Problema con el registro...

[Alex81]

...creo. Desde hace unos días cada vez que inicio el PC, el windows media player se ejecuta solo.



También en algunas páginas los thumbs de las fotos se convierten en banners a los pocos segundos de cargarse. He pasado el Panda (antivirus), el ad-aware y el a2 pero no me salta ningún virus ni troyano.



Alguien puede ayudarme?



Gracias.

[msc hotline sat]

Posiblemente tu antivirus no detecte todavía el Wallon:



https://foros.zonavirus.com/viewtopic.php?t=778



Recuerda que entra por no tener el parche MS04-013



saludos



ms, 19-05-2004

[Alex81]

error de principiante eligiendo el botón equivocado.



Gracias de todas formas.



Saludos.

[carolxsiempre]

Ahora bien alex, que antivirus tienes, podria ser que tu antivirus no fuese capaz de reconocerlo.



Saludos

Carolxsiempre

[msc hotline sat]

Y aparte de actualizar tu antivirus, podrias lanzar algún antispyware tambien actualizado:



*************************************************************



Eliminacion de adwares y spywares

Pasos a seguir una ver descargados es instalarlos, actualizados (update) y escanear el sistema



· Spybot - Search & Destroy 1.3

Sitio 1 - Descargar Spybot - Search & Destroy 1.3

http://download.com.om/3000-2144-10122137.html?part=104443&subj=dlpage&tag=button

Sitio 2 - Descargar Spybot - Search & Destroy 1.3 desde zonavirus.com

http://www.zonavirus.com/descargas/spybot-sd.asp



· Ad-aware Personal 6.0 Build 181

Sitio 1 - Descargar Ad-aware Personal 6.0 Build 181

http://download.com.com/3001-8022-10214379.html

Paquete Traductor al español

http://updates.ls-servers.com/aaw-lang-pack.exe

Sitio 2 - Descargar Ad-aware Personal 6.0 Build 181 desde zonavirus.com

http://www.zonavirus.com/descargas/ad-aware-free-internet-security.asp

Descargar Paquete Traductor al español desde zonavirus.com

http://www.zonavirus.com/descargas/ad-aware-free-internet-security.asp



Aunque personalmente creo que tiene muchas probabiliodades de ser el Wallon, antes indicado, y que por ser muy reciente, no lo detectan los antivirus, pweo los ONLINE acostumbran a estar muy al día.



Dinos si tenías ya aplicado el parche MS04-013, y prueba de nuevo con:



http://security.symantec.com/default.asp?productid=symhome&langid=ie&venid=sym



que lo controlan como Wallon.A



saludos



ms, 19-05-2004

[Alex81]

...la mala política de dejarlo para luego. Ahora esta instalado.

He pasado 3 antivirus on-line y lo han limpiado. No puedo decirte el nombre exacto del archivo eliminado porqué en la página (Trend Micro) no dan informe. Creo que si que era el Wallon, coincide con los sintomas que dan en la página que diagnostico que me diste. Los banners han dejado de aparecer pero persiste el problema del media player ejecutandose al iniciar el PC. Tal vez si reinstalo el wmp ¿se solucionaría?



Gracias por tu ayuda y amabilidad.



Saludos.

[carolxsiempre]

Alex:



Ve a inicio - todos los programas - inicio, y verifica que no este posicionado alli, por que si es asi eso es lo que te da la carga del wmp cuando inicias el pc.





Saludos

Carolxsiempre

[msc hotline sat]

No hemos tenido aun experiencias con este bicho.



Aparte de lo indicado en la descripcion de McAfee, que te ofrecimos al principio, mira lo que doce Stmantec, por si te puede ayudar:



__________________________________________



W32.Wallon.A@mm

Discovered on: May 11, 2004

Last Updated on: May 13, 2004 04:22:53 PM















W32.Wallon.A@mm is a mass-mailing worm that sends email messages containing a hyperlink to download the worm body from certain URLs. It also harvests the email addresses on the infected machine.



The worm exploits the following vulnerabilities: Microsoft Security Bulletin MS04-004 and Microsoft Security Bulletin MS04-013



This threat is written in Delphi and packed with ASPack.





Also Known As: WORM_WALLON.A [Trend], Win32.Wallon [Computer Associates], W32/Wallon.worm.a [McAfee], I-Worm.Wallon [Kaspersky]



Type: Worm

Infection Length: 36,352 bytes, 150,528 bytes







Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Systems Not Affected: DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x













Virus Definitions (Intelligent Updater) *

May 12, 2004





Virus Definitions (LiveUpdate™) **

May 12, 2004





*

Intelligent Updater definitions are released daily, but require manual download and installation.

Click here to download manually.



**

LiveUpdate virus definitions are usually released every Wednesday.

Click here for instructions on using LiveUpdate.















Wild:



Number of infections: 0 - 49

Number of sites: 3 - 9

Geographical distribution: Low

Threat containment: Easy

Removal: Moderate

Threat Metrics





Wild:

Low

Damage:

Low

Distribution:

Medium







Damage



Payload Trigger: n/a

Payload: n/a

Large scale e-mailing: Sends email messages containing an obfuscated link to download the worm body.

Deletes files: n/a

Modifies files: Overwrites wmplayer.exe on the system.

Degrades performance: n/a

Causes system instability: n/a

Releases confidential info: Sends harvested email addresses to the author.

Compromises security settings: n/a

Distribution



Subject of email: RE

Name of attachment: n/a

Size of attachment: n/a

Time stamp of attachment: n/a

Ports: n/a

Shared drives: n/a

Target of infection: n/a





W32.Wallon.A@mm arrives as an email with a link in the message body. The email uses an Internet Explorer vulnerability, described in Microsoft Security Bulletin MS04-004, to display an obfuscated link. Clicking the link redirects the user to a Web site to download "wmplayer.exe" into the Windows Media Player folder. The Web site may attempt to exploit an Outlook Express vulnerability, described in Microsoft Security Bulletin MS04-013, to download and execute the file. Because the worm attempts to overwrite the Windows Media Player executable, any attempts to run Windows Media Player on an infected computer will execute a copy of the worm.



When wmplayer.exe is executed, it preforms the following actions:





Creates the following registry keys:



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{FE5A1910-F121-11d2-BE9E-01C04A7936B1}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{FE5A1910-F121-11d2-BE9E-01C04A7936B2}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{FE5A1910-F121-11d2-BE9E-01C04A7936B3}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{FE5A1910-F121-11d2-BE9E-01C04A7936B4}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{FE5A1910-F121-11d2-BE9E-01C04A7936B5}



which creates five buttons on the Internet Explorer toolbar.



Each button points to a URL starting with:



http:/ /www.google.com.super-fast-search.apsua.com



The last five buttons in the following screenshot are added by the worm:









The worm also modifies the default home page of Internet Explorer to:



http:/ /www.google.com.super-fast-search.apsua.com/fast-find.htm



and the default search page to:



http:/ /www.google.com.super-fast-search.apsua.com/search.htm





Downloads a file from a predetermined URL and is saved as C:\Alpha.exe. The file is then executed, and remains memory-resident.





Checks for the value:



"Wh"="Yes"



in the registry key:



HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main



creating it if not found, which serves as an infection marker.





Collects email addresses from the Windows address book.



The worm will ignore addresses containing the following strings:



microsoft

support

software

webmaster

postmaster

admin





Uses its own SMTP engine to email itself to the addresses found.



The email has the following characteristics:



From:

The worm uses information found in the following registry key to spoof the From: address of the email:



HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts



Subject: RE:

Message: Contains an obfuscated URI that appears to point to the Web site, http://drs.yahoo.com/<recipient's domain>/NEWS









The worm may also send the list of email addresses found to the address 1@600pics.cjb.net.





Periodically executes a remote cgi script located at http:/ /pixpox.com.













Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":



Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.

If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.

Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.

Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.

Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.

Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.

Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.





The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.





Disable System Restore (Windows Me/XP).

Update the virus definitions.

Restart the computer in Safe mode or VGA mode.

Run a full system scan and delete all the files detected as W32.Wallon.A@mm.

Delete the value that was added to the registry.

Reset the Internet Explorer home page

Reset the Internet Explorer Search page



For specific details on each of these steps, read the following instructions.



1. To disable System Restore (Windows Me/XP)

If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.



Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.



Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.



For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

"How to disable or enable Windows Me System Restore"

"How to turn off or turn on Windows XP System Restore"



--------------------------------------------------------------------------------

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, re-enable System Restore by following the instructions in the aforementioned documents.

--------------------------------------------------------------------------------



For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.



2. To update the virus definitions

Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).

Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).



The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.



3. To restart the computer in Safe mode or VGA mode



Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode.

For Windows 95, 98, Me, 2000, or XP users, restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."

For Windows NT 4 users, restart the computer in VGA mode.



4. To scan for and delete the infected files

Start your Symantec antivirus program and make sure that it is configured to scan all the files.

For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."

For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."

Run a full system scan.

If any files are detected as infected with W32.Wallon.A@mm, click Delete.



--------------------------------------------------------------------------------

Note: If your Symantec antivirus product reports that it cannot delete an infected file, Windows may be using the file. To fix this, run the scan in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode." Once you have restarted in Safe mode, run the scan again.



(After the files are deleted, you can leave the computer in Safe mode and proceed with section 4. When that is done, restart the computer in Normal mode.)



--------------------------------------------------------------------------------





5. To delete the value from the registry





--------------------------------------------------------------------------------

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

--------------------------------------------------------------------------------



Click Start, and then click Run. (The Run dialog box appears.)

Type regedit



Then click OK. (The Registry Editor opens.)





Navigate to the key:



HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main





In the right pane, delete the value:



"Wh"="Yes"





Navigate to the key:



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\





Delete the subkeys:



{FE5A1910-F121-11d2-BE9E-01C04A7936B1}

{FE5A1910-F121-11d2-BE9E-01C04A7936B2}

{FE5A1910-F121-11d2-BE9E-01C04A7936B3}

{FE5A1910-F121-11d2-BE9E-01C04A7936B4}

{FE5A1910-F121-11d2-BE9E-01C04A7936B5}





Exit the Registry Editor.



6. To reset the Internet Explorer home page

Start Microsoft Internet Explorer.

Connect to the Internet, and then go to the page that you want to set as your home page.

Click the Tools menu > Internet Options.

In the Home page section of the General tab, click Use Current, and then click OK.



For additional information, or if this procedure does not work, read the Microsoft® Knowledge Base article, "Home Page Setting Changes Unexpectedly, or You Cannot Change Your Home Page Setting, Article ID 320159."



7. To reset the Internet Explorer Search page

Follow the instructions for your version of Windows



Windows 98/Me/2000

Start Microsoft Internet Explorer.

Click the Search button on the toolbar.

In the Search pane, click Customize.

Click Reset.

Click Autosearch Settings.

Select a search site from the drop-down list, and then click OK.

Click OK.



Windows XP

Because Windows XP is set by default to use animated characters in the search, how you do this can vary. Please read all instructions before you start.

Start Microsoft Internet Explorer.

Click the Search button on the toolbar.

Do one of the following:

If the pane that opens looks similar to this picture:











click the word Customize. Then skip to step h.





If the pane that opens has the words "Search Companion" at the top, and the center looks similar to this picture:











click the "Change preferences" link as shown above. Proceed with step d.





Click the "Change Internet search behavior" link.

Under "Internet Search Behavior," click "With Classic Internet Search."

Click OK. Then close Internet Explorer. (Close the program for the change to take effect.)

Start Internet Explorer. When the search pane opens, it should now look similar to this:











Click the word Customize, and then proceed with the next step.





In the Search pane, click Customize.

Click Reset.

Click Autosearch Settings.

Select a search site from the drop-down list, and then click OK.

Click OK.

Do one of the following:

If you were using (or want to continue using) the "Classic Internet Search" panel, stop here (or proceed with the next section).

If you want to go back to the "Search Companion" search (it usually has an animated character at the button), proceed with step n.





Click the word Customize again.

In the "Customize Search Settings" window, click "Use Search Companion," and then click OK.

Close Internet Explorer. The next time you open it, it will again use the Search Companion.











Write-up by: Yuhui Huang and John Canavan



__________________________________________





Mira de seguir las instrucciones de Carol, de eliminar la carga del WMP de la carpeta de Inicio si allí estuviera, pero no indican que lo instalen allí. Mas bien se trata de claves de registro que ha instalado y que no han sido eliminadas, según indican en la última descripcion.



Si alguien tiene una muestra de este virus, y nos la puede enviar a zonavirus@satinfo.es , abexadoa a un mail cuyo texto sea un copiar y pegar de este post, para contestar como respuesta a este Tema.



De todas formas estudiaremos la posibilidad de hacer una utilidad teorica, aunque siempre nos gusta mas comprobarla practicamente, para la eliminacion de las claves en cuestion.



Y COMO QUE EL VIRUS HA ENTRADO Y SOBREESCRITO EL WINDOWS MEDIA PLAYER ORIGINAL, INSTALANDO OTRO QUE DESCARGA EL VIRUS WALLON A TRAVES DEL AGUJERO MS04.-013, RECALCAMOS LA IMPORTANCIA DE ACTUALIZAR PARCHES DE MICROSOFT !!!



Aparte de lo antes indicado, envianos este Windows Media Player que tengas, que posiblemente no sea el original, y lo analizaremos. Aparte, tras actualizar parches, instalalo de nuevo. Envianoslo a zonavirus@satinfo.es conforme arriba indicado.





saludos



ms, 20-05-2004

[msc hotline sat]

Para el virus Wallom hemos preparadoteoricamente la itoñodad ELIWALLA, a la espera de muestras con las que comprobarla.



Pueden probarla descargandola de :



https://foros.zonavirus.com/viewtopic.php?p=3335#3335



saludos



ms, 20-05-2004

[Alex81]

después de desinstalar el wmp he restaurado la copia original del registro, he cargado otra vez el player y todo funciona con normalidad.



Gracias por vuestra ayuda. :wink:

[msc hotline sat]

Pues muchas geacias por decirnoslo.



Ha sido un placer



saludos



ms, 21-05-2004