Newsgroup: italia.napoli.discussioni
Titolo: Virus . . .

Qualcuno conosce gli effetti e la corretta rimozione dei seguenti virus ?
- W95.Babylonia.exe
- W95.Babilonia(dat).exe
So che infetta tutti i .com
Col Norton ho messo in quarantena il primo.
Il secondo non riesce nè a correggerlo, nè a spostarlo in quarantena, nè ad
eliminarlo.
Consigli ???
A chi mi risolve il problema, Vinarte concederà una riduzione o un 1 + 1 per
entrare in discoteca.
Se non vi piace la disco, Angie vi farà assaggiare la sua...  ( e non
pensate come penso sempre io ... ) pizza salsiccia e friarielli...
E se manco quella vi piace, porterò al posto vostro Cristiana al teatro, ok
??? Così vi risparmio l'uscita, il traffico, il parcheggio, il costo dei
biglietti, l'IVA, l'UVA e le OVA.
Cmq
Per la cronaca il mio PiCCione è infetto . . .
Io quindi colleziono virus...
Ricordo ancora il primo, che emozione !
Happy99.exe Mi fece infettare mezzo mondo.
Dall'Italia ( isole comprese ) al Perù !
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°
         Non cercate di rendere nessuno come voi stessi
    - voi sapete, e Dio sa, che uno di voi è già abbastanza.
                            * Ralph Waldo Emerson *
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

 - W95.Babilonia(dat).exe
Dal sito Symantec:
http://www.symantec.com/avcenter/venc/data/w95.babylonia.html
W95.Babylonia
Detected as: W95.Babylonia
Infection Length: 11,036 bytes
Likelihood: Common
Detected on: Dec 7, 1999
Region Reported: Europe, US, Asia-Pacific
Characteristics: MIRC, Y2K, Internet, Windows Help file
Description
W95.Babylonia was originally posted to an Internet news group on the night
of Dec 3, 1999 as a Windows Help file named serialz.hlp and appeared to be a
list of serial numbers for commercial software. When this Windows help file
is launched, it will introduce the virus into the computer system. Symantec
AntiVirus Research Center has received over 20 submissions of this new virus
as of Dec 6 and believes it is spreading quickly worldwide. The virus
appears to have been written by the same individual who released the
W32.Coke and W95.Fono (a.k.a. El_Inca) viruses.
W95.Babylonia is a complex virus that propagates mainly to other computer
users via MIRC or as regular attachment in an e-mail message. Additionally,
all infected .HLP and .EXE files can cause infection on other systems. This
Windows 95 virus employs many proven infection techniques that have been
developed by virus writers for the Windows 9x platforms over the past few
years.
Opening a help (.HLP) file
When an infected .HLP file is introduced on a Windows 9x system, the virus
code will be activated. The virus modifies the entry point of .HLP files to
a short script routine. This routine transfers control from the script
interpretation to the binary virus code that is placed at the end of .HLP
files in variable packed form.
When the binary virus code assumes control, the virus attempts to install
itself to kernel memory area on the machine and hooks the file system to its
own code. The virus then creates a 4KB file named c:\babylonia.exe. Finally,
this file is executed.
Execution of babylonia.exe
When babylonia.exe gets control, it copies itself to the Windows system
directory as KERNEL32.EXE and registers this copy in the registry at:
Software\Microsoft\Windows\CurrentVersion\Run.
As a result, this copy will be executed at each system start.
This module is registered as a system service and as a result it cannot be
seen on the Windows 9x task list. The trojan checks if the RNAAPP.EXE
application is running by enumerating the active processes. If it does not
find a similar process, it will sleep for some time and try it again a
later.
RNAAPP.EXE is active on Windows 9x machines during dial-up connections. When
the application is loaded, the virus attempts to connect to a virus writer's
website in Japan.
First, the trojan downloads a text file named virus.txt. This text file
lists a few file names (currently 4). The file names are: dropper.dat,
greetz.dat, ircworm.dat and poll.dat. They appear to use a special file
format with a header that begins with 'VMOD'. This stands for "Virus
Module". The header of the virus modules contains an entry point for the
module. The trojan then downloads the files and executes them inside its own
process, one by one.
This way the trojan can introduce additional functionality on the already
infected system. If the system is disinfected but the trojan is active, the
virus code will be introduced on the machine again since the dropper virus
module will create a 17KB application (INSTALAR.EXE) and execute it. This
file is infected with the virus. Finally the file is deleted.
The greetz.dat module modifies the c:\autoexec.bat file in January. Part of
the "marker" for this virus includes the following text in the
c:\autoexec.bat file:
W95/Babylonia by Vecna (c) 1999
The ircworm.dat appears to be an MIRC worm installer. The worm seems to
propagate two files: 2kBug-MircFix.EXE and 2kbugfix.ini to everyone on the
active MIRC channel.
The last module in virus.txt sends messages to
babyloni...@hotmail.com
with a message
Quando o mestre chegara?
This information was intended by the virus writer to track the number of
infections that W95.Babylonia causes.
Infected .EXE and .HLP files
W95.Babylonia hooks the file system to itself and checks for .EXE and .HLP
file extensions. It infects such files whenever they are accessed. Infected
Windows .HLP files and 32-bit PE .EXE files can introduce the full
functionality of the virus to new systems.
The virus uses an inserting technique (does not modify the entry point of PE
files) when it infects them, probably in an attempt to avoid detection from
heuristic analyzers that could catch the virus more easily. The virus body
is attached to the end of the infected files.
As long as the virus is in memory the virus cannot be easily removed from
the system. This infection mechanism is very similar to the W95.CIH virus.
WSOCK32.DLL Modifications
Another very important detail of the virus infection is that W95.Babylonia
will be able to modify WSOCK32.DLL when the file is not loaded in memory.
The virus adds a very short hook routine to the "Send" API of WSOCK32.DLL
similarly to the Happy99 worm (aka W32.SKA.A). This short hook routine
transfers control to the active part of the virus code when an e-mail is
sent. The end result of this code is that the virus adds a MIME-encoded
attachment of itself to all outgoing e-mail, thus increasing its rate of
spread. W95.Babylonia is technically a worm, as well as a virus.
The possible file names of the e-mail attachment are:
I-WATCH-U.EXE
BABILONIA.EXE
X-MAS.EXE
SURPRISE!.EXE
JESUS.EXE
BUHH.EXE
CHOCOLATE.EXE
It seems the virus has a bug in this routine and therefore only the
X-MAS.EXE file name will be used. This file appears to be the same as the
INSTALAR.EXE that is created by one of the virus modules that has a Santa
Claus icon.
--
Rosario Manzo
http://space.tin.it/io/rosamanz

Grazie 1.000
Non ci ho capito molto ma doveva essere interessante !
...scherzo... GRAZIE !
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::   Non giudicate una persona da quello che dice:   ::
::       cercate di scoprire perchè l'ha detto.          ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

 ...scherzo... GRAZIE !
Figurati.
