Ja, volt valami kernelfrissülés, aztán véletlenül virtualbokszolni akartam, és modult követelt.
De semmi gond, hozzányúlás nélkül megy a rendszer, bár a vitrualbox image-ek mintha megbuggyantak volna. Mondjuk nem érdekel, csak játék az egész.

Technical details

This Trojan will download a file indicated in the Trojan’s code to the victim machine. It uses a vulnerability in the ADODB.Stream ActiveX component to save the file to disk. The malicious code may be included in html pages. The Trojan is approximately 500 bytes in size.

Payload

The Trojan creates a Microsoft.XMLHTTP object and uses this to download the file to the victim machine. The Trojan uses a vulnerability in the ADODB.Stream ActiveX component to save the file to disk to the specified directory.

Removal instructions

Disable the ADODB.Stream object in Internet Explorer (see here for further details).
Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

# nmap 81.169.128.191

Starting Nmap 4.60 ( http://nmap.org ) at 2009-01-14 16:30 CET
Interesting ports on hansaserver.de (81.169.128.191):
Not shown: 1699 closed ports
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   filtered smtp
53/tcp   open     domain
80/tcp   open     http
106/tcp  open     pop3pw
110/tcp  open     pop3
113/tcp  open     auth
143/tcp  open     imap
443/tcp  open     https
465/tcp  open     smtps
993/tcp  open     imaps
995/tcp  open     pop3s
3306/tcp open     mysql
8080/tcp open     http-proxy
8443/tcp open     https-alt

Nmap done: 1 IP address (1 host up) scanned in 23.143 seconds