Newsgroup: it.fan.matrix
Titolo: Forrest...

.... mi traduci x paiacere?
AVERT Labs - Beaverton
Current Scan Engine Version:4.4.00
Current DAT Version:4541
Thank you for your submission.
Analysis ID: 1862821
File Name            Findings                       Detection
Type         Extra
--------------------|------------------------------|------------------------
----|------------|-----
bluetooth16.ref     |current detection             |w32/kalel.gen@mm
|Virus       |no   
current detection [bluetooth16.ref]
   We have detected a MIME encoded e-mail file, which contains an
attachment. To detect   
malware in a MIME encoded file you need to use an e-mail scanning
product
such as      
VirusScan's E-mail Scanner, WebShield, or GroupShield. The file
received is
infected   
and can be detected and removed with our current DAT files and engine.
It is
recommended that you update your DAT and engine files and scan your
computer
again. If 
you are not seeing this with the product you are using, please speak
with
technical    
support so that they can help you determine the cause of this
discrepancy.
If you use the McAfee VirusScan Online or VirusScan Retail retail
products,
and do not 
have the Dat File Version specified, please send an e-mail to
extr...@avertlabs.com
 
to request an extra.dat for your product. You must include the
Analysis ID
number      
found in the subject line of this message to receive the extra.dat
file.
To find detailed information about viruses and other malware, please
review
AVERT's    
Virus Information Library:
http://vil.mcafeesecurity.com
In order to get the fastest possible response, you may wish to submit
future
virus-samples to:
https://www.webimmune.net/default.asp
In most cases it can respond almost instantly with a solution. This
may also
be the    
best option if you are having a problem with gateway scanners
stripping your
sample    
submission.
If you believe your computer is infected, but are unsure which files
should
be         
submitted to AVERT for review, please visit:
http://vil.mcafeesecurity.com/vil/submit-sample.asp
For other virus-related information, please review the AVERT homepage
at:
http://www.avertlabs.com
Support -
Virus Research accepts file-samples for analysis and possible
inclusion into
AV        
signature DAT sets. We are also prepared to answer general virus
questions.
All        
product-related questions and comments can be addressed through
technical
support and  
customer service, including:
* Product installation and update questions
* Product usage questions
* Specific operating system/version questions
* Assistance with detection and cleaning or removal of viruses or
trojans
Use the following link to update your DAT and scan engine to the most
current version: 
http://www.mcafeesecurity.com/us/downloads/updates/
Use the following links to reach online technical support for McAfee
products -        
Corporate Customers:
http://www.mcafeesecurity.com/us/support/
Single User/Retail Customers:
http://www.mcafeehelp.com
Note -
Due to the prevalence of network gateway AV products, it is important
that
all         
submissions be zipped and the zip file password-protected (password -
infected). Some  
products will reject an email that contains a virus that is not sent
in this
way. In   
addition, often we receive a file that appears not to have been
infected, to
find      
later that the file was infected when it left the sender, and was
cleaned
somewhere    
along the line.
Regards,
McAfee AVERT tm
A division of McAfee, Inc
-- 
Logan75 
Messenger: 
lo...@hotmail.it
Membro Ogame dell'Alleanza ICCP 
*EiacuLand e'la mia terra e nessuno mai la conquistera'!*

 and engine files and scan your computer again.
dice che il file č infetto e puoi rimuovere il virus usando l'ultimo DAT
file, per cui ti raccomandano di aggiornare l'antivirus e di fare
nuovamente la scansione del pc.
-- 
*Forrest*
i miei pianeti :-)
http://razielweb.altervista.org/home/member.php?u=4

nuovamente la scansione del pc.
L'ho fatto ma i file me li mette in quarantena ma non me li
disinfetta....


 disinfetta....
che versione di McAfee hai messo?
sono file importanti oppure è il virus? non puoi eliminarli al posto di
metterli in quarantena?
hai controllato con il msconfig i file in avvio per vedere che non ci sia
niente che rigeneri i file al prossimo avvio del pc?
Ma soprattutto, hai disattivato il ripristino della configurazione di
sistema in fase di pulizia?


nuovamente la scansione del pc.
L'ho fatto ma i file me li mette in quarantena ma non me li
disinfetta....


sistema in fase di pulizia?
Si


 .... mi traduci x paiacere?
sě ma cheppalle
non credi di  esagerare? 

 irdav1.ref (in
OK elimina :-)
C:\windows\system32\bluetooth16.ref (Unencoded zip copy of the worm)
C:\windows\system32\bluetooth32.ref (Unencoded zip copy of the worm)
C:\windows\system32\irdav1.ref (Unencoded zip copy of the worm)
vedi se per caso hai anche questi file ed eventualmente eliminali
C:\windows\system\bluetooth32.dll (1 byte in length)
C:\windows\system32\kerneldump.ref (Keystroke log)
C:\windows\system32\mouse_irda64.dat
C:\windows\system32\mouse_irda32.ocx
C:\windows\system32\mouse_irda16.ref
C:\windows\system32\bluetooth1_3.zip
C:\windows\system32\bluetooth1_2.zip
C:\windows\system32\bluetooth1_1.zip
C:\windows\system\bluetooth16.dll
controlla il registro di configurazione ed elimina queste chiavi se
presenti
- "Microsoft Authority Service" = "%Windir%\system\lsass.exe" in 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- "Microsoft Session Manager Subsystem" = "%Windir%\system\smss.exe" in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- "Microsoft Service Controller" = "%Windir%\system\services.exe" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- "Wxp4", "HELLBOT TEST", "winshost.exe", "Norton Antivirus AV" e
"WinStart" in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- "WinStart" = "winshost.exe" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- "HELLBOT TEST" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
infine vedi che il virus non sia copiato in queste cartelle
C:\programmi\eMule\Incoming
C:\programmi\gnucleus\downloads\incoming
C:\programmi\gnucleus\downloads
C:\programmi\KMD\my shared folder
C:\programmi\BearShare\Shared
C:\programmi\KaZaa Lite\My Shared Folder
C:\programmi\KaZaa\My Shared Folder
C:\programmi\Morpheus\my shared folder
C:\programmi\eDonkey2000\incoming
C:\programmi\direct connect\received files
C:\programmi\grokster\my shared folder
C:\programmi\grokster\my grokster
C:\programmi\limeWire\shared
C:\programmi\icq\shared files
C:\programmi\StreamCast\Morpheus\my shared folder
C:\programmi\rapigator\share
C:\programmi\shareaza\downloads
C:\programmi\Ares\My Shared Folder
C:\programmi\rapigator\share
C:\programmi\shareaza\downloads
C:\My Shared Folder
C:\programmi\Ares\My Shared Folder
C:\shared
C:\My Downloads


 non credi di  esagerare?
LOL
quando il duello tietro il convento delle carmelitane scalze???
-- 
Lurker
     /)/)         
http://snipurl.com/fman
   (  °.°)     Sorry, I DON'T speak english 8-(
 o(_('')('')     ... e nemmeno l'italiano 8-(((

 quando il duello tietro il convento delle carmelitane scalze???
perchč te ne sei andato? :( 

 perchè te ne sei andato? :(
il problema VERO è se me ne vado da OGAME: non sono tanto di umore "giusto"
8(


 "giusto" 8(
non mi hai risposto (come mi aspettavo)