Newsgroup: it.tlc.cellulari
Titolo: Wikeyfun e virus !! Occhio !

Wikey srl 

 >Wikey srl
messaggio molto corretto, bravi !
mk

take care
-----Sniiip----
Alcune ulteriori info....
W32/Hybris.gen@M is a Medium risk Virus 
 
Virus Name
W32/Hybris.gen@M  
Date Added
11/1/00 2:37:27 PM  
Virus Characteristics
This is an Internet worm which can be received by email. If run, this
worm modifies the WSOCK32.DLL file, after which, an attempt is made to
mail a copy of the worm to all mail recipients whenever email messages
are sent out. 
AVERT cautions all users to delete unexpected attachments.
W32/Hybris.gen@M is sent unknowingly by the user. 
This Internet worm downloads encypted update components from an
Internet web site, most likely it is the author's site. This worm
downloads encrypted components similar to the method first used by
W95/Babylonia. 
Indications Of Infection
Mail recipients claiming they received an attachment from you when one
was never sent 
Method Of Infection
When this Internet worm is launched, it downloads a file named
INDEX.TXT from the hosting site. This file contains a list of
additional files that the worm is to also download for use. On
November 13 2000, the site was still operational and contained the
following update component files: 
HTTP.DAT
NEWS.DAT
ENCR.DAT
PR0N.DAT
SPIRALE.DAT
SUB7.DAT
DOSEXE.DAT
AVINET.DAT
As of November 20, 2000, the site hosting the virus was taken down,
however, the virus continues to download plugins from alt.comp.virus. 
As of November 21, 2000, a new plugin is being distributed that will
enable W32/Hybris to infect PE files in a non-repairable way.
Executing the worm writes a modified version of the WSOCK32.DLL file
to the WINDOWS SYSTEM directory. This file goes by an extensionless
filename made up of 8 random characters. A line is created in the
WININIT.INI file to rename this, newly created, file to WSOCK32.DLL,
thus overwriting the original WSOCK32.DLL file. This change takes
place the next time the system is booted. The modified WSOCK32.DLL
file attempts to mail a copy of the worm, in the form of a .EXE or
.SCR file, to all mail recipients whenever email messages are sent
out. 
This Internet worm posts update details to a newsgroup named
alt.comp.virus. The message posts is a communication message to the
running Internet worm on hosts to perform self-updates. 
The format of the newsgroup posted message is as follows: 
anon.lcs.mit.edu
!
nym.alias.net
!mail2news
Message-ID:
&
amp;amp;amp;lt;2000111308052...@nym.alias.net
&amp;amp;amp;gt;
From: 
Author-Address: anonymous anon lcs mit edu
Subject: http [44 character alpha code]
Mail-To-News-Contact: 
postm...@nym.alias.net
Organization: 
mail...@nym.alias.net
Newsgroups: alt.comp.virus
Lines: 46 
KUWJGJWCVICGIWIWCZIWHCFXCHB [continues]....
[more coded lines]
[terminated by four asterisks]
**** 
Removal Instructions
The WSOCK32.DLL file must be restored from backup. This can be done
by: 
Windows 98
- Click the START MENU|RUN, type SFC and click OK.
- Choose Extract one file from the installation disk
- Type C:\WINDOWS\SYSTEM\WSOCK32.DLL in the box and click Start.
- In the Restore from box type C:\WINDOWS\OPTIONS\CABS or browse to
the Win98 directory on your Windows98 CD-ROM 
- Click OK and follow remaining prompts 
Windows95
- Click the START MENU|SHUT DOWN choose RESTART IN MS-DOS MODE
- Type: EXTRACT /A C:\WINDOWS\OPTIONS\CABS\WIN95_11.CAB WSOCK32.DLL /L
C:\WINDOWS\SYSTEM 
or 
- Insert your Windows95 CD-ROM and type:
EXTRACT /A D:\WIN95\WIN95_11.CAB WSOCK32.DLL /L C:\WINDOWS\SYSTEM
Where D: is your CD-ROM drive 
Virus Information
 Discovery Date: 10/16/00 
 Origin: South America 
 Type: Virus  
 SubType: Internet Worm 
 Risk Assessment: Medium 
 

 che antivirus hanno per poterlo aggiornare ogni 2 giorni ???
Ad esempio l'Antiviral Toolkit Pro (AVP)... 
Saluti!
.sk.
ps.: non sai + quotare neppure tu? ;-D
-- 
Posted from 
mail.sai.it
 [151.99.225.71] 
via Mailgate.ORG Server - 
http://www.Mailgate.ORG

Ad esempio l'Antiviral Toolkit Pro (AVP)... 
Quello si aggiorna OGNI giorno..;-D

>[snip]
Sbaglio o sei OT?
............................................................................
Gian Maria Freddi <gm.f...@NOSPAMlibero.it>
N.B.: togliere NOSPAM dall'indirizzo di e-mail.
............................................................................
La guida ad un corretto uso dei newsgroup italiani,
dal punto di vista tecnico e comportamentale,
assolutamente necessaria per tutti i lettori dei gruppi italiani,
la trovate qui: 
http://bertola.eu.org/usenet/faq/news-it/FAQ.html


Sai a cosa serve Wikeyfun?
Ne hai mai sentito parlare su questo ng ?
Allora forse avvisare che chi lo usa rischia un virus non è molto ot,
visto il modo di agire del virus o no ?
Soprattutto visto che a me ne sono arrivate già almeno 4 copie
sicuramente da questo ng....
E comunque visto che uso un indirizzo email reale certe osservazioni
sarebbe il caso di farle con quel mezzo o nella tua sig quello non è
riportato ? Si chiama bandwidth waste....
EOF


Date:    Mon, 11 Dec 2000 10:19:06 PST
The original message is kept in:
  fire:/var/spool/qmailscan/quarantine
where the System Anti-Virus Administrator can further diagnose it.
The Email scanner reported the following when it scanned that message:
--- 
---uvscan results ---
Scanning /var/spool/qmailscan/fire9765590412331/*
Scanning file /var/spool/qmailscan/fire9765590412331/attachment1.dat
Scanning file /var/spool/qmailscan/fire9765590412331/NHLAMDNH.EXE
/var/spool/qmailscan/fire9765590412331/NHLAMDNH.EXE
        Found the W32/Hybris.gen@M virus !!!
___________________________________________________________________________
chissa' che non sia stato proprio il mio antivirus a fare scattare
presso di loro l'allarme...
Baci e Abbracci
Cristiano


EOF
Una ripassatina alla netiquette non ti farebbe male.



    Mmmmmmh... senza entrare nel merito del mini-flame... sei certo di aver
compreso il messaggio di RaV? Cioè, proprio letto bene, intendo?
pPoison