Salut , j'ai eu + ou - le meme virus
voici ce que j'ai fait pour le supprimer:
W32/Hiton.a@MM
autres noms :
WORM_HITON.A
Win32.Hiton.A
Type: Ver
Taille du fichier: 44,036 bytes
Systemes touchés: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systemes immunisés: DOS, Linux, Macintosh, OS/2, UNIX
action:
Se copie et prend le nom de \Svchost.exe dans le repertoire racine de Windows.
Crée le fichier \Mssvc.dll (44,036 bytes) dans le repertoire System.
Ajoute les entrées suivantes a la base de registre :
"Service Host Driver"="%Windir%\svchost.exe"
dans
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
C'est son autorun.
On trouve aussi :
"(Default)" = "%System%\mssvc.dll"
dans:
HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\
InProcServer32
De cette facon, Explorer charge la bibliothèque Mssvc.dll.
Enfin :
"AutoRun"= "%Windir%svchost.exe"
dans:
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
Il génère les fichiers suivants :
%System%\Wsick32.dll, où sont stockées les adresses mail qu'il trouve sur la machine.
%System%\wsuck32.dll, fichier texte.
Remplace des entrées dans :
%System%\Drivers\etc\Hosts (sous Windows NT/2000/XP)
%Windir%\Hosts.sam (sous Windows 95/98/Me)
si il scanne et trouve l'un de ces mots:
grisoft
nai
networkassociates
vil.nai
nod32
bitdefender
f-secure
securityresponse.symantec
vsantivirus
openantivirus
norman
f-prot
ravantivirus
kaspersky
sarc
sophos
pandasoftware
antivirus
mcafee
trendmicro
symantec
Crée le repertoire :
[racine windows]\{21EC2020-3AEA-1069-A2DD-08002B30309D}
et s'y copie.
Il utilise son propre service SMTP pour l'envoi de mails.
Si recu par cette voie, l'en tete aura la forme
From: <spoofed>
Subject: l'un de ceux ci :
TONA, you have to see this!
hey wuts up?
hey wuts up TONA?
Very funny
Useful
Happy Times
gift for you TONA
Attatchments
Hiiiiiii TONA
Hiiiiiii
Wait for more
elegant ppl should satisfy thier taste with elegant things
heyyy TONA
heyyy
Heyyyyyyyy Lola Wussaaap??
Another one?
Hey Wussap?
Hey I thought you trusted me but ...
unknown
fake
leaked
stolen
information for you, TONA
information
warning
something for you
read it immediately
Undeliverable mail --
Server Report
Status
Returned mail --
Mail Delivery System
La Transazione Della Posta + venuto a mancare
La Transaction De Courrier A TchouT
Mail Transaction Failed
here|s the document you requested
here|s the document
Pr0n!
Here|s a nice Picture
here|s the archive you requested
New Internal Rls...
Do not release, its the internal rls!
hola TONA
hola
hello TONA
hello
hi TONA
Error
Ciao TONA
Ciao
Darling
Congratulations TONA!
Message: Un de ces messages :
i found this amazing file in my Recycled , i know u love this kind of things ONCRcyaaa
Hummm , i hope u accept this show as an apology.ONCRsave it for hard times
i will be waiting for u emaill to remind me of your self.
i'm fine , thanx for asking ONCRand thanx for the nice attachements.ONCRbut unfortunately, i don't remember you
you seem to be mad @ me coz i didn't send u anything for along time,ONCRi didn't forget u , but i was kinda busy , i've got all of ur emailsONCRthanx and i hope u accept this one as an apology.
i've got this surprise from a friend ONCRit really deserves a few minutes of your time.ONCRNever mind !
i thing the subject is enough to describe the attached file !ONCRcheck it out and replay your opinion
heyyyy i tried many times to send u this email but ur account was out of storage as i thinkONCRany way , make sure that i didn't and i won't forget u ONCRCya Forgotten
I've got your email , but you forgot to upload the attachments.ONCRDon't be selfish , i sent you all the files i have, send me anything
i just wanted to say sorry for last nightONCRand .. i wish u accept this as an apologyONCRbye dear
I can't be online tonight anyway , i sent u something u r gonna love ONCRcya tomorrow
i lost FRNA's Email plzz send this file to her ONCRand tell her i can't be online tonightONCRBye
YO TONA , IM SICK OF UR EMAILS , IF U LOSE IT AGAIN I WONT GIVE IT TO U, SAVE ITONCRBYEEE
I forgot to tell u , the other file is with FRNA bye
Heyyyy TONAI lost the other email , anyway i sent u all u needONCRi have just got it , plz tell me if u need more.bye
Here is the FRNA Dont tell Sam abt itONCRCya
i haven't ever thought i should send u my briefcase to gain ur Trust.ONCRHave it all bye
HEY TONA, call FRNA a virus text stealer =)
Hi TONA its FRNA.ONCRONCRI was shocked, when I found out that it wasn't you but your twin brother,ONCRthat's amazing, you're as like as two peas. No one in bed is better thanONCRyou TONA. I remember, I remember everything very well, that promised youONCRto tell how it was, I'll give you a call today after 9. He took my skirtONCRoff, then my panties, then my bra, he sucked my t**s, with the same furyONCRyou do it. He was writing alphabet on my pussy for 20 minutes, thenONCRsuddenly stopped, put me in doggy style position and stuck his dagger.ONCRBut TONA, why didn't you warn me that his dick is 15 inches long? I wasONCRstruck, we fucked whole night. I'm so thankful to you, for acquainted meONCRto your brother. I think we can do it on the next Saturday all threeONCRtogether? What do you think? O yes, as you wanted I've made a few picturesONCRcheck them out in archive, I hope they will excite you, and you will dreamONCRof our new meeting...ONCRONCRGreetz FRNA
something is fool
something is going wrong
you are bad
you try to steal
you feel the same
you earn money
misc
thats wrong
why?
take it easy
reply
do you?
that's funny
here, the cheats
here, the introduction
here, the serials
from the chatter
about me
information about you
something is going wrong!
stuff about you?
greetings
see you
here it is
that is bad
yes, really?
i found this document about you
your name is wrong
i hope it is not true!
kill the writer of this document!
something about you!
I have your password!
you are a bad writer
is that from you?
i wait for a reply!
is that your account?
is that your name?
is that true?
here
my hero
read it immediately!
here is the document.
read the details.
i'm waiting
ok
what does it mean?
anything ok?
Have a look at the attatchment.
That|s the answer to all your questions.
Here|s the document that you had requested.
Have a look the Pic attached !!
Real outtakes from Sex in the City!!ONCRAdult content!!! Use with parental advisory =)
Send me your comments.
The Archive is attached...
I have a document attached,ONCRwhich should solve your problems.
See the attached file for details.
Mail transaction failed. Partial message is available.
The message cannot be represented in 7-bit ASCII encodingONCRand has been sent as a binary attachment.
The message contains Unicode charactersONCRand has been sent as a binary attachment.
The message contains MIME-encoded graphicsONCRand has been sent as a binary attachment.
sendmail daemon reported: Error #804 occured during SMTP session.ONCRPartial message has been received.
Attachment: dans la liste :
misc
party
disco
part2
mail2
object
ranking
dinner
release
final
location
jokes
friend
website
mails
story
found
nomoney
aboutyou
shower
ps
topseller
product
swimmingpool
bill
note
information
concert
textfile
posting
stuff
me
attachment
details
creditcard
message
talk
doc
msg
mail
body
document
extensions :
.exe
.scr
.bat
.pif
Effacement
Scanner avec l'antivirus, et enlever tout fichier W32.Hiton@mm.
Effacer les entrées du registre dont on a parlé.
détail :
dans
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
effacer:
"Service Host Driver"="%Windir%\svchost.exe"
dans :
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
effacer:
"AutoRun"= "%Windir%svchost.exe"
dans :
HKEY_CLASSES_ROOT\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32
changer la valeur comme suit :
Windows NT/2000/XP:
%SystemRoot%\System32\webcheck.dll
Windows 95/98/Me:
C:\Windows\System\webcheck.dll"
Message édité par fablamenace le 13-03-2004 à 11:20:02