Non è una novità ma mi giunge segnalazione che questo virus, classificato come Win32.Dumaru.A@mm, sta ancora girando per cui credo sia opportuno tornarci su.
Ecco ciò che occorre sapere per la rimozione manuale:
__________________________
Symptoms:
Presence of the files
%WINDOWS%\dllreg.exe
%SYSTEM%\load32.exe
%SYSTEM%\vxdmgr32.exe
%WINDOWS%\windrv.exe
where %WINDOWS% points to Windows folder (Win9x/Me) or Winnt folder (Win2K/XP).
Presence of the value
"load32"=%SYSTEM%\load32.exe"
in the registry key
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
where %SYSTEM% points to System folder (Win9x/Me) or System32 folder (Win2K/XP).
Technical description:
The virus arrives as a fake email from Microsoft:
From: "Microsoft" security@microsoft.com
Subject: Use this patch immediately !
Body:
Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!
Attachment: patch.exe
When executed, the virus will do the following:
Copy itself as:
%SYSTEM%\load32.exe
%WINDOWS%\dllreg.exe
%SYSTEM%\vxdmgr32.exe
Drops and executes a backdoor component
%WINDOWS%\windrv.exe (8192 bytes)
which connects to a IRC server and joins a password protected channel, sends a login notice and waits for the author to issue commands.
Creates the value
"load32"="%SYSTEM%\load32.exe"
in the registry key
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
On Windows 9x/Me systems, it does the following:
uses RegisterServiceProcess to hide its presence;
modifies system.ini by adding the entry in the [Boot] section:
shell=explorer.exe %System%\vxdmgr32.exe
modifies win.ini by adding the following entry in the [Windows] section:
run=C:\WINDOWS\dllreg.exe
__________________________
Per i più pigri esistono dei tool dedicati per la disinfezione. Ve ne allego uno (file.zip, 53kb) compatto e funzionale [URL="https://www.forumzone.it/attachment_legacy.php?dir=Glide&file=20031124182044_Antidumaru-EN.zip](https://www.forumzone.it/images/misc/attach_legacy.gif)[/URL]
Questo programmino e le info sul virus Win32.Dumaru.A@mm sono state tratte dal sito http://www.bitdefender.com/