Slaper est une infection que l'on trouve généralement sur les Windows non à jour (sans service pack et Service pack 1).
L'infection se transmet automatiquement sur les ordinateurs non protégés par un pare-feu.
Une fois infecté.. l'infection détruit tout parefeu ce qui permet une réinfection...
La difficulté consiste donc à nettoyer l'infection en l'empéchant de revenir. Etant donné que l'infection flingue les firewall, il est recommandé de fermer les ports sensibles avec Windows Worms Doors Cleaner (WWDC) lors de la désinfection.
Si vous laissez la machine non protégée sans fermer les ports... cela ne sert à rien de désinfecter car l'infection va revenir!!
Quelques variantes :
- Fichier : helpermnew6win.exe - Trojan-Proxy.Win32.Slaper.c
- Fichiers : msvccc66 et svcchosst.exe - Trojan-Proxy.Win32.Slaper.e
- Fichier : mnew6win.exe Trojan-Proxy.Win32.Slaper.c
- Fichier aléatoire : Trojan-Proxy.Win32.Slaper.p
L'infection Slaper est très facilement reconnaissanble car il y a une multitude de clefs Run avec des noms de fichiers aléatoires (les fichiers sont recopiés et lancés avec de clefs différentes.
Quelques exemples :
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [bcmproc] cmdyaazn.exe
O4 - HKLM\..\Run: [ascdps] C:\WINDOWS\System32\itsdde.exe
O4 - HKLM\..\Run: [dllcvss] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKLM\..\Run: [idmlssp] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKLM\..\Run: [cxsemse] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\anfkbvt.exe <-- Trojan Ranky et Troj/Ranky-BA - on le retrouve souvent.
O4 - HKLM\..\Run: [asedwes] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKLM\..\Run: [ncsysproc] C:\WINDOWS\System32\sdmvproc.exe
O4 - HKLM\..\Run: [dlcipscl] C:\WINDOWS\System32\dcpavss.exe
O4 - HKLM\..\Run: [ssmcopx] C:\WINDOWS\System32\umcgusim.exe
O4 - HKLM\..\Run: [wdmlpc] C:\WINDOWS\System32\umcgusim.exe
O4 - HKLM\..\Run: [zwlibs] C:\WINDOWS\System32\umcgusim.exe
O4 - HKLM\..\Run: [Nero FR] nerofree.com
O4 - HKLM\..\Run: [ldvbs] C:\WINDOWS\System32\umcgusim.exe
O4 - HKLM\..\RunServices: [Nero FR] nerofree.com
O4 - HKCU\..\Run: [ascdps] C:\WINDOWS\System32\itsdde.exe
O4 - HKCU\..\Run: [dllcvss] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKCU\..\Run: [idmlssp] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKCU\..\Run: [cxsemse] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKCU\..\Run: [asedwes] C:\WINDOWS\System32\schnpgdr.exe
O4 - HKCU\..\Run: [ncsysproc] C:\WINDOWS\System32\sdmvproc.exe
O4 - HKCU\..\Run: [dlcipscl] C:\WINDOWS\System32\dcpavss.exe
O4 - HKCU\..\Run: [ssmcopx] C:\WINDOWS\System32\umcgusim.exe
O4 - HKCU\..\Run: [wdmlpc] C:\WINDOWS\System32\umcgusim.exe
O4 - HKCU\..\Run: [zwlibs] C:\WINDOWS\System32\umcgusim.exe
O4 - HKCU\..\Run: [ldvbs] C:\WINDOWS\System32\umcgusim.exe
O4 - HKCU\..\Run: [Nero FR] nerofree.com
Il peut y avoir vraiment beaucoup de ligne 04 comme le montre ce rapport
Les fichiers et rootkit que l'on peut rencontrer..
Les rootkits qui peuvent être présent :
- Toujours rustock/pe386
- ntio256.sys --> Trojan.Win32.Crypt.g - BackDoor-DIX.dr
C:\WINDOWS\system32\kxlwvach.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\nlib.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\nmwm.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\ntxphty.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\nwgiu.exe Infected: Trojan-Proxy.Win32.Ranky.gn skipped
C:\WINDOWS\system32\oodccnv.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\opny.exe Infected: Trojan-Proxy.Win32.Ranky.gn skipped
C:\WINDOWS\system32\pzikcmkv.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\thgu.exe Infected: Trojan-Proxy.Win32.Agent.mf skipped
C:\WINDOWS\system32\max1d1641.exe Dialer.Maxd
C:\WINDOWS\system32\dcwy.exe -> Backdoor.Agobot.aix : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ntpvau.exe -> Backdoor.PoeBot.j : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\winIogon.exe -> Backdoor.PoeBot.j : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\firewall.exe~ -> Backdoor.VanBot.ax : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\onmp.exe -> Backdoor.PoeBot.c : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ymanwo.exe -> Backdoor.PoeBot.j : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ntpvau.exe -> Backdoor.PoeBot.j : Nettoyé et sauvegardé (mise en quarantaine).
_________________________
Les détections de la variante Slaper.U au 15/05/2007
Complete scanning result of "umcgusim.exe", received in VirusTotal at 05.15.2007, 11:40:38 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.15.1 05.15.2007 no virus found
AntiVir 7.4.0.15 05.15.2007 TR/Crypt.PCMM.Gen
Authentium 4.93.8 05.14.2007 no virus found
Avast 4.7.997.0 05.15.2007 no virus found
AVG 7.5.0.467 05.14.2007 no virus found
BitDefender 7.2 05.15.2007 no virus found
CAT-QuickHeal 9.00 05.14.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.15.2007 no virus found
DrWeb 4.33 05.15.2007 no virus found
eSafe 7.0.15.0 05.14.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3634 05.15.2007 no virus found
Ewido 4.0 05.14.2007 no virus found
FileAdvisor 1 05.15.2007 no virus found
Fortinet 2.85.0.0 05.15.2007 suspicious
F-Prot 4.3.2.48 05.14.2007 no virus found
F-Secure 6.70.13030.0 05.15.2007 no virus found
Ikarus T3.1.1.7 05.15.2007 no virus found
Kaspersky 4.0.2.24 05.15.2007 no virus found
McAfee 5030 05.14.2007 no virus found
Microsoft 1.2503 05.15.2007 no virus found
NOD32v2 2267 05.15.2007 probably unknown NewHeur_PE virus
Norman 5.80.02 05.14.2007 no virus found
Panda 9.0.0.4 05.15.2007 Suspicious file
Prevx1 V2 05.15.2007 Covert.Sys.Exec
Sophos 4.17.0 05.11.2007 no virus found
Sunbelt 2.2.907.0 05.12.2007 VIPRE.Suspicious
Symantec 10 05.15.2007 no virus found
TheHacker 6.1.6.115 05.14.2007 no virus found
VBA32 3.12.0 05.14.2007 no virus found
VirusBuster 4.3.7:9 05.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.15.2007 Trojan.Crypt.PCMM.Gen
Aditional Information
File size: 44969 bytes
MD5: 223dbc0a41ca42e5aabed2b76b8a801f
SHA1: bc03e7a12f20010763844cd85e1e9f5e75ccb47f
packers: NSPack
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=bfd195770175
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.
Complete scanning result of "cmdyaazn.exe", received in VirusTotal at 05.15.2007, 11:38:54 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.15.1 05.15.2007 no virus found
AntiVir 7.4.0.15 05.15.2007 TR/Crypt.PCMM.Gen
Authentium 4.93.8 05.14.2007 no virus found
Avast 4.7.997.0 05.15.2007 no virus found
AVG 7.5.0.467 05.14.2007 no virus found
BitDefender 7.2 05.15.2007 no virus found
CAT-QuickHeal 9.00 05.14.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.15.2007 no virus found
DrWeb 4.33 05.15.2007 no virus found
eSafe 7.0.15.0 05.14.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3634 05.15.2007 no virus found
Ewido 4.0 05.14.2007 no virus found
FileAdvisor 1 05.15.2007 no virus found
Fortinet 2.85.0.0 05.15.2007 suspicious
F-Prot 4.3.2.48 05.14.2007 no virus found
F-Secure 6.70.13030.0 05.15.2007 Backdoor.Win32.SdBot.ayk
Ikarus T3.1.1.7 05.15.2007 Backdoor.Win32.SdBot.ayk
Kaspersky 4.0.2.24 05.15.2007 Backdoor.Win32.SdBot.ayk
McAfee 5030 05.14.2007 no virus found
Microsoft 1.2503 05.15.2007 no virus found
NOD32v2 2267 05.15.2007 no virus found
Norman 5.80.02 05.14.2007 no virus found
Panda 9.0.0.4 05.15.2007 Suspicious file
Prevx1 V2 05.15.2007 Win32.Malware.gen
Sophos 4.17.0 05.11.2007 no virus found
Sunbelt 2.2.907.0 05.12.2007 VIPRE.Suspicious
Symantec 10 05.15.2007 no virus found
TheHacker 6.1.6.115 05.14.2007 no virus found
VBA32 3.12.0 05.14.2007 suspected of Backdoor.xBot.1 (paranoid heuristics)
VirusBuster 4.3.7:9 05.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.15.2007 Trojan.Crypt.PCMM.Gen
Aditional Information
File size: 92699 bytes
MD5: 5b37a98c403b1ef3c7758c86ee967ac1
SHA1: cd6d4ceb1fd8fe4f8ddb5d621d4562251be9cae4
packers: NSPack
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=051c95686017
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.
Complete scanning result of "gregrehgtrh.exe", received in VirusTotal at 05.15.2007, 11:44:30 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.15.1 05.15.2007 no virus found
AntiVir 7.4.0.15 05.15.2007 TR/Crypt.PCMM.Gen
Authentium 4.93.8 05.14.2007 no virus found
Avast 4.7.997.0 05.15.2007 no virus found
AVG 7.5.0.467 05.14.2007 no virus found
BitDefender 7.2 05.15.2007 Trojan.Spammer.A
CAT-QuickHeal 9.00 05.14.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.15.2007 no virus found
DrWeb 4.33 05.15.2007 no virus found
eSafe 7.0.15.0 05.14.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3634 05.15.2007 no virus found
Ewido 4.0 05.14.2007 no virus found
FileAdvisor 1 05.15.2007 no virus found
Fortinet 2.85.0.0 05.15.2007 suspicious
F-Prot 4.3.2.48 05.14.2007 no virus found
F-Secure 6.70.13030.0 05.15.2007 Trojan-Proxy.Win32.Slaper.u
Ikarus T3.1.1.7 05.15.2007 no virus found
Kaspersky 4.0.2.24 05.15.2007 Trojan-Proxy.Win32.Slaper.u
McAfee 5030 05.14.2007 no virus found
Microsoft 1.2503 05.15.2007 no virus found
NOD32v2 2267 05.15.2007 no virus found
Norman 5.80.02 05.14.2007 no virus found
Panda 9.0.0.4 05.15.2007 Trj/Spammer.ABE
Prevx1 V2 05.15.2007 Win32.Malware.gen
Sophos 4.17.0 05.11.2007 no virus found
Sunbelt 2.2.907.0 05.12.2007 Trojan-Proxy.Win32.Slaper.u
Symantec 10 05.15.2007 no virus found
TheHacker 6.1.6.115 05.14.2007 no virus found
VBA32 3.12.0 05.14.2007 no virus found
VirusBuster 4.3.7:9 05.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.15.2007 Trojan.Crypt.PCMM.Gen
Aditional Information
File size: 72207 bytes
MD5: c3fa55c393c26d27e73f2a4d758a52f1
SHA1: c7bab55cdd66d976100566064c89d834c04f43a8
packers: NSPack
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=5fb493746469
Complete scanning result of "tgrftgrf.exe", received in VirusTotal at 05.15.2007, 11:52:04 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.15.1 05.15.2007 Win-Trojan/Proxy.52656
AntiVir 7.4.0.15 05.15.2007 HEUR/Crypted
Authentium 4.93.8 05.14.2007 no virus found
Avast 4.7.997.0 05.15.2007 no virus found
AVG 7.5.0.467 05.14.2007 no virus found
BitDefender 7.2 05.15.2007 no virus found
CAT-QuickHeal 9.00 05.14.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.15.2007 no virus found
DrWeb 4.33 05.15.2007 no virus found
eSafe 7.0.15.0 05.14.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3634 05.15.2007 no virus found
Ewido 4.0 05.14.2007 no virus found
FileAdvisor 1 05.15.2007 No threat detected
Fortinet 2.85.0.0 05.15.2007 suspicious
F-Prot 4.3.2.48 05.14.2007 no virus found
F-Secure 6.70.13030.0 05.15.2007 no virus found
Ikarus T3.1.1.7 05.15.2007 no virus found
Kaspersky 4.0.2.24 05.15.2007 no virus found
McAfee 5030 05.14.2007 no virus found
Microsoft 1.2503 05.15.2007 no virus found
NOD32v2 2267 05.15.2007 no virus found
Norman 5.80.02 05.14.2007 no virus found
Panda 9.0.0.4 05.15.2007 Suspicious file
Prevx1 V2 05.15.2007 Polynomial.Code.Exploit
Sophos 4.17.0 05.11.2007 no virus found
Sunbelt 2.2.907.0 05.12.2007 Trojan-Proxy.Win32.Slaper.u
Symantec 10 05.15.2007 no virus found
TheHacker 6.1.6.115 05.14.2007 no virus found
VBA32 3.12.0 05.14.2007 suspected of Trojan-Spy.Agent.23 (paranoid heuristics)
VirusBuster 4.3.7:9 05.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.15.2007 Heuristic.Crypted
Aditional Information
File size: 52656 bytes
MD5: 0ff5089881adafc0ee6bfd43a65adc71
SHA1: a813f9c4d53a6081325cbffce3cd9e54a592e2ef
packers: MASKPE
Bit9 info: http://fileadvisor.bit9.com/services/extin...e6bfd43a65adc71
packers: NSPack
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=b44a91552931
Complete scanning result of "trdgrre.exe", received in VirusTotal at 05.15.2007, 11:52:10 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.5.15.1 05.15.2007 Win-Trojan/Xema.70202
AntiVir 7.4.0.15 05.15.2007 TR/Crypt.PCMM.Gen
Authentium 4.93.8 05.14.2007 no virus found
Avast 4.7.997.0 05.15.2007 no virus found
AVG 7.5.0.467 05.14.2007 no virus found
BitDefender 7.2 05.15.2007 no virus found
CAT-QuickHeal 9.00 05.14.2007 (Suspicious) - DNAScan
ClamAV devel-20070416 05.15.2007 no virus found
DrWeb 4.33 05.15.2007 no virus found
eSafe 7.0.15.0 05.14.2007 Suspicious Trojan/Worm
eTrust-Vet 30.7.3634 05.15.2007 no virus found
Ewido 4.0 05.14.2007 no virus found
FileAdvisor 1 05.15.2007 no virus found
Fortinet 2.85.0.0 05.15.2007 suspicious
F-Prot 4.3.2.48 05.14.2007 no virus found
F-Secure 6.70.13030.0 05.15.2007 Trojan-Proxy:W32/Slaper.U
Ikarus T3.1.1.7 05.15.2007 no virus found
Kaspersky 4.0.2.24 05.15.2007 no virus found
McAfee 5030 05.14.2007 no virus found
Microsoft 1.2503 05.15.2007 no virus found
NOD32v2 2267 05.15.2007 no virus found
Norman 5.80.02 05.14.2007 no virus found
Panda 9.0.0.4 05.15.2007 Trj/Spammer.ABG
Prevx1 V2 05.15.2007 Covert.Sys.Exec
Sophos 4.17.0 05.11.2007 no virus found
Sunbelt 2.2.907.0 05.12.2007 VIPRE.Suspicious
Symantec 10 05.15.2007 no virus found
TheHacker 6.1.6.115 05.14.2007 no virus found
VBA32 3.12.0 05.14.2007 no virus found
VirusBuster 4.3.7:9 05.14.2007 no virus found
Webwasher-Gateway 6.0.1 05.15.2007 Trojan.Crypt.PCMM.Gen
Aditional Information
File size: 70202 bytes
MD5: a2c45bed0c3a1782b38bc4f5c04c6c9d
SHA1: 3e206fc5d549e43f7f626f07d3dae4ba2025ea62
packers: NSPack
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=296a93658820
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.