Newsgroup: it.comp.retrocomputing
Titolo: Microsoft...........acc!

 
http://www.f-secure.com/v-descs/qaz.htm
ESTRATTO SOTTO RIPORTATO.........
F-Secure Virus Descriptions
 
NAME: Qaz 
ALIAS: Worm.Qaz, Worm_Qaz 
This is network worm with backdoor capabilities, which spreads itself
under Win32 systems. The worm was reported in-the-wild in July-August,
2000. The worm itself is Win32 executable file and about 120K long,
written in MS Visual C++. 
When an infected file is executed, the worm registers itself in
Windows registry in auto-start section: 
 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  startIE = "filename qazwsx.hsq"
where "filename" is the name of worm's file (usually this is
"Notepad.exe", see below). As a result, the worm will be activated
each time Windows starts up. 
The worm then stays in the system memory as an application (visible in
the task list) and runs two processes: its spreading process and
backdoor process. 
The spreading process spreads the worm copy through the local network
to drives that are shared for reading/writing. The worm enumerates
network resources and looks for "WIN" string in their names. If such a
string is found from the name (i.e. Windows directory on a remote
computer), the worm looks for NOTEPAD.EXE in there, renames it with a
new name 
NOTE.COM
 and writes its copy with the name NOTEPAD.EXE. 
As a result the original NOTEPAD.EXE can be found with 
NOTE.COM
 name
on the affected computer (it is used by the worm to run original
Notepad when the worm completes its routines), and the worm code is
present in NOTEPAD.EXE file. The worm will be activated when a user
runs Notepad on the affected machine. 
The backdoor routine is quite simple. It supports just a few commands:
Run (to run specified file), Upload (to create a file on affected
machine) and Quit (terminate the worm routines). There are just three
commands, but that is enough to install any other (more powerful)
trojan/virus to the computer. 
The worm also sends a notification to its "host" (worm's author?).
This e-mail message is sent to some address in China. The message
contains the IP address(es) of infected machine. 
Before disinfection with FSAV, please download and run the special REG
file that will remove worm's registry entry from the system: 
ftp://ftp.europe.F-Secure.com/anti-virus/tools/qazdisin.reg
 
Then restart the system and perform disinfection from either DOS or
Windows. Finally, rename 
NOTE.COM
 file back to NOTEPAD.EXE to have
Notepad available again. 
Here's how the worm looks 'from the inside': 
(.....andatevi a vedre il link!)
 
[Kaspersky Labs, F-Secure Corp.; October 2000]  
 ciao,fabio
 

 ESTRATTO SOTTO RIPORTATO.........
Me lo sono beccato.
Ringrazio chi me l'ha mandato e allerto chi ha ricevuto documenti da me.
CONTROLLATE!!
Scusatemi.
Ciao        8-)

NO COMMENT...
Sabino
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-----------------------------------------------------------------
   ZDNET ANNOUNCEMENT         10/30/2000
-----------------------------------------------------------------
************SPECIAL ADVERTISER ANNOUNCEMENT************
"Microsoft told The Wall Street Journal that rogue hackers had
used e-mail to gain entry into Microsoft's corporate network
with a Trojan program, possibly QAZ.trojan."
     ZDNet - October 27, 2000
The QAZ Trojan has been curable by most anti-virus software
products for 3 months.  How could the world's largest software
company fall victim to this known problem?
Because anti-virus software is only as good as the last time it
was updated, and updating it can be a complex and time-consuming
task.
...
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Windows registry in auto-start section:
Scusate, non per fare quello che rigira il coltello nella piaga, ma...
...quando vi arriva un eseguibile in allegato, che fate, cliccate senza
pieta'?
Fabrizio (mica per criticare nessuno, eh?)

 pieta'?
Cancello direttamente il messaggio, non si accettano eseguibili :))
Ciao.Alberto.

 pieta'?
Boh, io ci provo, ma proprio non riesco a installare 'sti virus sul
VAX.
	tentatamente,
	    Cthulhu
-- 
       Ph'nglui mglw'nafh Cthulhu 
http://www.rlyeh.it
 wgah'nagl fhtgan!
		        <cthulhu at rlyeh dot it>

pieta'?
Certo che si'. Casomai ci si nascondesse un virus/trojan/worm/ecc.,
cosi' a forza di martellate lo faccio fuori. Se invece e' un bel 
programmino che mi aiuta a gestire la posta elettronica spedendo
automaticamente messaggi, oppure uno che mi ripulisce per bene
l'hd, o ancora uno che mi fa il backup delle password, magari su
un sito cinese, ben vengano! ^______^
-- 
ciriciao from kirone
... e Blue Ribbons a tutti
e-mail adddress modificato: togliere il primo punto

pieta'?
Io sempre! Con l'Amiga mai avuto problemi! Ormai ci hanno abbandonato anche i
virus.......:)
Ciao!
Cossu Enrico-CPU at work:68000/20/30/40/60-"E quando mia moglie si intromise
per impedirmi di fare il mio dovere.....punii anche lei."

 virus.......:)
Un computer che più invecchia, più è sano :-)
Ciao!
        Daniele Gratteri (
dan.i...@ciaoweb.it
 - ICQ N° 53943994)
                           CBM & AMIGA FOREVER!

virus.......:)
Non succedono piu' cose meravigliose al tuo Amiga?
Fabrizio (i tempi in cui si sorrideva quando se ne parlava...)

Fabrizio (i tempi in cui si sorrideva quando se ne parlava...)
Mi hai incuriosito.....


Mi hai incuriosito.....
Erano i primi tempi... quasi faceva sorridere (e senza dubbio, si
rideva guardando la faccia esterrefatta dell'infettato).
Fabrizio