ASocksrv / SocksA.exe - problem, kako maknut?

OK, sasvim slucajno, nicim izazvan idem ja cistit registry i naidjem na ovu malu zvjer,,,,

Sad, moj adaware ga ne vidi, tj. nesto kao mice, ali svaki restart iznova se ovo cudo vraca

Citam po netu, to je kao crvuljak neki, citam kako da ga maknem, koje file-ove da brisem, vrati se uvijek, rucno nece.

Molim savjet, predpostavljam da je to poznata stvar i da postoji 1 click removal ali ne mogu ga naci.

Hvala svima na odgovorima,

P.S. ako pomaze:

File name: tel.xls.exe
Size: 48.0 KB (49,152 bytes)
Checksum: d88f7c6c15585404c30c92a11c429c36 (MD5)
Packer: None
Written in: Visual Basic 6
Virus detected as:

* KAV: Trojan.Win32.VB.atg
* Duba: -
* Rising: -
* KV: -

Details:

File System Change(s):
1. After execution,the file replicates itself to:
* %System%\SocksA.exe
* %System%\algsrv.exe
* %System%\FileKan.exe

PS: %System% is an environment variable.This represent the System32 folder in Windows NT/2000/XP/Server 2003 (eg. C:\Windows\System32 )

2. It also replicates itsef to all fixed drives and renamed as tel.xls.exe
3. Create autorun.inf to all fixed drives
4. After replicating the files,it executes explorer.exe with parameter %SystemDrive%,Windows Explorer will be shown

Registry Change(s):
1. Create the following values to HKEY_LOCAL_MACHINE\Software\Micros­ oft\Windows\CurrentVersion\Run
* "ASocksrv" = "SocksA.exe"
* "BSserver" = "FileKan.exe"
2. Modify the value "CheckedValue" in HKEY_LOCAL_MACHINE\SOFTWARE\Micros­ oft\Windows\CurrentVersion\Explore­ r\Advanced\Folder\Hidden\SHOWALL

Removal Procedure:

1. Press Ctrl + Alt + Del to execute Windows Task Manager,terminate the following processes:
* SocksA.exe
* algsrv.exe
* FileKan.exe
2. Delete the autorun.inf files
3. Delete the tel.xls.exe files
4. Delete the following files:
* %System%\SocksA.exe
* %System%\algsrv.exe
* %System%\FileKan.exe

PS: %System% is an environment variable.This represent the System32 folder in Windows NT/2000/XP/Server 2003 (eg. C:\Windows\System32 )

Comment: In fact,this is a worm
Write-up by: Krazaf/tkabc

Meni upute nisu pomogle u rjesavanju, nisam uspio pronac dosta toga sto je autor naveo i stalno mi se vraca... za pocetak nemam uopce tih procesa u listi za ubit:

Koristim Win Vista Ultimate 64 sp2, kod pregleda procesa stavio sam kvacicu na show process from all users i narihto sam da vidim hidden file-ove

Trenutno na visti samo sa adaware, ali probo sam na xp-u sa comodom i spybotom, nema sanse...

Ne znam isplati li se skidat avg, kazu da nije toliko dobar... kaspersky ili norton donesu vise loseg nego dobrog, a i comodo mi je malo kompliciran, pogotovo sto zadnji put kad sam ga nasnimio na vistu mi je sve zakljuco... svchost gleda ko virus i zeli ga blokirat...

Ne znam sto radit, dosta toga mi je pravilo probleme na vista ultimate 64 sp2

U stvari je ovo jedino sto mi pravi probleme a ne znam kako maknut, ti wormici su obicno imali onako manje programcice uz pomoc koji se micu, koji su radjeni bash za njih...

probat cu jos nekako... mozda nasnimim ovo sto si mi sugerirao, ali zanima me ima li jos netko neku ideju?

Da, od tamo sam i copy-paste-ao ona uputstva gore... nije pomoglo, ali hvala