[résolu]Nouveau blaster

[fabbe]

Hello

aujourd'hui j'ai chopé un blaster , celui ci infecte le fichier svchost qui ce trouve dans le repertoire win32

Il existe un patch chez microsoft

http://search.microsoft.com/search/results...B824146-x86-FRA

Je sais pas si c'est le virus Mydoom

Par contre toujour un probleme , apres application du patch lorsque je redemarre j'ai une fenetre DOS qui souvre executant le fichier svchost , je la ferme , ca me dit que le programme ne rêpond pas... Un pote m'avait parlé de ca donc j'avait fait une copie du fichier svchost avant d'etre infecté mais je peux pas remplacer le fichier infecté car celui ci est utilisé par windows!!!

Comment faire a part mettre mon HD sur un autre PC

Merci ++

[ingeni]

Voir si par un démarrage en mode sans échec le fichier svchost est utilisé ...

[fabbe]

j'ai pas encore resolu le probleme

J'ai essayé en mode sans echec...marche pas

J'ai essayé un point de restauration...marche pas

il a fallu que je transforme ma partition ntfs en fat32 car ma disquette bootable 98 fonctionne pas sur les partitions ntfs

Puis j'ai fait un copier coller sous DOS...marche pas

A l'aide mon systeme d'explitation a 2 semaines

Quelqu'un a une idée

++

[jojo83]

Salut,

Ok donc essaye de killer tout les process qui te semblent suspects et qui pourraient utiliser le fichier et t'empêcherait de le remplacer.

Sinon tu peux aussi lancer un msconfig et dans l'onglet démarrage empêcher le lancement du virus si tu le trouves.

[fabbe]

ok je vais testé ca ce soir

J'ai remarqué qu'il créait des .exe avec des noms de fichiers ou de repertoires

pris au hasrard sur mes HD , exemple : mesmp3.exe ou mesphotos.exe

Sale bete ...je vais lui mettre le compte ce soir

merci

++

[juliobob]

Essai aussi de désactiver la restauration auto du systeme avant intervention car autrement ton ver peut avoir été sauvegarder par le systeme. Ensuite scan antivirus a jour et correctifs windows (si c blaster, qui est different de mydoom. ppas de correctifs pour mydoom, il se repend par e mails, fichiers joints plus exactement)

[fabbe]

Voila avec ca j'ai réussi a le supprimer completement

------------------------------------------------------------------

W32/Hiton.a@MM

autres noms :

WORM_HITON.A

Win32.Hiton.A

Type: Ver

Taille du fichier: 44,036 bytes

Systemes touchés: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Systemes immunisés: DOS, Linux, Macintosh, OS/2, UNIX

action:

Se copie et prend le nom de \Svchost.exe dans le repertoire racine de Windows.

Crée le fichier \Mssvc.dll (44,036 bytes) dans le repertoire System.

Ajoute les entrées suivantes a la base de registre :

"Service Host Driver"="%Windir%\svchost.exe"

dans

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

C'est son autorun.

On trouve aussi :

"(Default)" = "%System%\mssvc.dll"

dans:

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\

InProcServer32

De cette facon, Explorer charge la bibliothèque Mssvc.dll.

Enfin :

"AutoRun"= "%Windir%svchost.exe"

dans:

HKEY_CURRENT_USER\Software\Microsoft\Command Processor

Il génère les fichiers suivants :

%System%\Wsick32.dll, où sont stockées les adresses mail qu'il trouve sur la machine.

%System%\wsuck32.dll, fichier texte.

Remplace des entrées dans :

%System%\Drivers\etc\Hosts (sous Windows NT/2000/XP)

%Windir%\Hosts.sam (sous Windows 95/98/Me)

si il scanne et trouve l'un de ces mots:

grisoft

nai

networkassociates

vil.nai

nod32

bitdefender

f-secure

securityresponse.symantec

vsantivirus

openantivirus

norman

f-prot

ravantivirus

kaspersky

sarc

sophos

pandasoftware

antivirus

mcafee

trendmicro

symantec

Crée le repertoire :

[racine windows]\{21EC2020-3AEA-1069-A2DD-08002B30309D}

et s'y copie.

Il utilise son propre service SMTP pour l'envoi de mails.

Si recu par cette voie, l'en tete aura la forme

From: <spoofed>

Subject: l'un de ceux ci :

TONA, you have to see this!

hey wuts up?

hey wuts up TONA?

Very funny

Useful

Happy Times :)

gift for you TONA :)

Attatchments

Hiiiiiii TONA

Hiiiiiii

Wait for more :)

elegant ppl should satisfy thier taste with elegant things

heyyy TONA

heyyy

Heyyyyyyyy Lola Wussaaap??

Another one?

Hey Wussap?

Hey I thought you trusted me but ...

unknown

fake

leaked

stolen

information for you, TONA

information

warning

something for you

read it immediately

Undeliverable mail --

Server Report

Status

Returned mail --

Mail Delivery System

La Transazione Della Posta + venuto a mancare

La Transaction De Courrier A TchouT

Mail Transaction Failed

here|s the document you requested

here|s the document

Pr0n!

Here|s a nice Picture

here|s the archive you requested

New Internal Rls...

Do not release, its the internal rls!

hola TONA

hola

hello TONA

hello

hi TONA

Error

Ciao TONA

Ciao

Darling

Congratulations TONA!

Message: Un de ces messages :

i found this amazing file in my Recycled , i know u love this kind of things ;)ONCRcyaaa

Hummm , i hope u accept this show as an apology.ONCRsave it for hard times

i will be waiting for u emaill to remind me of your self.

i'm fine , thanx for asking :) ONCRand thanx for the nice attachements.ONCRbut unfortunately, i don't remember you

you seem to be mad @ me coz i didn't send u anything for along time,ONCRi didn't forget u , but i was kinda busy , i've got all of ur emailsONCRthanx :) and i hope u accept this one as an apology.

i've got this surprise from a friend :)ONCRit really deserves a few minutes of your time.ONCRNever mind !

i thing the subject is enough to describe the attached file !ONCRcheck it out and replay your opinion

heyyyy i tried many times to send u this email but ur account was out of storage as i thinkONCRany way , make sure that i didn't and i won't forget u :)ONCRCya Forgotten

I've got your email , but you forgot to upload the attachments.ONCRDon't be selfish , i sent you all the files i have, send me anything :(

i just wanted to say sorry for last nightONCRand .. i wish u accept this as an apologyONCRbye dear

I can't be online tonight :(anyway , i sent u something u r gonna love ;)ONCRcya tomorrow

i lost FRNA's Email plzz send this file to her :)ONCRand tell her i can't be online tonightONCRBye

YO TONA , IM SICK OF UR EMAILS , IF U LOSE IT AGAIN I WONT GIVE IT TO U, SAVE ITONCRBYEEE

I forgot to tell u , the other file is with FRNA:) bye

Heyyyy TONAI lost the other email , anyway i sent u all u needONCRi have just got it , plz tell me if u need more.bye

Here is the FRNA Dont tell Sam abt itONCRCya

i haven't ever thought i should send u my briefcase to gain ur Trust.ONCRHave it all :) bye

HEY TONA, call FRNA a virus text stealer =)

Hi TONA its FRNA.ONCRONCRI was shocked, when I found out that it wasn't you but your twin brother,ONCRthat's amazing, you're as like as two peas. No one in bed is better thanONCRyou TONA. I remember, I remember everything very well, that promised youONCRto tell how it was, I'll give you a call today after 9. He took my skirtONCRoff, then my panties, then my bra, he sucked my t**s, with the same furyONCRyou do it. He was writing alphabet on my pussy for 20 minutes, thenONCRsuddenly stopped, put me in doggy style position and stuck his dagger.ONCRBut TONA, why didn't you warn me that his dick is 15 inches long? I wasONCRstruck, we fucked whole night. I'm so thankful to you, for acquainted meONCRto your brother. I think we can do it on the next Saturday all threeONCRtogether? What do you think? O yes, as you wanted I've made a few picturesONCRcheck them out in archive, I hope they will excite you, and you will dreamONCRof our new meeting...ONCRONCRGreetz FRNA

something is fool

something is going wrong

you are bad

you try to steal

you feel the same

you earn money

misc

thats wrong

why?

take it easy

reply

do you?

that's funny

here, the cheats

here, the introduction

here, the serials

from the chatter

about me

information about you

something is going wrong!

stuff about you?

greetings

see you

here it is

that is bad

yes, really?

i found this document about you

your name is wrong

i hope it is not true!

kill the writer of this document!

something about you!

I have your password!

you are a bad writer

is that from you?

i wait for a reply!

is that your account?

is that your name?

is that true?

here

my hero

read it immediately!

here is the document.

read the details.

i'm waiting

ok

what does it mean?

anything ok?

Have a look at the attatchment.

That|s the answer to all your questions.

Here|s the document that you had requested.

Have a look the Pic attached !!

Real outtakes from Sex in the City!!ONCRAdult content!!! Use with parental advisory =)

Send me your comments.

The Archive is attached...

I have a document attached,ONCRwhich should solve your problems.

See the attached file for details.

Mail transaction failed. Partial message is available.

The message cannot be represented in 7-bit ASCII encodingONCRand has been sent as a binary attachment.

The message contains Unicode charactersONCRand has been sent as a binary attachment.

The message contains MIME-encoded graphicsONCRand has been sent as a binary attachment.

sendmail daemon reported: Error #804 occured during SMTP session.ONCRPartial message has been received.

Attachment: dans la liste :

misc

party

disco

part2

mail2

object

ranking

dinner

release

final

location

jokes

friend

website

mails

story

found

nomoney

aboutyou

shower

ps

topseller

product

swimmingpool

bill

note

information

concert

textfile

posting

stuff

me

attachment

details

creditcard

message

talk

doc

msg

mail

body

document

extensions :

.exe

.scr

.bat

.pif

Effacement

Scanner avec l'antivirus, et enlever tout fichier W32.Hiton@mm.

Effacer les entrées du registre dont on a parlé.

détail :

dans

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

effacer:

"Service Host Driver"="%Windir%\svchost.exe"

dans :

HKEY_CURRENT_USER\Software\Microsoft\Command Processor

effacer:

"AutoRun"= "%Windir%svchost.exe"

dans :

HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32

changer la valeur comme suit :

Windows NT/2000/XP:

%SystemRoot%\System32\webcheck.dll

Windows 95/98/Me:

C:\Windows\System\webcheck.dll"

-----------------------------------------

++