OT: Virusii de tip image.php

Ati primit un mail sau link de genul:

awesome you should check this out wow http://www.ca15***.net/biz/?read=4216576
~*Advertisement
           
wow this is pretty crazy you should check this out http://www.wa1****.net/biz/?read=8034954
~*Advertisement

wow give this a look http://www.ca****s.net/biz/?employment=8427234
~*Advertisement

wow this is amazing you should look into it http://www.w**.net/biz/?employment=0185353
~*Advertisement

(am inlocuit site-ul infectat din URL sa nu cumva sa dea careva click din prea mult entuziasm!)
si ati dat click sa vedeti "awesome" sau "pretty crazy" ala, avind de pilda doar un simplu avira ca antivirus, v-ati infectat!
Si ati inceput implicit sa ii fericiti pe toti prietenii vostri ca si cum ati tusi fara batista ...
Fiindca e epidemie si nu mai e de glumit, cititi in continuare:
======================

Virusii de tip image.php veniti prin messenger, FB, emailuri:

O soutie de pe:
http://www.faravirusi.com/2010/05/02/solutie-virus-yahoo-messenger-%E2%80%93-%E2%80%9Cfoto-httpariafotos-comimage-php-sau-httptviceimg-comimage-php%E2%80%9D/

Pentru a nu lungi vorba, iata cum puteti incerca sa scapati de acesti intrusi:

Descarcati Malwarebytes Anti-Malware.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

Instalati-l si la sfarsit asigurati-va ca ati bifat urmatoarele: Update Malwarebytes' Anti-Malware si Launch Malwarebytes' Anti-Malware. Apoi apasati Finish
Dupa lansarea programului, selectati Full scan si apoi apasati pe Scan.
Dupa ce termina apasati OK si apoi Show Results. Asigurati-va ca e totul bifat si apoi apasati Remove Selected.
La final va solicita restartarea PC-ului. Nota mea: internetul deconectat!

Descarcati Kaspersky Removal Tool si scanati partitia C:\ cu el, stergand infectiile gasite.

http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/avptool11/setup_11.0.0.1245.x01_2012_04_25_05_34.exe

Descarcati ComboFix si salvati-l pe Desktop.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Apoi asigurati-va ca ati inchis toate programele care ruleaza (Yahoo Messenger, MozilaFirefox, etc) si rulati ComboFix. Va va intreba daca sa inceapa sa curete sistemul. Confirmati cu Yes de fiecare data. Nu-l opriti in timp ce scaneaza si dezinfecteaza sistemul. E posibil ca in timpul rularii lui desktop-ul sa dispara, dar nu va ingrijorati.

Pentru cei interesati de mai multe detalii, virusul creeaza urmatoarele fisiere:
%Windir%\infocard.exe (acesta va fi si procesul activ; sunt folosite si alte denumiri, cum ar fi net.exe sau net1.exe)
%Windir%\mds.sys
%Windir%\mdt.sys
%Windir%\winbrd.jpg

De asemenea urmatoarele chei registry ii apartin:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ [Firewall Administrating = "%Windir%\infocard.exe"]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\ [Firewall Administrating = "%Windir%\infocard.exe"]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ [Firewall Administrating = "%Windir%\infocard.exe"]

Prin aceste intrari in registry-ul Windows, virusul isi asigura rularea la fiecare pornire a computer-ului.

http://depositfiles.com/files/vergn3fma (puteti incerca si un fisier bat ce contine liniile de mai jos)

==============================
taskkill /f /im jusched.exe
taskkill /f /im jusched.exe
del /f /a %Windir%\jusched.exe
del /f /a c:\users\public\jusched.exe
==============================

Vezi si:
http://devirusare.com/2010/04/30/yahoo-messenger-virus-httpzhelefun-comimage-php-si-httptviceimg-comimage-php/
http://www.softpedia.com/get/Antivirus/MSN-Virus-Cleaner.shtml
http://blogger-warning.blogspot.com/2010/06/virusul-de-yahoo-messenger-se-intoarce_28.html

--
Ginduri bune,
Radu Mircea SERBAN
www.scouts.ro
__________________________________________________
Promo: 2% tu = 100% educatie: http://tinyurl.com/boxb92y