Bryggaren - forum för öl och bryggning

VARNING!

Inlägget som skickades tidigare idag med "Mats Lindback" som avsändare
innehåller med största sannolikhet ett "datavirus" (strikt talat en så
kallad mask).

RADERA detta brev och KÖR INTE PROGRAMMET "Pretty Park.exe"!

Om du gör detta kommer programmet att försöka skicka sig självt till alla
mailingslistor i din adressbok var 30:e minut. Det kan också försöka öppna
en IRC-förbindelse till en server, varifrån det kan hämta nya
instruktioner. Det kan då förse programmets skapare med information om din
dator.

Jag bifogar ett urklipp från sidan
http://pewi.mksit.mil.se/virusinfoarkiv(1).htm

med mer information om Pretty Park, och instruktioner för hur man tar
bort det om man drabbats.

Programmet infekterar enbart PC-datorer med Windows95/98/NT/2000. Jag kör
inte själv PC, och kan inte besvara några frågor om problemet. Jag skickar
denna varning bara för att jag tror att den kan minska skaden av det som
inträffat.

Jakob Carlström

P.S. "Mats Lindback" är säkert oskyldig till spridningen. Han har nog bara
haft oturen att själv drabbas av masken, som sedan spritt sig vidare.

----------
VARNING 990929 1 St

Virus Name
W32/Pretty.Worm

http://vil.nai.com/vil/vpe10175.asp

Date Added
6/8/99

Virus Characteristics

This is a worm that infects Windows 9x/NT files. It arrives via email from
infected users.

Indications Of Infection

This program, when run, will display a "3D Pipe" screen saver and then
will copy itself to FILES32.VXD in WINDOWS\SYSTEM folder. It then modifies
the registry key value "command" located in the location:
HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open from "%1" %* to
FILES32.VXD "%1" %*. This in essence will cause the FILES32.VXD to run
during the execution of any exe file. This worm will try to email itself
automatically every 30 minutes to all email addresses listed in the
Internet address book. A second function of this worm is that it will also
try to connect to an IRC server and join a specific IRC channel. While
connected, this worm tries to stay connected by sending information to the
IRC server, and will also retrieve any commands from the IRC channel.
While on the determined IRC server, the author of this worm could use the
connection as a remote access trojan in order to get information such as
the computer name, registered owner, registered organization, system root
path, and Dial Up Networking username and passwords. Method Of Infection
Direct execution of the file "Pretty Park.exe". Removal Removal is a
manual process. Use the following registry information to repair the now
modified system registry. Open NOTEPAD and cut and paste this info into a
NOTEPAD file; make sure that after the content is pasted into the file
that the format is not all on one line. Save the NOTEPAD file as
"undo.reg" to the desktop. Double click this file to repair the registry.

----------begin,cut after this line----------

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command]
(snabela)="\"%1\" %*"

----------end,cut before this line---------

* AVERT Note *
In notepad if you cut and paste this information it will paste as such

REGEDIT4
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command]
(snabela)="\"%1\" %*"

The problem here is that the .reg file will not work this way. It must
be exactly the way it shown between the dashed lines. After repairing
the registry, delete the files FILES32.VXD and PrettyPark.exe. Reboot
the computer. Failure to repair the registry will cause applications
not to run.
---