Newsgroup: it.comp.aiuto
Titolo: Cerco aiuto per virus babylonia.exe

Ho questo problema: da qualche parte ho beccato un virus che mi crea, ad ogni
accensione del pc, il file babylonia.exe che, a quanto pare, viene richiamato da
ogni programma che viene lanciato.
I pochi antivirus (un po' vecchi a dire il vero) che possiedo non mi vedono il
virus ma ad una banale ricerca con il find (opzione "testo contenuto":
babylonia) mi vengono rilevati tantissimi exe!
Come faccio a ripulire il tutto senza dover riformattare l'hdisk?
Perdonatemi se l'argomento è OT o se è già stato discusso da tempo: non ho mai
frequentato il ng!
Per favore contattatemi in email 
run...@usa.net
 

Come faccio a ripulire il tutto senza dover riformattare l'hdisk?
Aggiorna l'antivirus.
-- 
Ciao
Pippo Peppo  
a...@gmx.ch
ICQ#56544103

>Aggiorna l'antivirus.
Ok ma che tu/voi sappiate quali operazioni mi conviene fare per partire con il
pc pulito?
Ho paura infatti che mi abbia infettato anche il "motore" antivirus ... 
Avevo provato a cancellare tutta la dir di win98 ma č stato inutile.
Grazie.
Feld


Allora, quel bastardo di Babyonia, ti infetta tutti gli eseguibili che
trova, quindi anche l'antivirus sarà infettato. Aggiornarlo non
servirà a niente visto che il motore di scansione non partirà.
Quindi fai come ti dico:
- con un computer sano crea un disco di avvio (magari lo hai già fatto
con il computer infetto prima che fosse infetto);
- metti su disco un antivirus (F-Prot, oppure basta che tu abbia un cd
con sopra Norton o McAfee che vadano da Dos, quindi una copia sana);
- dopo aver fatto il boot (se l'antivirus risiede su cd nel disco di
boot devono esserci i driver del cdrom) installa l'antivirus;
- pulisci tutti i file (forse non potrai pulirli e li dovrai
eliminare);
- reinstalla Windows e tutti i programmi.
Consiglio personale: 
- anzichè far tutto sto casino, formatta tutto dopo aver avviato con
un disco pulito, e reinstalla tutto da zero.
Ciao, Bartman
--
ø*°`°*ø,¸_¸,ø*°`°*ø,¸_¸,=>>> Marco (Bartman) <<<=,¸_¸,ø*°`°*ø,¸_¸,ø*°`°*ø
e-mail: 
mbel...@tiscalinet.it
 
mbel...@hotmail.com
ICQ: 30.55.35.99      nick: Bartman
HomePage: 
http://utenti.tripod.it/marcobartman/index.htm

 Per favore contattatemi in email 
run...@usa.net
Ecco quanto riportato dal sito Symantrc:
http://www.symantec.com/avcenter/venc/data/w95.babylonia.htm
                     W95.Babylonia
                          Detected as:
                                     W95.Babylonia
                      Infection Length:
                                     11,036 bytes
                           Likelihood:
                                     Common
                          Detected on:
                                     Dec 7, 1999
                     Region Reported:
                                     Europe, US, Asia-Pacific
                       Characteristics:
                                     MIRC, Y2K, Internet, Windows Help file
                     Norton AntiVirus users can protect themselves from this virus
by downloading
                     the current virus definitions either through LiveUpdate or from
the Download
                     Virus Definition Updates page.
                     Description
                     W95.Babylonia was originally posted to an Internet news group
on the night
                     of Dec 3, 1999 as a Windows Help file named serialz.hlp and
appeared to
                     be a list of serial numbers for commercial software. When this
Windows help
                     file is launched, it will introduce the virus into the computer
system. Symantec
                     AntiVirus Research Center has received over 20 submissions of
this new virus
                     as of Dec 6 and believes it is spreading quickly worldwide. The
virus appears
                     to have been written by the same individual who released the
W32.Coke and
                     W95.Fono (a.k.a. El_Inca) viruses.
                     W95.Babylonia is a complex virus that propagates mainly to
other computer
                     users via MIRC or as regular attachment in an e-mail message.
Additionally,
                     all infected .HLP and .EXE files can cause infection on other
systems. This
                     Windows 95 virus employs many proven infection techniques that
have been
                     developed by virus writers for the Windows 9x platforms over
the past few
                     years.
                     Opening a help (.HLP) file
                     When an infected .HLP file is introduced on a Windows 9x
system, the virus
                     code will be activated. The virus modifies the entry point of
.HLP files to a
                     short script routine. This routine transfers control from the
script interpretation
                     to the binary virus code that is placed at the end of .HLP
files in variable
                     packed form.
                     When the binary virus code assumes control, the virus attempts
to install itself
                     to kernel memory area on the machine and hooks the file system
to its own
                     code. The virus then creates a 4KB file named c:\babylonia.exe.
Finally, this
                     file is executed.
                     Execution of babylonia.exe
                     When babylonia.exe gets control, it copies itself to the
Windows system
                     directory as KERNEL32.EXE and registers this copy in the
registry at:
                          Software\Microsoft\Windows\CurrentVersion\Run.
                     As a result, this copy will be executed at each system start.
                     This module is registered as a system service and as a result
it cannot be seen
                     on the Windows 9x task list. The trojan checks if the
RNAAPP.EXE
                     application is running by enumerating the active processes. If
it does not find a
                     similar process, it will sleep for some time and try it again a
later.
                     RNAAPP.EXE is active on Windows 9x machines during dial-up
connections.
                     When the application is loaded, the virus attempts to connect
to a virus
                     writer's website in Japan.
                     First, the trojan downloads a text file named virus.txt. This
text file lists a few
                     file names (currently 4). The file names are: dropper.dat,
greetz.dat,
                     ircworm.dat and poll.dat. They appear to use a special file
format with a
                     header that begins with 'VMOD'. This stands for "Virus Module".
The header
                     of the virus modules contains an entry point for the module.
The trojan then
                     downloads the files and executes them inside its own process,
one by one.
                     This way the trojan can introduce additional functionality on
the already
                     infected system. If the system is disinfected but the trojan is
active, the virus
                     code will be introduced on the machine again since the dropper
virus module
                     will create a 17KB application (INSTALAR.EXE) and execute it.
This file is
                     infected with the virus. Finally the file is deleted.
                     The greetz.dat module modifies the c:\autoexec.bat file in
January. Part of the
                     "marker" for this virus includes the following text in the
c:\autoexec.bat file:
                          W95/Babylonia by Vecna (c) 1999
                     The ircworm.dat appears to be an MIRC worm installer. The worm
seems to
                     propagate two files: 2kBug-MircFix.EXE and 2kbugfix.ini to
everyone on
                     the active MIRC channel.
                     The last module in virus.txt sends messages to
 
babyloni...@hotmail.com
                     with a message
                          Quando o mestre chegara?
                     This information was intended by the virus writer to track the
number of
                     infections that W95.Babylonia causes.
                     Infected .EXE and .HLP files
                     W95.Babylonia hooks the file system to itself and checks for
.EXE and .HLP
                     file extensions. It infects such files whenever they are
accessed. Infected
                     Windows .HLP files and 32-bit PE .EXE files can introduce the
full
                     functionality of the virus to new systems.
                     The virus uses an inserting technique (does not modify the
entry point of PE
                     files) when it infects them, probably in an attempt to avoid
detection from
                     heuristic analyzers that could catch the virus more easily. The
virus body is
                     attached to the end of the infected files.
                     As long as the virus is in memory the virus cannot be easily
removed from the
                     system. This infection mechanism is very similar to the W95.CIH
virus.
                     WSOCK32.DLL Modifications
                     Another very important detail of the virus infection is that
W95.Babylonia will
                     be able to modify WSOCK32.DLL when the file is not loaded in
memory. The
                     virus adds a very short hook routine to the "Send" API of
WSOCK32.DLL
                     similarly to the Happy99 worm (aka W32.SKA.A). This short hook
routine
                     transfers control to the active part of the virus code when an
e-mail is sent.
                     The end result of this code is that the virus adds a
MIME-encoded attachment
                     of itself to all outgoing e-mail, thus increasing its rate of
spread.
                     W95.Babylonia is technically a worm, as well as a virus.
                     The possible file names of the e-mail attachment are:
                          I-WATCH-U.EXE
                          BABILONIA.EXE
                          X-MAS.EXE
                          SURPRISE!.EXE
                          JESUS.EXE
                          BUHH.EXE
                          CHOCOLATE.EXE
                     It seems the virus has a bug in this routine and therefore only
the X-MAS.EXE
                     file name will be used. This file appears to be the same as the
INSTALAR.EXE
                     that is created by one of the virus modules that has a Santa
Claus icon:
Informazione personale per la rimozione:
-Scarica dal sito AVP
AVP 3.0 for DOS
 AVP - Antiviral Toolkit Pro by Eugene V. Kaspersky is an advanced integrated
anti-virus application package. AVP
 belongs to the top group of AV applications available today. It's state-of-the-art
scanning technology allows it to deal
 with the most complex known polymorphic viruses, and thanks to it's unpacking and
extracting engines, AVP does not
 stop from tracking down viruses even in packed and archived files.
Indirizzo:  
http://www.avp.ch/E/avpdos30.htm.
.. La versione per DOS dell'ultimo
antivirus é distribuita in un archivio ZIP
al sito 
http://www.avp.ch/E/dldos.htm
 in formato ZIP
...questo deve essere scompattato da DOS utilizzando PKUNZIP (anch'esso sicuramente
non infetto...!) ...quindi fattelo prestare da un amico possibilmente
o controlla la data e le dimensioni del file ...altrimenti scaricalo anchesso da
Tucows...
-Riparti da un dischetto di Boot *sicuramente* non infetto!!!! cioe' NON creato
dallo stesso computer nel  periodo in cui é stato infettato...!!
-Al  prompt del DOS digita:
-Fdisk /mbr
-Sys C:
-Togli il floppy
-Riavvia il computer
--Una volta scompattato in una directory temporanea ...tipo c:\temp ...procedi alla
sua installazione l'antivirus per DOS ...
-Quindi procedi alla disinfezione...
Int: Fai passare 2 volte l'antivirus ...riavviando
Auguri..:)))
Walter

-Quindi procedi alla disinfezione...
Ringrazio con questa mail tutti coloro che mi son venuti in aiuto.
Riepilogo brevissimamente come me ne son liberato. 
Premetto che ero disposto a tutto pur di non dover essere costretto a formattare
l'hd avendo su questo un mucchio di dati e programmi utili e difficilmente
reperibili. Purtroppo non ho potuto approfittare di antivirus di amici poichè
nessuno li aveva aggiornati o aggiornabili.
Mi sono collegato al sito della McaFee e mi sono iscritto come trial alla Clinic
Antivirus Online tramite la quale ho potuto scoprire con esattezza quali erano i
programmi infettati sul mio pc. (Non mi sono preoccupato di Win avendo
intenzione di rasare completamente tale directory).
Notate che l'antivirus citato (e a quanto mi risulta nessun altro av esistente
dieci giorni fa) non era in grado di fare il clean! - solo detect!
Ho cancellato i programmi infettati e la directory windows.
Ho reistallato win98 e finalmente il virus Babylonia era sparito.
Fine dei guai e delle imprecazioni che hanno fatto da colonna sonora alle
operazioni sopra citate! ;-)
Saluti.
Feld