Newsgroup: it.scienza.astronomia.amatoriale
Titolo: OT Importante - VIRUS

Salve gente, premetto che questa non è una bufala.
In questi giorni si sta avendo una larga diffusione del Worm W32.Klez.H@mm,
che rimbalza da un pc all'altro attraverso messaggi di posta elettronica.
Io stesso sto ricevendo diverse email infettate da questo virus (dal
mittente anonimo),  che il Norton Antivirus 2002 prontamente mi segnala e
blocca.
Pertanto consiglio a tutti (se non l'avete già fatto, se non avete un
antivirus aggiornato ma anche se lo avete) di scaricare e lanciare il tool
di rilevamento e rimozione, sviluppato da Symantec, e che trovate alla
pagina
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.too
l.html
 o che potete scaricare direttamente cliccando su
http://securityresponse.symantec.com/avcenter/FixKlez.com
 .
Non sottovalutate l'importanza di questa operazione. Ciao!
Giuseppe De Falco

Grazie
Io consiglierei sempre di leggere prima il tutorial innanzitutto e poi
scaricarlo dal link che tu, gentilmente, hai postato.
--------
To obtain and run the tool
NOTE: You must have administrative rights to run this tool on Windows NT
4.0, Windows 2000, or Windows XP.
  1. Download the FixKlez.com file from
http://securityresponse.symantec.com/avcenter/FixKlez.com
.
  2. Save the file to a convenient location, such as your download folder or
the Windows desktop (or, if possible, removable media that is known to be
uninfected).
  3. To check the authenticity of the digital signature, refer to the
section The digital signature.
  4. Close all programs.
  5. If you are on a network or if you have a full-time connection to the
Internet, disconnect the computer from the network and the Internet.
  6. If you are running Windows Me or Windows XP, then disable System
Restore. Refer to the section System Restore option in Windows Me/XP for
additional details.
  NOTE: If you are running Windows Me/XP, Symantec strongly recommends that
you do not skip this step.
  7. Restart the computer in Safe mode (all versions of Windows except
Windows NT). For instructions, read the document for your version of
Windows.
    a.. How to start Windows XP in Safe mode.
    b.. How to start Windows 2000 in Safe mode.
    c.. How to restart Windows 9x or Windows Me in Safe mode.
  8. Double-click the FixKlez.com file to start the removal tool.
  9. Click Start to begin the process, and allow the tool to run.
  10. Restart the computer normally.
  11. Next, you must reinstall NAV. For consumer products such as NAV
2000/2002/2002, follow the instructions in the document How to restore
Norton AntiVirus after removing a virus. For Enterprise versions, contact
your system administrator.
  12. Run LiveUpdate to make sure that you are using the most current virus
definitions, and scan the computer again. If NAV detects any infected files
and cannot repair them, then choose to delete the files.
  13. If you are running Windows Me/XP, re-enable System Restore.
NOTE:The removal procedure might be unsuccessful if Windows Me/XP System
Restore was not disabled as previously directed because Windows prevents
System Restore from being modified by outside programs. Because of this, the
removal tool might fail. If W32.Klez.gen@mm was activated before you ran the
removal tool, in most cases you will not be able to start Norton AntiVirus
(NAV). The instructions for running NAV from the command line and
reinstalling NAV are in the removal section of the W32.Klez.E@mm writeup.
When the tool has finished running, you will see a message that indicates
whether the computer was infected by variants of W32.Klez@mm and/or variants
of W32.ElKern. If an infection was removed, the program displays the
following results:
  a.. The total number of the scanned files
  b.. The number of deleted files
  c.. The number of repaired files
  d.. The number of viral processes terminated
  e.. The number of viral services deleted
--------------------
--
Giampiero Mascelli
Programma Monitoraggio Pianeti
http://space.tin.it/scienza/hgmascel
Versione precedente:
http://web.tiscalinet.it/MGP-ELYstudios
"Han" <gdf...@tiscaliNOSP4M.it> ha scritto nel messaggio
news:wpJJ8.11165$b4.2...@news2.tin.it...


E come giustamente fa notare Giampiero
LEGGETE PRIMA IL TUTORIAL


