Newsgroup: it.lavoro.professioni.webmaster
Titolo: Attenzione: nuovo virus

Casualmente stamattina ho ricevuto un virus non individuato da nessun
sistema antivurus installato ed ho inviato tutto a 
webimmune.net
 per il
test:
      Analysis ID: 109877
      Scan Status: scan complete
      Scan Findings: Virus variant detected!
      Virus Name: New Script
      Engine used for detection: 4.1.40
      File Name: defcon.doc .vbs
      The WebImmune Heuristic Analyzer has detected what may be a variant of
a known virus. This submission is being forwarded to an AVERT Researcher for
confirmation. You will be contacted by AVERT via e-mail with the final
results and an EXTRA.DAT will be provided if one is necessary.
      Thank you for using WebImmune by McAfee AVERT
Il file arriva via e-mail con un messaggio proveniente (vogliono far
credere) da 
CNN.COM
  con oggetto: "Release the Russian, Adobe Says " e con
il seguente testo:
"WASHINGTON -- In a stunning turn of events, Adobe abruptly bowed to public
outcry and recommended the release of a Russian programmer who was arrested
for writing code-breaking software.
Late Monday, Adobe officials said they had changed their minds and no longer
believed that Dmitry Sklyarov should be prosecuted for alleged copyright
infringement.
"We strongly support (federal copyright law) and the enforcement of
copyright protection of digital content," Colleen Pouliot, general counsel
for Adobe, said in a statement. "However, the prosecution of this individual
in this particular case is not conducive to the best interests of any of the
parties involved or the industry."
Adobe's announcement came as hundreds of geeks-turned-activists protested
Sklyarov's arrest in at least 10 cities, with about 100 marchers descending
on the company's San Jose headquarters, and representatives of the
Electronic Frontier Foundation met with Adobe officials to try and broker a
deal.
See defcon.doc attchment for more information.
Best wishes,
Cnn news.
www.cnn.com
"
Logicamente, il file allegato non è un doc ma un VBS. Aprendo il VBS, con un
editor di testo, si vede il "solito" codice di autospedizione via e-mail.
Al suo interno, si trovano altri corpi ed oggetti di messaggi:
es:
Oggetto: "New Generation of drivers"
Testo: Microsoft has published new driver for all types Video Cards,
compatible with Windows 95/98/NT/2000/XP
Allegato: "driver.doc                                              .vbs"
Crea poi un utente: "net user Lord_Nikon password /add" e lo aggiunge al
gruppo degli amministratori "net localgroup Administratotrs Lord_Nikon /add"
Praticamente "buca" NT/2000 creando un utente tutto suo, in modo da potersi
collegare alla macchina.....
Spero possa essere utile, sino a pubblicazione di aggiornamento degli
antivirus.....
--
Roberto Scano - 
rsc...@iwa-italy.org
--------------------------------------------------------------------
Presidente Italiano Associazione IWA ITALIA
International Webmasters Association Italia
www.iwa-italy.org
--------------------------------------------------------------------
Coordinatore Italiano IWA
International Webmasters Association
International HeadQuartier
http://www.iwanet.org

McaFee ha fatto l'analisi a tempo di record:
http://vil.nai.com/vil/dispVirus.asp?virus_k=99147