w32.virut.w, PE_VIRUT.A w32.virut.w, PE_VIRUT.A

I just download google pack with norton and the first scan hook my fav svn tortoise with w32.virut.w . Je viens de télécharger Google Pack avec Norton et le premier scan de mon crochet fav svn w32.virut.w avec les tortoise.

Excerpt from Symantec Extrait de Symantec

W32.Virut.A is a virus that infects executable files and opens a back door on TCP port 65520 by connecting to a predefined IRC server. W32.Virut.A est un virus qui infecte les fichiers exécutables et ouvre une porte dérobée sur le port TCP 65520 en vous connectant à un serveur IRC prédéfini.

Netstats

netstat -aob > netstat.log netstat-AOB> netstat.log

  TCP USER:1028 78.109.19.140.in.hosting.ua:65520 ESTABLISHED 936 UTILISATEUR TCP: 1028 78.109.19.140.in.hosting.ua: 65520 CRÉÉ 936 
  [winlogon.exe] 

The free version of Norton Internet Scan Failed to fixed the virus. La version gratuite de Norton Internet Scan Impossible de fixer le virus. :( : (

Norton Logs Norton Logs

 Process: Processus: 
  c:\windows\system32\ctfmon.exe c: \ windows \ system32 \ ctfmon.exe 
  c:\program files\tortoisesvn\bin\tsvncache.exe C: \ Program Files \ TortoiseSVN \ bin \ TSVNCache.exe 
 Infection: 
  c:\windows\system32\ctfmon.exe c: \ windows \ system32 \ ctfmon.exe 
  c:\program files\tortoisesvn\bin\tsvncache.exe C: \ Program Files \ TortoiseSVN \ bin \ TSVNCache.exe 
  c:\windows\system32\spoolsv.exe c: \ windows \ system32 \ spoolsv.exe 
  c:\windows\system32\locator.exe c: \ windows \ system32 \ locator.exe 
  c:\windows\system32\alg.exe c: \ windows \ system32 \ alg.exe 
  c:\windows\system32\sessmgr.exe c: \ windows \ system32 \ sessmgr.exe 
  c:\windows\system32\dllhost.exe c: \ windows \ system32 \ DLLHost.exe tombait 
  c:\windows\system32\rsvp.exe c: \ windows \ system32 \ rsvp.exe 
  c:\windows\system32\dmadmin.exe c: \ windows \ system32 \ dmadmin.exe 
  c:\windows\system32\msdtc.exe c: \ windows \ system32 \ msdtc.exe 
  c:\windows\system32\cisvc.exe c: \ windows \ system32 \ Cisvc.exe 
  c:\windows\system32\wbem\wmiapsrv.exe c: \ windows \ system32 \ WBEM \ wmiapsrv.exe 
  c:\windows\system32\ups.exe c: \ windows \ system32 \ ups.exe 
  c:\windows\system32\msiexec.exe c: \ windows \ system32 \ msiexec.exe 
  c:\windows\system32\netdde.exe c: \ windows \ system32 \ Netdde.exe 
  c:\windows\system32\vssvc.exe c: \ windows \ system32 \ vssvc.exe 
  c:\windows\system32\mnmsrvc.exe c: \ windows \ system32 \ mnmsrvc.exe 
  c:\windows\system32\mshta.exe c: \ windows \ system32 \ mshta.exe 
  c:\windows\system32\userinit.exe c: \ windows \ system32 \ userinit.exe 
  c:\windows\system32\ieudinit.exe c: \ windows \ system32 \ ieudinit.exe 
  c:\windows\inf\unregmp2.exe c: \ windows \ inf \ unregmp2.exe 
  c:\windows\system32\ie4uinit.exe c: \ windows \ system32 \ ie4uinit.exe 
  c:\windows\system32\rundll32.exe c: \ windows \ system32 \ rundll32.exe 
  c:\windows\system32\regsvr32.exe c: \ windows \ system32 \ regsvr32.exe 
  c:\windows\system32\ntsd.exe c: \ windows \ system32 \ ntsd.exe 
  c:\program files\wakoopa\wakoopa.exe C: \ Program Files \ wakoopa \ wakoopa.exe 
  c:\program files\7-zip\7zfm.exe C: \ Program Files \ 7-zip \ 7zfm.exe 
  c:\program files\acd systems\acdsee\6.0\acdsee6.exe C: \ Program Files \ ACD Systems \ ACDSee \ 6.0 \ acdsee6.exe 
  c:\program files\adobe\adobe help center\ahc.exe C: \ Program Files \ Adobe \ Adobe Help Center \ ahc.exe 
  c:\program files\netmeeting\conf.exe C: \ Program Files \ NetMeeting \ conf.exe 
  c:\program files\common files\acd systems\en\devdetect.exe C: \ Program Files \ Fichiers communs \ ACD Systems \ fr \ devdetect.exe 
  c:\program files\windows nt\dialer.exe C: \ Program Files \ Windows NT \ DIALER.EXE 
  c:\program files\acd systems\fotocanvas\3.0\fotocanvas3.exe C: \ Program Files \ ACD Systems \ fotocanvas \ 3.0 \ fotocanvas3.exe 
  c:\program files\acd systems\fotoslate\3.0\fotoslate3.exe C: \ Program Files \ systèmes ACD \ fotoslate \ 3.0 \ fotoslate3.exe 
  c:\windows\pchealth\helpctr\binaries\helpctr.exe C: \ Windows \ PCHealth \ HelpCtr \ binaires \ helpctr.exe 
  c:\program files\hp\digital imaging\unload\hpqapkil.exe C: \ Program Files \ HP \ Digital Imaging \ décharger \ hpqapkil.exe 
  c:\program files\hp\digital imaging\unload\hpqdia.exe C: \ Program Files \ HP \ Digital Imaging \ décharger \ hpqdia.exe 
  c:\program files\hp\digital imaging\unload\hpqdias.exe C: \ Program Files \ HP \ Digital Imaging \ décharger \ hpqdias.exe 
  c:\program files\hp\digital imaging\unload\hpqphunl.exe C: \ Program Files \ HP \ Digital Imaging \ décharger \ hpqphunl.exe 
  c:\program files\hp\digital imaging\unload\hpqpsmon.exe C: \ Program Files \ HP \ Digital Imaging \ décharger \ hpqpsmon.exe 
  c:\program files\hp\digital imaging\unload\hpqunset.exe C: \ Program Files \ HP \ Digital Imaging \ décharger \ hpqunset.exe 
  c:\program files\hp\digital imaging\bin\hpqvpswp.exe C: \ Program Files \ HP \ Digital Imaging \ bin \ hpqvpswp.exe 
  c:\program files\windows nt\hypertrm.exe C: \ Program Files \ Windows NT \ hypertrm.exe 
  c:\program files\internet explorer\connection wizard\icwconn1.exe C: \ Program Files \ Internet Explorer \ Connection Wizard \ icwconn1.exe 
  c:\program files\internet explorer\connection wizard\icwconn2.exe C: \ Program Files \ Internet Explorer \ Connection Wizard \ icwconn2.exe 
  c:\program files\internet explorer\iexplore.exe C: \ Program Files \ Internet Explorer \ iexplore.exe 
  c:\program files\adobe\adobe photoshop cs2\imageready.exe C: \ Program Files \ Adobe \ Adobe Photoshop CS2 \ imageready.exe 
  c:\program files\internet explorer\connection wizard\inetwiz.exe C: \ Program Files \ Internet Explorer \ Connection Wizard \ inetwiz.exe 
  c:\program files\internet explorer\connection wizard\isignup.exe C: \ Program Files \ Internet Explorer \ Connection Wizard \ isignup.exe 
  c:\program files\java\jre1.6.0_02\bin\javaws.exe C: \ Program Files \ Java \ jre1.6.0_02 \ bin \ javaws.exe 
  c:\windows\system32\usmt\migwiz.exe c: \ windows \ system32 \ USMT \ migwiz.exe 
  c:\program files\movie maker\moviemk.exe C: \ Program Files \ Movie Maker \ moviemk.exe 
  c:\program files\windows media player\mplayer2.exe C: \ Program Files \ Windows Media Player \ Mplayer2.exe 
  c:\program files\combined community codec pack\mpc\mplayerc.exe C: \ Program Files \ combiné communauté Codec Pack \ PPM \ mplayerc.exe 
  c:\windows\pchealth\helpctr\binaries\msconfig.exe C: \ Windows \ PCHealth \ HelpCtr \ binaires \ msconfig.exe 
  c:\program files\outlook express\msimn.exe C: \ Program Files \ Outlook Express \ msimn.exe 
  c:\program files\common files\microsoft shared\msinfo\msinfo32.exe C: \ Program Files \ Fichiers communs \ Microsoft Shared \ Msinfo \ msinfo32.exe 
  c:\program files\messenger\msmsgs.exe C: \ Program Files \ Messenger \ msmsgs.exe 
  c:\program files\notepad  \notepad  .exe C: \ Program Files \ Notepad     \ notepad    . exe 
  c:\windows\system32\mspaint.exe c: \ windows \ system32 \ mspaint.exe 
  c:\program files\adobe\adobe photoshop cs2\photoshop.exe C: \ Program Files \ Adobe \ Adobe Photoshop CS2 \ photoshop.exe 
  c:\program files\quicktime\pictureviewer.exe C: \ Program Files \ QuickTime \ pictureviewer.exe 
  c:\python25\python.exe c: \ python25 \ python.exe 
  c:\program files\real\realplayer\realplay.exe C: \ Program Files \ réel \ RealPlayer \ realplay.exe 
  c:\program files\common files\real\update_ob\rnxproc.exe C: \ Program Files \ Fichiers communs \ réel \ update_ob \ rnxproc.exe 
  c:\windows\soundman.exe c: \ windows \ SOUNDMAN.EXE 
  c:\program files\tortoisesvn\bin\subwcrev.exe C: \ Program Files \ TortoiseSVN \ bin \ subwcrev.exe 
  c:\program files\outlook express\wab.exe C: \ Program Files \ Outlook Express \ wab.exe 
  c:\program files\outlook express\wabmig.exe C: \ Program Files \ Outlook Express \ wabmig.exe 
  c:\program files\winrar\winrar.exe C: \ Program Files \ WinRAR \ winrar.exe 
  c:\program files\windows media player\wmplayer.exe C: \ Program Files \ Windows Media Player \ wmplayer.exe 
  c:\program files\windows nt\accessories\wordpad.exe C: \ Program Files \ Windows NT \ Accessoires \ wordpad.exe 
  c:\program files\combined community codec pack\zoom player\zplayer.exe C: \ Program Files \ combiné communauté Codec Pack \ Zoom Player \ zplayer.exe 
  c:\windows\system32\logon.scr c: \ windows \ system32 \ logon.scr 
 Service: 
  RpcLocator 
  ALG 
  RDSessMgr 
  COMSysApp 
  RSVP 
  dmadmin 
  MSDTC 
  CiSvc 
  WmiApSrv 
  UPS 
  SwPrv 
  MSIServer 
  NetDDE 
  VSS 
  mnmsrvc 
 Browser Cache Cache du navigateur 
 Registry: Registre: 
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon->Userinit HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon-> Userinit 

had to reinstall my windows XP because there is so many hook. a réinstaller mon windows XP car il ya tant de crochet. I had send a support email to hosting.ua but still got no replied from theme. J'avais envoyer un courriel à l'appui hosting.ua mais toujours pas reçu de réponse du thème. need to reboot now. besoin de redémarrer maintenant.

Nov 17 07 , Update 17 novembre 07, mise à jour

I got reply back from hosting.ua support. Je suis de retour de réponse hosting.ua soutien. below is part of the email ci-dessous s'inscrit dans le cadre de l'e-mail

 from abuse@hosting.ua de abuse@hosting.ua 
 to nospam@gmail.com, à nospam@gmail.com, 
 date Nov 13, 2007 5:00 PM Date de sortie Nov 13, 2007 5:00 PM 
 subject Reply: trojan 78.109.19.140.in.hosting.ua #48879 Répondre thème: trojan 78.109.19.140.in.hosting.ua # 48879 

 hide details Nov 13 (3 days ago) Hide details novembre 13 (il ya 3 jours) 	

 Reply Répondre 

 ======== CUT HERE ========= CUT HERE ======== ========= 
 Your support request was answered: Votre demande de soutien a été répondu: 

 Created: 11.11.2007 1:28:38 Création: 11.11.2007 1:28:38 
 Last Mod: 12.11.2007 1:41:30 Dernière Mod: 12.11.2007 1:41:30 

 Assigned To: Assigné à: 
 admin(Hosting.UA) admin (Hosting.UA) 

 [11.11.2007 1:28:38] [11.11.2007 1:28:38] 
 Q: hi, Q: salut, 
 This is for your attention. C'est pour votre attention. I got a trojan in pc it routed back to one of J 'ai un cheval de Troie dans le PC, il en déroute dos à l'une des 
 your hosting at *78.109.19.140.in.hosting.ua * votre hébergement à 78.109.19.140.in.hosting.ua * * 

 I hope you can do something about it. J'espère que vous pouvez faire quelque chose. 

 Thank you Merci 
 ------------------------------------------------------- -------------------------------------------------- ----- 

 [13.11.2007 11:00:08] [13.11.2007 11:00:08] 
 A: Fixed! A: Correction! 

 thx 
 www.Hosting.UA 

 ------------------------------------------------------- -------------------------------------------------- ----- 
 Hosting.UA Administration Hosting.UA Administration 

Well there is no explaination about the issue from the support staff.  hope this site will be closed down for good. Eh bien il n'y a pas explications sur la question du personnel de soutien. Espérons que ce site sera fermé pour de bon. Google already blocked and place a warning when you search for the infected URI. Déjà bloqué Google et le lieu d'un avertissement lorsque vous effectuez une recherche pour les personnes infectées URI.