Newsgroup: it.comp.console.playstation
Titolo: [OT]638...

...sono i messaggi di e-mail che ho appena ricevuto.Tutti da Mail Delivery
Service o Mail Delivery System con oggetto delivery status notification.E'
successo anche a qualcuno di voi?Che fo?
Grazie

 Grazie
Hai un buon antivirus?
Te lo dico perche' qualche tempo fa mi era arrivata anche a me una lettera
cosi' solo che l'allegato invece di avere il testo della mail non inviata
aveva un buon virussozzo....
Hai controllato?
-- 
questo articolo e` stato inviato via web dal servizio gratuito 
http://www.newsland.it/news
 segnala gli abusi ad 
ab...@newsland.it

purtroppo
"Transponder" <trans...@TOGLIMItin.it> ha scritto nel messaggio
news:9bCab.84897$hE5.3...@news1.tin.it...


purtroppo
"Transponder" <trans...@TOGLIMItin.it> ha scritto nel messaggio
news:9bCab.84897$hE5.3...@news1.tin.it...


 ha scritto nel messaggio
news:bker67$9bs$1...@news.newsland.it...


purtroppo
"Transponder" <trans...@TOGLIMItin.it> ha scritto nel messaggio
news:9bCab.84897$hE5.3...@news1.tin.it...


 ha scritto nel messaggio
news:bker67$9bs$1...@news.newsland.it...


 ha scritto nel messaggio
news:kkCab.2026$wT2....@tornado.fastwebnet.it...


 cazzo, credo di avere un viru
controlla dove ti ho consigliato:



Ti ringrazio per i siti indicati.Ora sono su pandasoftware e sto facendo uno
scanning del sistema...speriamo bene(nel frattempo mi sono arrivate altre 70
mail uguali alle precedenti).
Grazie ancora

 sono arrivate altre 70 mail uguali alle precedenti).
Da un ng:
Piccola guida:
Win32.Swen.a
===========================
Virus/Vandal name: Win32.Swen.a
Threat Level:      Medium
Alias:             Swen, I-Worm.Swen, W32/Swen.A@mm, W32/Gibe.E@MM, Gibe.E
Platforms:         Win 95,Win 98,Win ME,Win NT,Win 2K,Win XP
Updated on:        September 18, 2003
Arrival Form:      Email,Network Shares,IRC,P2P
Type:              Win32,Worm,Trojan
Damage:            Create files,Prevent normal OS operation,Send
Email,Send Message,Theft of information,Other
Analysis
-------------
Introduction
---------------------
Win32.Swen.a is a mass-mailing worm which employs multiple propagation
methods to spread. The worm may appear to be a legitimate message from
Microsoft. All users must note that Microsoft will never send updates and
paths via email.
The worm attempts to open itself automatically when received via email by
using the I-Frame exploit. eSafe Gateway and eSafe Mail customers are
proactively protected from this exploit and therefore the worm will not be
able to self-execute on protected machines.
The arriving email will have the following characteristics:
Sender: The forged sender's address is composed of several random strings.
The random address is composed as follows:
User...@domain.domain-suffix.com
 or .net
Possible Usernames:
Assistance
Bulletin
Center
Corporation
Customer
Department
Division
Internet
Microsoft
MS
Network
Program
Public
Section
Security
Services
Support
Technical
Possible Domain Names:
advisor
bulletin
confidence
news
newsletters
support
technet
updates
Possible Domain Suffixes:
microsoft
ms
msdn
msn
Subject: The subject of this mail will usually be composed from a
pre-generated list of words. There may be thousands of different
variations.
Message body: The message body contains information that may appear
legitimate. It claims to include a cumulative patch for Internet Explorer,
Outlook and Outlook express. The exact message is also constructed from
various lines of text and may appear different for each recipients.
Attached File: The attached filename will be an executable (.EXE). The
name itself will be composed of one of the following text strings and end
with a randomly generated number:
install
patch
q
update
Malicious Activity
---------------------
When the worm is executed it does the following:
1. The worm attempts to disable various processes related to security
applications. This may help the worm thrive on a system if it was not
already protected.
2. The worm searches the registry to check if the computer is already
infected. If it doesn't find the relevant entry it creates one. This
action also ensures the worm is executed whenever the computer is
restarted. The registry entry is as follows:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
'[random string]' = '[random string].exe /autorun'
3. If the computer is already infected by the worm, it will display the
following message:
Subject: Microsoft Internet Update Pack
Message: This update does not need to be installed on this system.
If the computer is not yet infected, the worm will display the following
message, with Yes and No buttons:
Subject: Microsoft Internet Update Pack
Message: This will install Microsoft Security Update. Do you wish to
continue?
The infection will commence regardless of the user's selection. If the
'No' button is pressed, the worm will install itself in the background
with no user interaction.
When a user authorized installation is complete the worm will notify the
user accordingly.
4. Copies itself to the default Windows directory as an executable file
with a random filename.
5. Creates the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\[ran
domly generated 4 character string]
'CacheBox Outfit' = 'yes'
'Install Item' = '<random string>'
'Installed' = '...by Begbie'
'Mirc Install Folder' = '<location of installed mIRC client>'
'Unfile' = '<random string>'
'ZipName' = '<random string>'
6. Modifies the following registry keys so that they correspond with its
main executable file:
HKEY_LOCAL_MACHINE\CLASSES\exefile\shell\open\command
HKEY_LOCAL_MACHINE\CLASSES\regfile\shell\open\command
HKEY_LOCAL_MACHINE\CLASSES\scrfile\shell\open\command
HKEY_LOCAL_MACHINE\CLASSES\comfile\shell\open\command
HKEY_LOCAL_MACHINE\CLASSES\batfile\shell\open\command
HKEY_LOCAL_MACHINE\CLASSES\piffile\shell\open\command
This allows the worm to run whenever .exe, .reg, .scr, .com, .bat or .pif
files are executed.
7. So that users will not be able to access the worms registry
modifications, it also creates the following entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Syste
m
'DisableRegistryTools' = '1'
8. Occasionally, the worm may present a forged MAPI Exception error which
will prompt the user to enter all mail details, confidential (password) or
otherwise.
9. When certain executables the worm does not agree with are opened, the
worm will display the following error message and the close the
application:
Exception error occured:
Memory access violation in module kernel32 at < random
number:random_number >
10. To spread via KaZaA, the worm creates a folder and shares it with
other users. It then drops several copies of itself to that folder with
various filenames and with a .zip or .exe extensions.
11. To spread via mIRC, the worm attempts to open a client (if it exists
on the infected computer), connect to channels and send itself to all
users connected to those channels.
12. To spread via network shares, the worm attempts to copy itself to all
startup folders on shared drives it can find.
13. The worm also attempts to spread via newsgroup channels, but only if
the machine's user uses this service. The worm will only send itself to
those newsgroups accessed by the user.
14. Finally, the worm attempts to send itself to all contacts harvested
from various locations on the infected system. All messages attempt to use
the I-Frame exploit in order to be automatically executed when the message
is opened or previewed.
--
Ciao :o)
Raziel
ICQ: a richiesta

ANCHE A ME SONO ARRIVATI!!!

 
http://www.pandasoftware.com/activescan/
No, Cristo, anche a me adesso sono arrivate le email.
Porca di quella...
-- 
   |\/\/\/|  Convolvulaceo, alias Convulvaceo, alias Conovulcaneo,
   |      |  alias Convulaccio, alias Convalvolaceo, alias Convulvaceleo,
   |      |  alias il cognato del volatile vulaceo (thanks to fizio)
   | (o)(o)  alias Conoviolaceo, alias Conanvulcaneo
  C      _)  Si accettano new entry
   | ,___|   ICQ: 338305510
   |   /     C6: Convolvulaceo 		
  /____\     Alternative C6: 19NiceGuy85
/      \    Mailto: 
Il_Mio_Nick_...@tin.it
 

 ha scritto nel messaggio
news:sFCab.85090$hE5.3...@news1.tin.it...



anche a me ha risolto il problema quindi mi sentirei di consigliarlo a
quelli a cui sono arrivate le dannatissime email.

 successo anche a qualcuno di voi?Che fo?
Io avevo circa 5-6 mega di quella merda schifosa
Sono andato su libero e l'ho cancellata da lě senza usare outlook
56k rulez

ANCHE A ME SONO ARRIVATI!!!
Io per ora sembro salvo...
Ammazza c'e' stata una mega epidemia..
E mettetelo sto bel antivirus dai ^_______^...che dopo la ML se uno di
noi sternutisce ci ammaliamo tutti quanti ^_^;
--
-------------------------------
Mor...@libero.it
Cherottu...@email.it
ICQ# 83275450
-------------------------------

Io per ora sembro salvo...
Prima di vedere la mail su 
email.it
 (-_-)....94 nuove mail
10 di Spam...il resto indovinate un po'?....


 
http://www.pandasoftware.com/activescan/
Per ora 227 file infetti
Mica male


CANCELLA TUTTO !!!
potrebbero essere virus, anzi di certo lo sono !