Mittente: Microsoft - security@microsoft.com

[Glide]

Non è una novità ma mi giunge segnalazione che questo virus, classificato come Win32.Dumaru.A@mm, sta ancora girando per cui credo sia opportuno tornarci su.

Ecco ciò che occorre sapere per la rimozione manuale:

__________________________

Symptoms:

Presence of the files

%WINDOWS%\dllreg.exe
%SYSTEM%\load32.exe
%SYSTEM%\vxdmgr32.exe
%WINDOWS%\windrv.exe

where %WINDOWS% points to Windows folder (Win9x/Me) or Winnt folder (Win2K/XP).


Presence of the value

"load32"=%SYSTEM%\load32.exe"

in the registry key

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]

where %SYSTEM% points to System folder (Win9x/Me) or System32 folder (Win2K/XP).
Technical description:
The virus arrives as a fake email from Microsoft:

From: "Microsoft" security@microsoft.com

Subject: Use this patch immediately !

Body:

Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!

Attachment: patch.exe

When executed, the virus will do the following:



Copy itself as:
%SYSTEM%\load32.exe
%WINDOWS%\dllreg.exe
%SYSTEM%\vxdmgr32.exe


Drops and executes a backdoor component

%WINDOWS%\windrv.exe (8192 bytes)

which connects to a IRC server and joins a password protected channel, sends a login notice and waits for the author to issue commands.


Creates the value

"load32"="%SYSTEM%\load32.exe"

in the registry key

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]


On Windows 9x/Me systems, it does the following:

uses RegisterServiceProcess to hide its presence;


modifies system.ini by adding the entry in the [Boot] section:

shell=explorer.exe %System%\vxdmgr32.exe

modifies win.ini by adding the following entry in the [Windows] section:

run=C:\WINDOWS\dllreg.exe


__________________________


Per i più pigri esistono dei tool dedicati per la disinfezione. Ve ne allego uno (file.zip, 53kb) compatto e funzionale [URL="[url="https://www.forumzone.it/attachment_legacy.php?dir=Glide&file=20031124182044_Antidumaru-EN.zip"]https://www.forumzone.it/attachment_legacy.php?dir=Glide&file=20031124182044_Antidumaru-EN.zip[/url]][/URL]

Questo programmino e le info sul virus Win32.Dumaru.A@mm sono state tratte dal sito http://www.bitdefender.com/