Sziasztok!!

A mai napon a Top Gun repulos litan keresztul virustamadas aldozatai
lettunk.
Rita ebersege, Bassssszus "ongsm" segitsege es 40 ev rutinja nyoman
sikerult
kivedeni a bajt!!

Az alabbiakban olvashatjatok a Rita altal gyorsan lekormolt
ellenintezkedesi javallatokat!!

Figyelem!!

A legeslegfontosabb ovintezkedes:

MINDEN MELLEKLETTEL ERKEZO LEVEL GYANUSKENT KEZELENDO!!!!!!!!!!!!!!!!!

Ime Rita levele:

Sziasztok!

Haat, eredetileg szep nyugis estet terveztem magamnak. Inkabb nem
illusztralom, hogy mi lett belole. Hat ora szivas es virusirtas, viszont
hal Istennek most mar elmondhatom, hogy adatvesztes nelkul tul vagyunk a
dolgon.

Azoknak, akik meg nem irtottak le, es meg nem veszett el semmijuk, hasznos
lehet par tanacs.

Az ftp://ftp.europe.F-Secure.com/anti-virus/tools/naviddis.reg fajlt
letoltve es futtatva visszairja a registrybe a regi adatokat.
Ezutan nyissatok meg a Task Managert (magyarul fogalmam sincs, hogy
hivjak), a mesterharmas (vagyis Ctrl-Alt-Del) EGYSZERI megnyomasaval, es
toroljetek minden "Navidad" es "Winsvrc" feladatot. Ezutan inditsatok ujra
a Windowst tiszta bootlemezrol, es toroljetek a kovetkezo ket fajlt:
WINSVRC.VXD (a Windows\System konyvtarban)
NAVIDAD.EXE (elvileg a Windows\System konyvtarban, nekem a Temp konyvtarban
volt).

Ezutan a gep elvileg tiszta.
Mellekelem a hozzaerto elvtarsak altal krealt teljes irtasi utmutatot, ami
a http://www.europe.f-secure.com/v-descs/navidad.htm cimen is olvashato.

Par trukk:

En a szemekre es a furcsa uzenetekre figyeltem fel. Ezutan a virus nem
akarta engedni az .exe fajlok futtatasat, arra hivatkozva, hogy nem talalja
a winsvrc.exe fajlt. Huszarvagas: lemezrol bootolva a Windows\System
konyvtarban megtalalt winsvrc.vxd fajlrol winsvrc.exe neven csinaltam egy
masolatot ugyanabban a konyvtarban, igy be tudtam inditani a Windowst, es -
rejtelyes modon - az Internet Explorer ikonrol mukodott. Igy le tudtam
tolteni a netrol a virusirtom frissiteset (ami nem tudta irtani), majd a
fenti naviddis.reg fajlt. Kozben tengernyi szem figyelt a talcarol.

A VIRUS A NETEN TALALT INFO SZERINT 10, AZAZ TIZ NAPOS!!!!!

A frissitett virusirtonak annyi haszna megis volt, hogy felismerte es
blokkolta a virust, de emiatt nem engedett semmi programot elindulni,
kiveve persze az IExplorert.

A munka nagyjat DOS alatt kell elvegezni, ezert mindenkeppen kell egy
tiszta bootlemez.


Sok sikert! Remelem, sikersztorik is lesznek. Itt es most inkabb nem
fejtenem ki, mi a velemenyem a raero idejukben virusirassal szorakozo
"programozokrol".


Alabb az angol "recept":

Secure Virus Descriptions

NAME: Navidad
ALIAS: I-Worm.Navidad, W32/Watchit.intd, I-Worm_Navidad, W32/Navidad
SIZE: 32768

Navidad is an Internet worm. It spreads itself as NAVIDAD.EXE attachment to
e-mail messages sent from an infected computer. The icon of the worm´s
executable file looks like that:

The original worm sample that we received has a bug that makes an infected
system inoperable after infection - no EXE files could be started.

Being run the NAVIDAD.EXE file installs itself as WINSVRC.VXD into
\Windows\System directory and modifies several Registry keys. It changes
the default EXE file startup key


to make sure it starts with every EXE file. The worm also makes sure it is
always run on each Windows startup by creating another startup key in


The worm also creates ´Navidad´ key in the following section:

[HKEY_CURRENT_USER\Software]

But there´s a bug in the worm´s code - the Registry keys are created for
WINSVRC.EXE file while the worm installs itself as WINSVRC.VXD file. As a
result no EXE files can be started in a system after infection. Also the
worm doesn´t get activated on next Windows startup. To fix the mess done by
this worm, download and run the special REG file. It will restore the
default EXE file startup key value and remove worm´s autostart key too.

ftp://ftp.europe.F-Secure.com/anti-virus/tools/naviddis.reg

During installation the worm displays a fake error message:

"U!"

After a user presses ´OK´, an ´eye´ icon appears in Windows taskbar.

This is the major sign that indicates Navidad worm infection in a system.
When a user clicks on that icon the following dialog box with ´Nunca
presionar este boton´ text is displayed, and when the only button in the
above dialog box is clicked, another messagebox with ´Lamentablemente cayo
en la tentacion y perdio si computadora´ text appears.

When the worm is activated it connects to MAPI-compatible e-mail browser
using MAPI32.DLL library, enumerates all unread e-mails, gets e-mail
addresses from them and sends itself out to these addresses.

This worm is rather easy to delete from an infected system. You first need
to run the REG file (see above), then open Task Manager and kill all
´NAVIDAD´ and ´WINSVRC´ tasks there. Then the worm´s files NAVIDAD.EXE and
WINSVRC.VXD can be deleted manually or by FSAV without any problem.

[Analysis: Alexey Podrezov, F-Secure; November 2000]