W32.Licum Gaelicum.A

L

Leon

I got hit by this virus W32.Licum Gaelicum.A now I can't event login
to my computer in normal or safe mode. It displays the login screen
after entering the password and login in it take me back the login
screen.
Any ideas on fixing this?

Thank you
 
A

Art

I got hit by this virus W32.Licum Gaelicum.A

What av product produced that name?
now I can't event login
to my computer in normal or safe mode.

Is it this virus/worm?:

http://vil.nai.com/vil/content/v_134857.htm
It displays the login screen
after entering the password and login in it take me back the login
screen.
Any ideas on fixing this?

You're not supplying sufficient information. Such as the version of
Windows and what you tried before thngs degenerated to the point
you describe. How you might proceed depends on whether the
OS is Win 9X/ME or a NT based OS. In the former case, you can
approach it via some "boot into DOS via diskette" method. In the
latter case, there are several different possible approaches.

If the virus, or attempts to clean it, caused file damage, you're
in the "last resort" situation of reformat-reinstall.

Art

http://home.epix.net/~artnpeg
 
D

David H. Lipman

From: "Leon" <[email protected]>

| I got hit by this virus W32.Licum Gaelicum.A now I can't event login
| to my computer in normal or safe mode. It displays the login screen
| after entering the password and login in it take me back the login
| screen.
| Any ideas on fixing this?
|
| Thank you

Please answer Art's questions...

Have you tried logging in with a different account ?
 
V

Virus Guy

Leon said:
A now I can't event login to my computer in normal or safe mode.

If you're running XP, then call your IT department.

What - you don't have an IT department? Then what are you doing
running XP?
 
L

Leon

Hello

Thank you for your reply.

This is a windows Xp computer it's my bother's computer, he wanted
to host a game of Helo so I put the computer in the DMZ of the router
instead of opening ports. It was there only for few hours and it got
hit by this virus.

There is only one user name

Reformatting will be the last resort I really would like to fix this
computer.

Any help will be appreciated.
 
A

Art

Hello

Thank you for your reply.

This is a windows Xp computer it's my bother's computer, he wanted
to host a game of Helo so I put the computer in the DMZ of the router
instead of opening ports. It was there only for few hours and it got
hit by this virus.

There is only one user name

Reformatting will be the last resort I really would like to fix this
computer.

Any help will be appreciated.

Here are some approaches:

http://www.claymania.com/virus-ntfs.html

The Bart PE approach is probably the best. Some have warned
that pulling the drive and scanning it on a clean PC can be risky.

Maybe David will have more suggestions.

BTW, you didn't say which av gave you the malware name. Nor did
you give us any clue as to why things degenerated to the point
where you can no longer get into Windows.

Art

http://home.epix.net/~artnpeg
 
M

Max Wachtel

Virus Guy said:
snip crap

Why did you waste your time posting useless drivel?
The OP did not state it was his computer at work,he stated it was his
brothers machine. As my father used to say,If you don't have anything
useful to contribute-shut the **** up.
-max
 
S

Scott Bolander

I got hit by this virus W32.Licum Gaelicum.A now I can't event login
to my computer in normal or safe mode. It displays the login screen
after entering the password and login in it take me back the login
screen.
Any ideas on fixing this?

Thank you

You won't be able to fix it; the virus has replaced thousands of exe files
on your hard drive with infected versions. It CANNOT be repaired.

Get your data off and wipe it; good thing for you that this virus only
goes after exe files.
 
D

David H. Lipman

From: "Scott Bolander" <[email protected]>

| On Fri, 22 Jul 2005 03:42:02 -0700, Leon wrote:
||
| You won't be able to fix it; the virus has replaced thousands of exe files
| on your hard drive with infected versions. It CANNOT be repaired.
|
| Get your data off and wipe it; good thing for you that this virus only
| goes after exe files.

The virus appends itself to the EXE files and a good scanner should be able to remove the
virus and leave the EXE intact.
 
M

Martin

Virus Guy said:
If you're running XP, then call your IT department.

What - you don't have an IT department? Then what are you doing
running XP?

Gee, maybe he PURCHASED IT!! Let's see, XP Home... Oh, and even XP Pro can
be purchased by an individual, well fancy that...

WANKER!
 
V

Virus Guy

Gee, maybe he PURCHASED IT!! Let's see, XP Home... Oh, and
even XP Pro can be purchased by an individual, well fancy that..

You missed the point.

The point being that Win 2K was NOT, repeat, NOT for home use (as per
Microsoft's own product description). Yet we have XP (which is a
minor derivative of Win 2K) and now Microsoft has no alternative to
Win 98 or ME, so they come up with a slightly hacked version of XP and
call it "XP home". It's still a bloated, over-managed, over-serviced
bear of an operating system that (for the average home user) is more
trouble than it's worth (when compared to Win 98).

When you _really_ need to do something with it (like fix something,
like, say, A VIRUS) it won't let you. It's too internally convoluted
for it's own good.

You want to know why spam has exploded over the past 3 years?

It's because of XP on home computers. It's because Micro$hit was
criminally negligent when it put ZERO effort at releasing a home
version of XP with dozens of useless services turned off. Because
with thousands of programmers they generated so much code that was
vulnerable to buffer overruns.

Anyone running XP who gets infected with mal-ware and can't figure out
how to get rid of it deserves what they get. Go run to daddy Gates,
get him to fix your computer. He promised you a more exciting, a more
productive, a more secure computing experience with XP. Go ask him
where those promises went. I'll tell you where they are - they were
pulled out of the ass holes of Micro$haft's marketing staff. And they
have more promises they will pull out of their asses and shove down
your throat when they start their bullshit advertizing for Windows
Vista (which is really a modified version of Server 2003, which was
never meant for home use until Micro$loth re-names it to something
else and then says it was naturally designed for home use).
 
A

Art

You missed the point.

The point being that Win 2K was NOT, repeat, NOT for home use (as per
Microsoft's own product description). Yet we have XP (which is a
minor derivative of Win 2K) and now Microsoft has no alternative to
Win 98 or ME, so they come up with a slightly hacked version of XP and
call it "XP home". It's still a bloated, over-managed, over-serviced
bear of an operating system that (for the average home user) is more
trouble than it's worth (when compared to Win 98).

But Win 9X/ME also have open internet ports by default. To have
unnecesary services enabled by default is insane. And both IE and
OE have always been disasters waiting to happen to unsuspecting
users. IMO, MS never has produced a decent home user OS.

Yet any of the OS can be tamed down and made reasonably safe
to use for non-techies, providing such users are willing to follow a
simple set of "safe hex" guidelines. More apps such as WWDC.EXE

http://www.firewallleaktester.com/wwdc.htm

for closing all open ports should be available for use by "grandma"
who isn't interested in anything but browsing and email. Grandma
simply needs to be told:

1. Only use IE on trustworth sites and only when absolutely necessary
2. Use Tbird or Pegasus for email
3. Immediately delete any and all unsolicted email attackments

If effective OS hardening sw were available, grandma could happily
enjoy her PC without need for antivirus, antispyware, antitrojan,
firewall or router ... on any of the Windows OS.

Art

http://home.epix.net/~artnpeg
 
V

Virus Guy

Art said:
But Win 9X/ME also have open internet ports by default.

I don't know about ME, but if you take a plain, original installation
of Windows 98 (SE) and connect it to the internet (WITHOUT going
through a NAT router), it WILL NOT become infected with any sort of
worm or trojan.

You CAN'T say the same thing about Win-2K or XP (unless you've bought
a recent version of XP that includes SP2 or maybe SP1).

Win-98 does not enable resource sharing or netbios over TCP or have
the various extra services that 2K and XP have (such as remote
administration services). The DCOM vulnerability does not seem to
affect 98 either.
To have unnecesary services enabled by default is insane.

Yes, so why are they part of XP home?
And both IE and OE have always been disasters waiting to
happen to unsuspecting users.

IE and OE are applications who's vulnerabilities are mostly common to
all platforms and that require user activity to cause an incident.

Only Win-2k and XP have built-in vulnerabilities that require no user
activity to accomplish an infection. Once connected to a DSL or cable
modem, a system win 2k or XP will become infected within minutes -
even before patches can be downloaded and installed. The same is
simply not true for Win-98.
 
A

Art

I don't know about ME, but if you take a plain, original installation
of Windows 98 (SE) and connect it to the internet (WITHOUT going
through a NAT router), it WILL NOT become infected with any sort of
worm or trojan.

That's incorrect. Win 98 has NETBios enabled by default, and the usual
ports 137-139 are open and vulnerable to attack.
Only Win-2k and XP have built-in vulnerabilities that require no user
activity to accomplish an infection.

That's also incorrect. Win 98 has a number of vulnerabilities for
which a series of critical patches were released by M$ along the way.

Art

http://home.epix.net/~artnpeg
 
V

Virus Guy

Art said:
Win 98 has NETBios enabled by default, and the usual
ports 137-139 are open and vulnerable to attack.

Netbios over TCP is only installed if Client for Microsoft Networks is
installed, and that is installed only if file and print sharing is
turned on.

A home network (at least a network running 98) can run netbeui, and
Netbios over TCP can be turned off
(http://www.uzipaz.com/eng/pfnt.html) but a multi-port NAT router
would block attempts to the netbios ports anyways if netbios was
running.

BTW, the above link says this about netbios:

"Older versions of Win95 had file and print sharing over NetBIOS
enabled by default. On Win98, and WinMe it was disabled by default."

Because 2K and XP were designed for network'd use in corporate
situations, Netbios over TCP is enabled by default:

http://www.microsoft.com/resources/...00/server/reskit/en-us/cnet/cnbc_imp_wcug.asp

and

http://www.microsoft.com/windows200...ced/help/sag_WINS_und_NetbiosConceptsNode.htm

Don't forget the Remote Procedure Call (RPC) Locator vulnerabilities,
as well as the default hidden shares on 2K and XP machines (FAX$,
IPC$, PRINT$, C$, D$, etc) that have no equivalent in Win-98.
Win 98 has a number of vulnerabilities

Other than those pertaining to netbios, could you name a few?
 
F

Frank Booth Snr

Art said:
But Win 9X/ME also have open internet ports by default. To have
unnecesary services enabled by default is insane. And both IE and
OE have always been disasters waiting to happen to unsuspecting
users. IMO, MS never has produced a decent home user OS.
I cannot agree. I've used Windows 98 SE for some years now and have
never been bothered by malware. Nor have I ever used AVS, anti-spyware
or a firewall. I remain firmly covinced that these products exist to
plant fear in the minds of most online users. And from what I've
witnessed, nearly all users who end up with serious malware problems are
..... yes you guessed it. Users of XP with firewalls and a multitude of
anti-goodness-knows-what-malware on their systems.
What a farce!
 
J

James Egan

That's incorrect. Win 98 has NETBios enabled by default, and the usual
ports 137-139 are open and vulnerable to attack.

That's not quite right. File and printer sharing is not installed by
default although (iirc) the client for MS networks is. Consequently a
trip to your favourite open port checker will show a netbios session
service port listening. However, you will not be able to get a
successful connection to it since file and printer sharing is not
installed and nothing has been expressly shared out so it is as good
as closed and not open to network infection.

The main grievance you might have with win9x is that if you
*subsequently* install file and printer sharing, the default behaviour
of win98 is to bind it to all interfaces ie. any shares will be
accessible from the Internet until you manually go into the properties
and unbind file and printer sharing from the tcp/ip stack of the
Internet connection.

It is this bind everything to everything philosophy (to minimise
connectivity queries from users) which got the network security
fraternity upset.


Jim.
 
A

Art

Netbios over TCP is only installed if Client for Microsoft Networks is
installed, and that is installed only if file and print sharing is
turned on.

A home network (at least a network running 98) can run netbeui, and
Netbios over TCP can be turned off
(http://www.uzipaz.com/eng/pfnt.html) but a multi-port NAT router
would block attempts to the netbios ports anyways if netbios was
running.

Grandma doesn't have a NAT router :)
BTW, the above link says this about netbios:

"Older versions of Win95 had file and print sharing over NetBIOS
enabled by default. On Win98, and WinMe it was disabled by default."

Because 2K and XP were designed for network'd use in corporate
situations, Netbios over TCP is enabled by default:

http://www.microsoft.com/resources/...00/server/reskit/en-us/cnet/cnbc_imp_wcug.asp

and

http://www.microsoft.com/windows200...ced/help/sag_WINS_und_NetbiosConceptsNode.htm

I'm pretty sure the NETBios ports checked as open on my Win 98
original.
Don't forget the Remote Procedure Call (RPC) Locator vulnerabilities,
as well as the default hidden shares on 2K and XP machines (FAX$,
IPC$, PRINT$, C$, D$, etc) that have no equivalent in Win-98.

Win 9x/ME also has RPC services enabled by default. The only way I
found to close the port is to rename RPCSS.EXE to RPCSS.OLD in
plain DOS.

Furthermore, Win ME (and some versions of '98 according to Steve
Gibson) have the upnp service port open. I use Steve Gibson's utility
to disable the service and close the port.
Other than those pertaining to netbios, could you name a few?

I can only remember one off hand that I specifically tested on '98
which was a TCP/IP stack overrun vulnerability. It can be tested
at the PCFlank test site by running the Exploits test. A unpatched
OS will blue screen on at least one of the Exploits but a patched
OS passes the tests fine.

You may still be able to find all the patches and descriptions for
'98 (and ME). I haven't checked in ages.

Anyway, there's no difference in the basic approach one should take
in hardening any Windows OS. All patches should be installed and
all unnecessary services disabled.

Art

http://home.epix.net/~artnpeg
 
A

Art

I cannot agree. I've used Windows 98 SE for some years now and have
never been bothered by malware. Nor have I ever used AVS, anti-spyware
or a firewall. I remain firmly covinced that these products exist to
plant fear in the minds of most online users. And from what I've
witnessed, nearly all users who end up with serious malware problems are
.... yes you guessed it. Users of XP with firewalls and a multitude of
anti-goodness-knows-what-malware on their systems.
What a farce!

Well, I've done the same with Win 98 orignal and with Win ME, never
using realtime av or firewall (though now I have a wireless router).
However, I patched, did the unbinding, and made sure all ports were
closed. The point is that this can be done with any version of
Windbloze. There's no reason grandma needs to be less safe using
the NT based OS than the DOS based ones. Her "safe hex" rules
are the same in any event. She just needs a utility to harden her
OS, since she can't be trusted to follow a procedure involving
editing the registry :)

Art

http://home.epix.net/~artnpeg
 
A

Art

That's not quite right. File and printer sharing is not installed by
default although (iirc) the client for MS networks is. Consequently a
trip to your favourite open port checker will show a netbios session
service port listening. However, you will not be able to get a
successful connection to it since file and printer sharing is not
installed and nothing has been expressly shared out so it is as good
as closed and not open to network infection.

Yes, well I just can't remember whether or not file/printer sharing
was ticked on by defualt on my Win 98 original. I always took the
route of binding only to TCP/IP just to make sure ... and to make
sure the ports were closed.
The main grievance you might have with win9x is that if you
*subsequently* install file and printer sharing, the default behaviour
of win98 is to bind it to all interfaces ie. any shares will be
accessible from the Internet until you manually go into the properties
and unbind file and printer sharing from the tcp/ip stack of the
Internet connection.

It is this bind everything to everything philosophy (to minimise
connectivity queries from users) which got the network security
fraternity upset.

But the NetBios group of ports aren't the only concern with Win
9x/ME. On Win ME, there are two other services to disable and
ports to close.

Art

http://home.epix.net/~artnpeg
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top