Newsgroup: italia.napoli.discussioni
Titolo: ...e magari se mi dite cosa c'è scritto . . .

...perchè è questo il virus che ho . . .
Virus Alerts
Virus Information
Discovery Date:  03/12/2001
Origin:  Europe
Length:  Varies, adds at least 24 Kb
Type:  Virus
SubType:  worm
Minimum Dat:  4128
Minimum Engine:  4.1.00
DAT Release Date:  03/14/2001
Description Added:  03/13/2001
Update May 30, 2001:
AVERT has observed a steady increase in the prevalence of this virus over
the last week amongst end users. End users are advised to update their DAT
files immediately to protect themselves from this threat.
W32/Magistr@MM is a combination of a files infector virus and e-mail worm.
-The viral code infects 32 bit PE type files (.exe) files in the WINDOWS
directory and subdirectories.
-The worm part is using mass mailing techniques to send itself to email
addresses stored in several places. The worm installs itself to run at each
system startup.
Five minutes after the virus is run, it attempts a mailing routine. Email
addresses are gathered from the Windows Address Book, Outlook Express
mailboxes, and Netscape mailboxes (address found in the email messages
within existing mailboxes are gathered), and these file locations and
addresses are saved to a hidden .DAT file somewhere on the hard disk
(varies). The messages sent by the worm contain varying subject headings,
body text, and attachments. The body of the message is derived from the
contents of other files on the victim's computer. It may send more than one
attachment and may include non .EXE or non-viral files along with an
infectious .EXE file.
The virus proceeds by infecting 32 bit PE (Portable Executable) type .EXE
files found in the WINDOWS SYSTEM directory and subdirectories. The viral
code is encrypted, polymorphic, and uses anti-debugging techniques to make
it difficult detected. Email addresses have been seen encrypted in infected
files. These addresses are believed to represent other users that have also
been infected from the same point of origin.
In the decrypted body of the virus code, the following comments exist:
ARF! ARF! I GOT YOU! v1rus: Judges Disemboweler.
by: The Judges Disemboweler.
written in Malmo (Sweden)
W32/Magistr@MM has a payload routine that on some systems may result in
cmos/bios info being erased as well as destroying sectors on the hard disk.
Symptoms
- Increase in size in .EXE files (adds 24Kb or more)
- Infected files use a modified access date of the time of the infection
- Presence of a newly created .DAT file containing email addresses
(representing those users which were sent the virus)
-Entry in WIN.INI RUN=(App)
-Entry in Registry, run key value:
HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\AppName (varies)=C:\WINDOWS\SYSTEM\(App).EXE (varies)
Method Of Infection
This worm which arrives as an .EXE file with varying filenames. Executing
this attachment infects your machine which is used to propagate the virus.
When first run, the virus may copy one .EXE file in the WINDOWS or WINDOWS
SYSTEM directory using the same name with an altered last character.
For example, CFGWIZ32.EXE becomes CFGWIZ31.EXE, PSTORES.EXE becomes
PSTORER.EXE, etc.
(this naming convention seems to be consistent where the last character of
the filename is decreased by a factor of 1)
This copy is then infected and a WIN.INI entry, or a registry run key value
may be created, to execute this infected file upon system startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
CFGWIZ31=C:\WINDOWS\SYSTEM\CFGWZ31.EXE
This copied executable infects other PE .EXE files in the SYSTEM directory
and subdirectories, when run. It also infects over open network shares.
This virus will create a .DAT file on the local file system which contains
strings of the files used to grab email address from (.dbx, .mbx, .wab), and
also strings of email addresses which will be used as a target list. The
.DAT file will be named after the machine name, but in an offset method. For
instance, here is a corresponding list of letter equivalents used:
original letter           corresponds to
     a             ->           y
     b             ->           x
     c             ->           w
     d             ->           v
     e             ->           u
     f             ->           t
     g             ->           s
     h             ->           r
     i             ->           q
     j             ->           p
     k             ->           o
     l             ->           n
     m             ->           m
     n             ->           l
     o             ->           k
     p             ->           j
     q             ->           i
     r             ->           h
     s             ->           g
     t             ->           f
     u             ->           e
     v             ->           d
     w             ->           c
     x             ->           b
     y             ->           a
     z             ->           z
Numbers are not affected. So a machine name of ABC-123 would have a .DAT
file on the local system named YXW-123.DAT.
Removal Instructions
Use specified engine and DAT files for detection and removal.
Windows ME Info:
NOTE: Windows ME utilizes a backup utility that backs up selected files
automatically to the C:\_Restore folder. This means that an infected file
could be stored there as a backup file, and VirusScan will be unable to
delete these files. These instructions explain how to remove the infected
files from the C:\_Restore folder.
Disabling the Restore Utility
1. Right click the My Computer icon on the Desktop.
2. Click on the Performance Tab.
3. Click on the File System button.
4. Click on the Troubleshooting Tab.
5. Put a check mark next to "Disable System Restore".
6. Click the Apply button.
7. Click the Close button.
8. Click the Close button again.
9. You will be prompted to restart the computer. Click Yes.
NOTE: The Restore Utility will now be disabled.
10. Restart the computer in Safe Mode.
11. Run a scan with VirusScan to delete all infected files, or browse the
file's located in the C:\_Restore folder and remove the file's.
12. After removing the desired files, restart the computer normally.
NOTE: To re-enable the Restore Utility, follow steps 1-9 and on step 5
remove the check mark next to "Disable System Restore". The infected file's
are removed and the System Restore is once again active.
Variants
Name  Type  Sub Type  Differences
no known variants
Aliases
Name
I-Worm.Magistr (CA)
Magistr (F-Secure)
PE_MAGISTR.A (Trend)
W32.Magistr.24876@mm (Symantec)
W32/Disemboweler (Panda)
W32/Magistr-a (Sophos)

Description Added:  03/13/2001
[cut]
Principa' prova a postare su it.comp.sicurezza.virus
dove sicuramente sapranno cosa fare.

 dove sicuramente sapranno cosa fare.
Credo ci sia scritto... perchè indica alcuni passi... 1), 2). 3), etc. . . .
Qualche anima pia che ci dia un occhio e che traduza la parte essenziale ?

 Qualche anima pia che ci dia un occhio e che traduza la parte essenziale ?
Marco smettila!
--
 +-+-+-+
 |R|o|s|
 +-+-+-+
http://web.tiscalinet.it/archngraph

 Marco smettila!
E che mi chiamo, Francesco ?

 wrote in message
zdj47.12366$m06.4...@news.infostrada.it...

No no questa volta io non c'entro. Marco smettila !!!
Fra
--
"Duro destino è l'avere un destino.
L'uomo predestinato avanza e i suoi
passi non possono portarlo che là, al
punto d'arrivo che le stelle hanno fissato
per lui..."
Italo Calvino

 No no questa volta io non c'entro. Marco smettila !!!
Francesco smettila !
E poi io non sono Marco... ma semplicemente Il Principale . . .

 wrote in message
A7n47.13962$m06.5...@news.infostrada.it...

Ok... "Semplicemente" Il Principale smettila !


 Ok... "Semplicemente" Il Principale smettila !
Francesco smettila o vengo a darti lezioni sulle file in mezzo !
...naturalmente approfittando di Debby la modella . . .
" )))

 wrote in message
Yin47.14059$m06.5...@news.infostrada.it...

Guarda che si fa pagare cara. Casomai prendi qualcun'altra come modella.
^___^
Franc' coiffeur
