| "Autor" |
Habm Virus----> Gegenmittel`? |
|
|
|
geschrieben am: 14.07.2002 um 13:15 Uhr
|
|
Hallo,
es ist dringend:
ich habe den Virus: Worm.P2P.Surnova.b
Ich möchte wissen, was der macht, und wie ich ihn bekämpfen kann
Beitrag wurde von xeena am 14.07.2002 um 17:22 Uhr aus dem Forum Treffpunkt verschoben. |
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 14.07.2002 um 13:33 Uhr
|
|
| frag mal den Doc der weiß vielleicht was! |
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 14.07.2002 um 13:40 Uhr
|
|
|
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 14.07.2002 um 13:40 Uhr
|
|
ich nehme an, sie meint doc knock ..
V. |
| ich bin verantwortlich für das, was ich sage, nicht für das, was DU verstehst! |
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 14.07.2002 um 13:43 Uhr
|
|
| er schreibt sich im ICQ DR:Knock |
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 14.07.2002 um 13:48 Uhr
|
|
ahhh... unser Docktor! *knuddel*
Geändert am 14.07.2002 um 13:49 Uhr von Mausi-4 |
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 14.07.2002 um 14:02 Uhr
|
|
hier mal was kopiert:
Worm.P2P.Surnova
--------------------------------------------------------------------------------
This is a worm that replicates using the Windows Messenger and Kazaa network software. It replicates by copying itself to the Kazaa shared folder and by sending its copies via the Windows Messenger.
Installation
When the worm is launched for the first time, it tries to copy itself to the Windows directory with one of the following names:
Alles-ist-vorbei.exe
Desktop-shooting.exe
Hello-Kitty.exe
BigMac.exe
Cheese-Burger.exe
Blaargh.exe
The worm sets its copy up to be executed automatically when Windows starts by writing the following registry value:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
Supernova=(one of the file names specified above)
The worm also shows a fake error message:
(worm's file name)
------------------
Application attempted to read memory at 0xFFFFFFFFh
Terminating application
Replication: Kazaa network
The worm tries to obtain the name of the Kazaa shared directory from the system registry. If it doesn't exist, it uses the Media folder located in the Windows directory instead of the Kazaa shared directory name. Then, it copies itself to that directory with the following names:
Windows XP key generator.exe
Windows XP serial generator.exe
Key generator for all windows XP versions.exe
Warcraft 3 ONLINE key generator.exe
Half-life ONLINE key generator.exe
Quake 4 BETA.exe
Grand theft auto 3 CD1 crack.exe
GTA3 crack.exe
Battle.net key generator (WORKS!!).exe
Warcraft 3 battle.net serial generator.exe
Half-life WON key generator.exe
Star wars episode 2 downloader.exe
Winzip 8.0 + serial.exe
Winrar + crack.exe
Britney spears nude.exe
Macromedia MX key generator (all products).exe
KaZaA media desktop v2.0 UNOFFICIAL.exe
Microsoft key generator, works for ALL microsoft products!!.exe
Microsoft Windows XP crack pack.exe
Hack into any computer!!.exe
DivX codec v6.0.exe
DivX newest version.exe
DivX.exe
DivX pro key generator.exe
Key generator for over 1,000 applications (really!).exe
DivX patch - Increases quality.exe
KaZaA spyware remover.exe
Age of empires 2 crack.exe
Norton antivirus 2002.exe
Macromedia Dreamweaver MX Key Generator.exe
Macromedia Flash MX Key Generator.exe
Microsoft Office XP (english) key generator.exe
Microsoft Office XP.iso.exe
CloneCD + crack.exe
CloneCD all-versions key generator.exe
XBOX emulator (WORKS!!).exe
Gamecube Emulator (WORKS!!).exe
Xbox.info.exe
Replication: Windows Messenger
If there is an active copy of Windows Messenger, the worm tries to send its copies to the recipients of the Messenger contact list, with one of the accompanying messages:
Hehe, check this out :-)
Funny, check it out (h)
LOL!! See this :D
LOL!! Check this out :)
Other
Each time the worm is launched outside the Windows directory it creates a text file in the Windows directory with a random name consisting of digits and with the ".txt" extension (for example, "8787333302.txt"). The contens of the file are the following:
W32.Supernova
---------------------------------------------------
'Patch the leaks or the ship will sink'
---------------------------------------------------
Depending upon random counters, the worm may also show the following message:
Just checkin' the walls...
--------------------------
Patch the leaks or the ship will sink
|
|
|
|
|
|
|
Top
|
| "Autor" |
|
|
|
|
geschrieben am: 15.07.2002 um 03:12 Uhr
|
|
| besser die würmer zum angeln nimmt.gg |
|
|
|
|
|
|
Top
|
