %Windows%\SYSTEM32\FF.EXE

Under Windows NT, this translates to the registry entry :

HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Shell="%Windows%\SYSTEM32\FF.EXE"

This ensures that the worm runs at the next Windows start.

Note: '%Windows%' is a variable location. The worm determines the location of the current Windows folder by querying the operating system. The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP is C:\Windows.
Via Network Shares

Rirc.A randomly generates IP addresses, and tries to connect to s hares on these remote machines using a primitive dictionary attack. Should it succeed in guessing a correct password, it attempts to copy itself to the following locations on the remote host :

\Documents and Settings\All Users\Start Menu\Programs\Startup\Xi.exe
\WINDOWS\Start Menu\Programs\Startup\Xi.exe
\WINNT\Profiles\All Users\Start Menu\Programs\Startup\Xi.exe

Finally, it schedules a remote job so that the worm is executed on the remote host.
Backdoor Functionality

Rirc connects to an irc server, reports the infection, and listens for a limited set of backdoor commands.

Voi olla hyvä että ei löydy...
Kyseessä lienee virus (joka on poistettu ??),
mutta josta on jäänyt käynnistystietoihin merkintä.

Rekisteristä (käynnistä >suorita >"regedit" >ok)
voisi katsella löytyykö:
HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Shell="%Windows%\SYSTEM32\FF.EXE"

Linkkejä:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_RIRC.A

http://vic.zonelabs.com/tmpl/body/CA/virusDetails.jsp?VId=39109

Sainkin helposti ojkeiden avulla poistettua tuon FF.EXE herjan onko mato nyt poistettu koko koneesta kun poistin tuon shell tiedoston rekisteristä