Bokt.nl

**Geplaatst door de TopicStarter** : 15-06-01 20:15

Geplaatst door de TopicStarter : 15-06-01 20:15

http://www.sarc.com/avcenter/venc/data/ ... 76@mm.html
Iemand heeft een virus. Of dat hier is weet ik niet. Ik weet wel dat ik het virus van onbekenden krijg op mijn supersecret e-mail adres. Ik heb daar in het verleden met Heike, Rieja, en.... vast nog wel een paar, Karin ook... Naja, diegenen moeten dus echt heel goed opletten en even op deze link klikken. Komt het je bekend voor: REAGEER DAN METEEN. Mijn vader heeft het virus gehad, enneh, je bent dan niet happy.
De mails die ik de laatste tijd kreeg zijn allemaal infected (nwe virusscan doet wonderen).
Verder nog een paar tips: print je adresboek (vooral Outlook-gebruikers) uit, en delete alle mensen erin. Af en toe de nieuwen uitprinten, en hou het op papier vast. De meeste virussen verspreiden per adresboek. Zorg er dus ook heel goed voor dat je adresboek klein blijft, de kans dat het vanaf jouw pc verspreidt (en bij dit virus dus in een verder stadium komt) is dan nihil.
Koop ook aub een goede virusscan. Norton is echt geweldig. Pikt ze er gelijk uit.
Mensen, let aub heel goed op. Lees de virusinfo, en wees heel erg attent. Je kunt op veel manieren de kans verkleinen, maar er blijft een kans bestaan....

**Geplaatst**: 15-06-01 22:16

Geplaatst: 15-06-01 22:16

Ik kreeg deze week van iemand ook al een virusmelding, een goede bekende die het per ongeluk had meegstuurd. gelukkig had ik de bijlage niet geopend dus meneer Norton meldde na een zorgvuldige scan dat er niks aan het handje was. Maar er is wel iets in omloop idd.....wij scannen nu alles als we mials binnenkrijgen.

**Geplaatst**: 15-06-01 22:20

Geplaatst: 15-06-01 22:20

Ach ja, als je geen vage attachements opent dan is er niks aan de hand.

Alleen attachements openen waarvan je 100% zeker weet dat ze geen kwaad kunnen (plaatjes, filmpjes) en dus ZEKER GEEN .exe en .vbs enzo..
Ook niet als een bestand:

<pre>
'naked girls.mpg .exe'
</pre>

heten Knipoog

_________________
<FONT COLOR="DARKGREEN">"zelfs Heike, van wie ik 't nooit verwacht had!!!quote maaike"</FONT>

<font size=-1>[ Dit Bericht is bewerkt door: Heike op 2001-06-15 22:21 ]</font>

**Geplaatst**: 15-06-01 22:21

Geplaatst: 15-06-01 22:21

Ik weet dat exlover iets vaags meestuurt, ze zegt dat ze daar niks aan kan doen en niet weet wat het is..??! Ik heb het direct gedelete

**Geplaatst**: 15-06-01 22:29

Geplaatst: 15-06-01 22:29

Symantec AntiVirus Research Center (SARC)
http://www.symantec.com/avcenter

W32.Magistr.24876@mm
Discovered on: March 13, 2001
Last Updated on: April 4, 2001 at 11:55:55 AM PDT

Due to the increased number of submissions, SARC has updated the threat level of this virus from 3 to 4.

W32.Magistr.24876@mm is a virus that has email worm capability. It is also network aware. It infects Windows Portable Executable (PE) files, with the exception of .dll system files, and sends email messages to addresses that it gathers from the Outlook/Outlook Express mail folders (.dbx, .mbx), the sent items file from Netscape, and Windows address books (.wab), which are used by mail clients such as Microsoft Outlook and Microsoft Outlook Express,. The email message may have up to two attachments, and it has a randomly generated subject line and message body.

Also Known As: I-Worm.Magistr, PE_MAGISTR.A, W32.Magistr@mm

Category: Virus, Worm

Infection Length: varies

Virus Definitions: March 13, 2001

Threat Assessment:

Wild:
High Damage:
High Distribution:
High

Wild:

Number of infections: 50 - 999
Number of sites: More than 10
Geographical distribution: Medium
Threat containment: Moderate
Removal: Moderate
Damage:

Payload:
Large scale e-mailing: Uses email addresses from the Windows Address Book files and Outlook Express Sent Items folder.
Causes system instability: Overwrites hard drives, erases CMOS, flashes the BIOS.
Releases confidential info: It could send confidential Microsoft Word documents to others.
Distribution:

Subject of email: Randomly generated text that can be up to 60 characters long.
Name of attachment: One randomly named infected executable and several randomly selected text or document files
Target of infection: All Windows PE files that are not .dll files.

Technical description:

When a file that is infected by W32.Magistr.24876@mm is executed, it searches in memory for a readable, writable, initialized section inside the memory space of Explorer.exe. If one is found, a 110-byte routine is inserted into that area, and the TranslateMessage function is hooked to point to that routine. This code first appeared in W32.Dengue.

When the inserted code gains control, a thread is created and the original TranslateMessage function is called. The thread waits for three minutes before activating. Then the virus obtains the name of the computer, converts it to a base64 string, and depending on the first character of the name, creates a file in either the Windows folder, the Program Files folder, or the root folder. This file contains certain information, such as the location of the email address books and the date of initial infection. Then it retrieves the current user's email name and address information from the registry (Outlook, Exchange, Internet Mail and News), or the Prefs.js file (Netscape). The virus keeps in its body a history of the 10 most recently infected users, and these names are visible in infected files when the virus is decrypted. After this, the virus searches for the Sent file in the Netscape folder, and for .wab, .mbx, and .dbx files in the Windows and Program Files folders.

If an active Internet connection exists, the virus searches for up to five .doc and .txt files and chooses a random number of words from one of these files. These words are used to construct the subject and message body of the email message. Then the virus searches for up to 20 .exe and .scr files smaller than 128 KB, infects one of these files, attaches the infected file to the new message, and sends this message to up to 100 people from the address books. In addition there is a 20-percent chance that it will attach the file from which the subject and message body was taken, and an 80-percent chance that it will add the number 1 to the second character of the sender address. This last change prevents replies from being returned to you and possibly alerting you to the infection.

After the mailing is done, the virus searches for up to 20 .exe and .scr files, and infect one of these files. Then there is a 25-percent chance, if the Windows directory is named one of the following:

Winnt
Win95
Win98
Windows
that the virus will move the infected file into the Windows folder and alter the file name slightly. Once the file is moved, a run= line is added to the Win.ini file to run the virus whenever the computer is started. In the other 75 percent of cases, the virus will create a registry subkey in

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun

The name of this subkey is the name of the file without a suffix, and the value is the complete file name of the infected file. The virus then searches all local hard drives and all shared folders on the network for up to 20 .exe and .scr files to infect, and add the run= line if the Windows folder exists in that location.

If the computer has been infected for one month and at least 100 people have been sent an infected file, and if at least three files contain at least three examples from the following list:

sentences you
sentences him to
sentence you to
ordered to prison
convict
, judge
circuit judge
trial judge
found guilty
find him guilty
affirmed
judgment of conviction
verdict
guilty plea
trial court
trial chamber
sufficiency of proof
sufficiency of the evidence
proceedings
against the accused
habeas corpus
jugement
condamn
trouvons coupable
a rembourse
sous astreinte
aux entiers depens
aux depens
ayant delibere
le present arret
vu l'arret
conformement a la loi
execution provisoire
rdonn
audience publique
a fait constater
cadre de la procedure
magistrad
apelante
recurso de apelaci
pena de arresto
y condeno
mando y firmo
calidad de denunciante
costas procesales
diligencias previas
antecedentes de hecho
hechos probados
sentencia
comparecer
juzgando
dictando la presente
los autos
en autos
denuncia presentada

then the virus will activate the first of its payloads. This payload is similar to that of W32.Kriz, and it does the following:

Deletes the infected file
Erases CMOS (Windows 9x/Me only)
Erases the Flash BIOS (Windows 9x/Me only)
Overwrites every 25th file with the text YOUARESHIT as many times as it will fit in the file
Deletes every other file
Displays the following message:

Overwrites a sector of the first hard disk
This payload is repeated infinitely.

If the computer has been infected for two months, then on odd days the desktop icons are repositioned whenever the mouse pointer approaches, giving the impression that the icons are "running away" from the mouse:

If the computer has been infected for three months, then the infected file is deleted.

For files that are infected by W32.Magistr.24876@mm, the entry point address remains the same, but up to 512 bytes of garbage code is placed at that location. This garbage code transfers control to the last section. A polymorphic encrypted body is appended to the last section. The virus is hostile to debuggers and will crash the computer if a debugger is found.

Removal instructions:

To remove this worm:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. If any files are detected as infected by W32.Magistr.24876@mm, choose Repair.
NOTE: This virus contains bugs which will corrupt some files while attempting to infect them, as well as when the first payload activates. These files cannot be repaired; they must be restored from backup.

Write-up by: Peter Ferrie

Afbeelding

**Geplaatst**: 15-06-01 22:48

Geplaatst: 15-06-01 22:48

Heike heeft gelijk. Ik open ook alleen maar bestanden waarvan ik volledig zeker weet dat ze veilig zijn. Foto's worden in Hotmail trouwens automatisch weergegeven (in Outlook Express ook trouwens). Ik wil er nog een veilig bestandsformaat aan toevoegen, mp3-bestanden.